Resolving LDAP Thread Starvation in VMware Identity Manager

Products

• VCF Automation

Issue/Introduction

VMware Identity Manager (vIDM) and VMware Aria Automation consoles become inaccessible, and Active Directory (AD) authentication requests fail. When attempting to log in, the UI appears to hang or remains in a perpetual loading state. This behavior is caused by LDAP thread starvation resulting from communication failures with unresponsive domain controllers (DCs). While restarting the horizon-workspace service provides temporary relief, the issue recurs as configuration files are periodically synchronized.

Environment

VMware Identity Manager 3.3.7

Cause

When fetching LDAP contexts, vIDM attempts to communicate with the primary domain controller returned by the DNS/AD query. If this host is unresponsive, vIDM fails to iterate through the remaining healthy DCs, instead throwing an exception back to the top-level retry loop. This causes thread starvation and loopback timeouts across background services.

Because /usr/local/horizon/conf/domain_krb.properties is automatically synchronized with Active Directory/DNS every two hours, unresponsive hosts are frequently re-populated into the configuration, causing the issue to reoccur.

Resolution

To resolve this issue, optimize the DC health check interval to force iterative communication rather than relying on a single primary host.

Prerequisites:

Take a snapshot of the vIDM appliance(s) before making configuration changes.

Steps:

1. Access the vIDM appliance command line via SSH as the root user.
2. Open the runtime configuration file for editing
   
   

   vi /usr/local/horizon/conf/runtime-config.properties

3. Append the following configuration lines to the bottom of the file:
   
   

   directory.schedule.dc.optimize=true
   directory.domain.controllers.daily.cron=0 */2 * * * ?
   directory.domain.controllers.periodic.cron=0 */2 * * * ?

4. If the environment contains multiple vIDM nodes, repeat steps 1-3 on all nodes.
   
   
5. Restart the workspace service to apply the changes:
   
   

   service horizon-workspace restart

Workaround

Restarting the horizon-workspace service clears current locked threads and restores temporary access; however, this does not prevent the issue from recurring. Permanent remediation requires the configuration changes listed above.

Additional Information

Implementing these properties activates schedule optimization, which forces the system to perform iterative health checks on all configured domain controllers. This ensures that the system does not perpetually attempt to contact an unreachable primary host, thereby preventing the thread starvation loop.

Please make sure that vDIM is funcationing as expected before deleteing the snapshots.