Active Directory logins fail intermittently due to nested group expansion timeouts in vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

• Users experience intermittent login failures or prolonged login times when attempting to access the vSphere Client using Active Directory credentials.
• The vSphere Client UI displays a generic "Authentication failed" or a connection timeout error, rather than an "Invalid credentials" error.
• Reviewing the Secure Token Service (STS) logs on the vCenter Server (/var/log/vmware/sso/vmware-identity-sts.log) reveals entries similar to the following:

Failed to find nested parent groups for principal: [email protected]

or

ERROR [IdentityManager] Failed to authenticate principal [[email protected]] ... LDAP query timed out during nested group expansion

 

Environment

• vCenter Server 7.0.x
• vCenter Server 8.0.x
• Active Directory over LDAP or LDAPS configured as an Identity Source

Cause

This issue is caused by Active Directory token bloat. The user account attempting to log in belongs to a massive number of nested Active Directory groups.

During authentication, vCenter Server successfully connects and binds to the Domain Controller. However, before vCenter can issue a SAML token, it must recursively query Active Directory to expand and resolve every nested group the user belongs to. If the identity source is configured to search the entire domain root, the Secure Token Service (STS) may hit its maximum execution timeout before the recursive LDAP query finishes, causing the login attempt to fail.

 

Resolution

1. To resolve this issue, you must reduce the LDAP query scope so vCenter does not attempt to map irrelevant nested groups across the entire Active Directory environment.

   This is achieved by narrowing the Base DN (Distinguished Name) in the vCenter Single Sign-On Identity Source configuration:

   1. Log in to the vSphere Client as an administrator (e.g., [email protected]).
   2. Navigate to Menu > Administration > Single Sign-On > Configuration.
   3. Select the Identity Provider tab, then click Identity Sources.
   4. Select your Active Directory identity source and click Edit.
   5. Locate the Base DN for users and Base DN for groups fields.
   6. Change these values from the domain root (e.g., DC=domain,DC=local) to the specific Organizational Units (OUs) that contain your vSphere administrators.
   • Example: OU=vSphereAdmins,OU=IT,DC=domain,DC=local
   7. Click Save to apply the configuration.

   By restricting the Base DN, vCenter will only expand nested groups that exist within the specified OUs, significantly reducing the LDAP query time and preventing the STS timeout.

    

Additional Information

• Is this a bind failure? If your /var/log/vmware/sso/vmware-identity-sts.log file specifically reports LDAP error code 49, the issue is not a nested group timeout. Error 49 indicates an LDAPS bind failure (usually due to an expired LDAP service account password). For bind failures, refer to Broadcom KB 401985.
• For instructions on generating log bundles to review STS logs, refer to Broadcom KB 326299: Collecting diagnostic information for ESXi hosts and vCenter Server using the vSphere Client.