Password Rotation fails with minimum password length exceeding 20 Characters for NSX Manager accounts

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• Password rotation for NSX local admin accounts may fail with the below error 
  Specified password invalid: BAD PASSWORD: is too simple.
  
  
• /var/log/vmware/vcf/operationsmanager/operationsmanager.log may have the below entries
  
  [YYYY-MM-DDTHH:MM:SS]  DEBUG [vcf_om,xxxxxxx] [c.v.v.c.a.i.VcfApiTelemetryInterceptor,http-nio-127.0.0.1-7300-exec-7] is public API : true
[YYYY-MM-DDTHH:MM:SS]  DEBUG [vcf_om,xxxxxxx] [c.v.v.p.s.PasswordUpdateHistoryService,http-nio-127.0.0.1-7300-exec-7] Getting password update history with page 1, page size: 2147483647, exclude passwords: true
[YYYY-MM-DDTHH:MM:SS]  DEBUG [vcf_om,xxxxxxx] [c.v.v.p.helper.NsxtApiUtil,om-exec-18] Failed to update NSX user details : { "error_code": 36143, "error_message": "Specified password invalid: BAD PASSWORD: is too simple.", "module_name": "node-services" } with status :  Bad Request
[YYYY-MM-DDTHH:MM:SS]  ERROR [vcf_om,xxxxxxx] [c.v.v.p.u.c.AbstractPasswordChanger,om-exec-18] Specified password invalid: BAD PASSWORD: is too simple.
[YYYY-MM-DDTHH:MM:SS]  ERROR [vcf_om,xxxxxxx] [c.v.v.p.u.c.AbstractPasswordChanger,om-exec-18] Specified password invalid: BAD PASSWORD: is too simple.
  
  
• NSX Manager password policy is configured with a minimum password length greater than 20 characters.

 

Environment

SDDC Manager 5.x 
NSX Manager 4.x

Cause

SDDC Manager enforces a Minimum password length (minlen) of 20 characters by default.

Configuring the NSX Manager auth-policy minimum-password-length to a value exceeding 20 characters causes a conflict. The password generated by SDDC Manager is rejected by the NSX authentication policy, resulting in rotation failure.

Resolution

To resolve this issue, select one of the following approaches based on organizational security mandates:

Option 1: Reduce NSX Minimum Password Length

To restore automated password rotation functionality, reduce the NSX minimum password length to 20 characters or fewer.

Log in to the NSX Manager CLI.
Update the authentication policy: set auth-policy minimum-password-length 20

Option 2: Utilize Manual Password Updates
If organizational security requirements strictly mandate a 32-character minimum length, automated password rotation via SDDC Manager is not supported. Perform manual credential management:

1. Manually update the password on the NSX Manager appliance with 32 characters.
2. In the SDDC Manager UI, navigate to Security > Password Management.
3. Select the Update operation for the NSX admin account.
4. Input the password manually set in step 1 and proceed to update to ensure credential synchronization in the SDDC Manager vault.

Additional Information

As Per VCF design, automated password rotation is unsupported when the minimum password length is set to a value greater than 20.