Troubleshooting NTP Time Drift and SAML Authentication Failures in Isolated Environments VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

SAML authentication failures, VPN access loss, or cookie errors observed in isolated environments after maintenance windows.

Environment

• VMware vCenter Server
• VMware ESXi.

Cause

Time synchronization variance (drift) between the vCenter Server, ESXi hosts, and the authoritative NTP source, which invalidates SAML tokens.

Resolution

1. Verify current time settings on the authoritative NTP server.
2. Ensure ESXi hosts are synchronized to the correct NTP source.
3. Restart vCenter Server Appliance (VCSA) services to acknowledge the corrected time:
   service-control --stop --all && service-control --start --all
4. Verify VPN time synchronization with the ESXi host, vCenter, and any other configured VM's.
   1. On SSH session to vCenter and ESXi hosts you can verify time with the date command.