Site pairing fails with aps.fault.InvalidLogin due to Windows AD NTP time skew - Protection and Recovery
search cancel

Site pairing fails with aps.fault.InvalidLogin due to Windows AD NTP time skew - Protection and Recovery

book

Article ID: 452651

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

When attempting to create a new site pair between two sites using Protection and Recovery 9.1.0, the operation fails. The primary symptom is an authentication failure during the service discovery phase of pairing.

Symptoms:

  • Attempts to create a site pair fails with the below error message.

    Method.aps.site.SiteManager.getServicesForPairing threw undeclared fault of type aps.fault.InvalidLogin

  • The /opt/vmware/support/logs/aps/aps-service.log reports below events indicating time difference of more than 30 seconds across the sites.

    INFO aps-service 11412 [ApsService@4413 sub="vmomi.soapStub [280]" opID="2b028#####################################################"] SOAP request returned HTTP failure; <SSL(<io_obj t:N7Vmacore6System19TCPSocketObjectAsioE, h: 198, <TCP '###.###.###.### : 48400'>, <TCP '##.##.##.# : 443'>>), /drserver/vcdr/vmomi/sdk>, method: loginByToken; code: 500 (Internal Server
    Error) ; fault: (dr.fault.InvalidTokenLifetime) {
    -->     faultCause = (vmodl. MethodFault) null,
    -->     faultMessage = <unset>,
    -->     from = "2026-08-17T09:24:21.046Z"
    -->     to = "2026-08-17T17:24:21.046Z",
    -->     now ="2026-08-17T09:23:49.040707Z",
    -->     tolerance = "30000"
    -->     msg = "Received SOAP response fault from [<SSL(<io_obj t:N7Vmacore6System19TCPSocketObjectAsioE, h: 198, <TCP '###.###.###.###:48400'>, <TCP '##.##.##.#:443'>>), /drserver/vcdr/vmomi/sdk>]: loginByToken
    --> The received single sign-on token [MASKED TOKEN] valid from '2026-08-17T09:24:21.046Z' to '2026-08-17T17:24:21.046Z'. It is currently '2026-08-17T09:23:49.040707Z'. The tolerance is 30000 milliseconds."
    --> }
    ...............
    ERROR aps-service 11412 [ApsService@4413 sub="Req@internalaps/2.0" opID="2b028#####################################################"] Method aps. site.SiteManager.getServicesForPairing threw undeclared fault of type aps. fault. InvalidLogin

Environment

  • Protection and Recovery 9.1

  • VMware Live Site Recovery 9.x

  • Environment: Air-gapped network configuration

  • NTP Source: Windows Active Directory Domain Controller

Cause

The issue is caused by a time difference across sites exceeding the 30 second (30,000 milliseconds) tolerance required for SAML token validation. In air-gapped environments, a Windows AD server acting as an NTP source may not be recognized as a reliable time source by Photon OS-based appliances if the default clock dispersion and announcement flags are used. This results in the appliances failing to synchronize immediately even after the Windows clock is manually adjusted.

Resolution

To resolve the synchronization issues, update the Windows AD registry to force the server to declare itself as a reliable time source.

  1. Log in to the Windows AD server acting as the NTP source.
  2. Open the Registry Editor (regedit).
  3. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpServer.
  4. Set the Enabled value to 1.
  5. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\W32Time\Config.
  6. Set the AnnounceFlags value to 5.
  7. Set the LocalClockDispersion value to 0.
  8. Restart the Windows Time service (w32time) 
  9. Verify the appliances on both sites are now synchronized within the 30-second tolerance.
  10. Re-attempt the site pair creation in the Site Recovery Manager interface.

Additional Information

Powered by Wolken Software