Error: "SessionCreationException: Invalid token" and Blank Page Downloading 'sso' File When Logging Into vSphere Client
search cancel

Error: "SessionCreationException: Invalid token" and Blank Page Downloading 'sso' File When Logging Into vSphere Client

book

Article ID: 452998

calendar_today

Updated On:

Products

VMware vCenter Server 8.0

Issue/Introduction

When attempting to log into the vCenter Server vSphere Client, the login process fails and exhibits the following symptoms:

  • The browser redirects to a blank page at https://<vcenter-fqdn>/ui/saml/websso/sso.

  • The browser automatically downloads a 0-byte file named sso.

  • The vSphere Client logs  under /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log contain the following stack trace, confirming a token validation failure during session creation:

 [ERROR] p-nio-127.0.0.1-5090-exec-13 70000040 100007 ###### com.vmware.vsphere.client.security.sso.SsoAuthenticationHandler Error during authentication com.vmware.vcenter.apigw.session.SessionCreationException: Invalid token
at com.vmware.vcenter.apigw.session.frontend.impl.FrontendSessionManagerImpl.create(Unknown Source)
at com.vmware.vcenter.apigw.api.impl.ApiGatewaySessionManagerImpl.login(Unknown Source)
at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
at java.lang.reflect.Method.invoke(Method.java:498)
at org.springframework.aop.support.AopUtils.invokeJoinpointUsingReflection(AopUtils.java:333)
at org.springframework.aop.framework.JdkDynamicAopProxy.invoke(JdkDynamicAopProxy.java:223)
at com.sun.proxy.$Proxy268.login(Unknown Source)
at com.vmware.vsphere.client.security.sso.SsoAuthenticationHandler.setupSessionData(SsoAuthenticationHandler.java:485)
at com.vmware.vsphere.client.security.sso.SsoAuthenticationHandler.authenticate(SsoAuthenticationHandler.java:196)
at com.vmware.vise.security.spring.DefaultAuthenticationProvider.authenticate(DefaultAuthenticationProvider.java:354)
at org.springframework.security.authentication.ProviderManager.authenticate(ProviderManager.java:182)
at com.vmware.vise.security.websso.WebssoAuthenticationProcessingFilter.attemptAuthentication(WebssoAuthenticationProcessingFilter.java:47)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:231)
at org.springframework.security.web.authentication.AbstractAuthenticationProcessingFilter.doFilter(AbstractAuthenticationProcessingFilter.java:221)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:107)
at org.springframework.security.web.authentication.logout.LogoutFilter.doFilter(LogoutFilter.java:93)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
at org.springframework.security.web.header.HeaderWriterFilter.doHeadersAfter(HeaderWriterFilter.java:90)
at org.springframework.security.web.header.HeaderWriterFilter.doFilterInternal(HeaderWriterFilter.java:75)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
at org.springframework.security.web.context.request.async.WebAsyncManagerIntegrationFilter.doFilterInternal(WebAsyncManagerIntegrationFilter.java:62)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:106)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:117)
at org.springframework.security.web.context.SecurityContextPersistenceFilter.doFilter(SecurityContextPersistenceFilter.java:87)
at org.springframework.security.web.FilterChainProxy$VirtualFilterChain.doFilter(FilterChainProxy.java:361)
at org.springframework.security.web.session.DisableEncodeUrlFilter.doFilterInternal(DisableEncodeUrlFilter.java:42)
at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.

Environment

 

  • VMware vCenter Server 8.0.x

  • VMware vCenter Server 9.x

 

Cause

This sequence of failures occurs when the account attempting to log in (such as [email protected] or any other configured SSO user) has been disabled or locked out in the Single Sign-On (SSO) database. Because the account is inactive, the Security Token Service (STS) returns a token rejection. The vCenter API Gateway is unable to process this rejection payload properly, which results in the "Invalid token" exception and breaks the SAML redirect loop.

Resolution

If the primary SSO administrator account is locked out, you must create a temporary SSO administrator via the command line to log in and unlock the affected account. (Note: If the affected account is a standard user only, an existing SSO administrator can skip directly to step 2).

1. Create a Temporary Administrator (vCenter SSH) Connect to the vCenter Server Appliance via SSH as root and execute the following commands to create a temporary recovery user. Replace VMware1!VMware1! with a secure password of your choice.

/usr/lib/vmware-vmafd/bin/dir-cli user create --account testadmin --first-name Temp --last-name Admin --user-password 'VMware1!VMware1!'

Add the temporary user to the SSO Administrators group:

/usr/lib/vmware-vmafd/bin/dir-cli group modify --name Administrators --add testadmin

2. Unlock the Affected Account (vSphere Client)

  1. Open a new private or incognito browser window and log in to the vSphere Client using [email protected] (or an existing valid administrator account).

  2. Navigate to Menu > Administration > Single Sign On > Users and Groups.

  3. Select the applicable domain (e.g., vsphere.local)

  4. Locate the affected account (e.g., administrator, or the specific user experiencing the issue).

  5. Click Edit, and check the box to Enable or Unlock the account.

  6. Click Save.

  7. Log out of the vSphere Client.

3. Cleanup Verify that the user can now successfully log in with the previously locked account. Once confirmed, delete the temporary user via the vCenter SSH session:

/usr/lib/vmware-vmafd/bin/dir-cli user delete --account testadmin

 

Powered by Wolken Software