vCenter logins are very slow and intermittently getting failed with error [400] An error occurred while sending an authentication request.

Products

• VMware vCenter Server

Issue/Introduction

1. Login to vCenter was very slow
2. Login to vCenter intermittently got failed with error [400] An error occurred while sending an authentication request.
3. STS cervice crashed several times and applmgmt can not start successfully.
4. In the vmware-identity-sts.log:
   [com.vmware.identity.idm.server.ServerUtils] cannot establish ldap connection with URI: [ldaps://<AD>:636] because [com.vmware.identity.interop.ldap.ServerDownLdapException] with reason [Can't contact LDAP server] therefore will try to attempt to use secondary URIs, if applicable

Environment

vCenter 8.x

Cause

STS shares 150 worker threads with other modules. Each login attempt against a dead DC held a worker thread before timing out. With enough concurrent attempts, the 150-thread pool filled. Once the pool was exhausted, local system logins and internal authentication requests were forced to queue behind the pending AD requests, causing them to time out.

Applmgmt needs a quick SSO round-trip at startup to verify its own privileges (depending on sts). With SSO starved, that call didn't return, its health probe failed, vMon restarted it and the restart hit the same stuck SSO.

Resolution

1. Check AD DNS record and /etc/hosts file
2. Validate Network Connectivity: curl -v telnet://<DC_FQDN>:389 (or 636 for LDAPS) from the VCSA shell to confirm the path is open.

Additional Information

Reference vCenter UI Inaccessible and STS service crashing