Active Directory LDAP authentication timeouts in VCF Identity Broker with out-of-band MFA providers

Products

• VMware vCenter Server
• VCF Operations

Issue/Introduction

• Authentication via the VCF Identity Broker (VCF SSO) fails when Active Directory is configured with an inline or out-of-band Multi-Factor Authentication (MFA) provider, such as Silverfort, DUO, Microsoft Entra ID, or CrowdStrike, etc.
• In case of external Identity Broker, the VCF Identity Broker logs on control plane of VCF Services Runtime (vidb-service pod logs) record a 5000ms timeout initialization followed by an LDAP directory host unreachable exception exactly 5 seconds later:

  INFO ... com.sun.jndi.ldap.connect.timeout - 5000
  ...
  ERROR ... Connecting to Active Directory on socket (<DC_FQDN>:<PORT>) has timed out.
  ERROR ... Unexpected exception during login com.vmware.vidm.usergroup.model.exceptions.broker.connector.LdapDirectoryCommunicationFailureException: ldap.directory.host.unreachable

• In case of embedded Identity Broker, following error can be seen on vCenter Server Logs:

  #/var/log/vmware/vc-ws1a-broker/accesscontrol-service.log
  
  ERROR ActiveDirectoryServiceImpl - Connecting to Active Directory on socket ([your-ldap-server]:636) has timed out

Environment

• vCenter Server 9.x
• VCF Operations 9.1.x
• Embedded Identity Broker 9.x
• External Identity Broker 9.1.x

Cause

In VCF Operations 9.1.x / vCenter 9.x, the updated identity microservice architecture enforces a stricter default timeout of ~5 seconds for LDAP socket connections. This is an insufficient amount of time for users to approve the MFA on remote devices. If the push notification is not approved on the device within ~5 seconds, the microservice drops the connection.

Resolution

This is a known issue, and will be fixed in a future release of VCF 9.x.

 

Embedded Identity Broker (Appliance)

To increase the LDAP connection timeout for the Embedded Identity Broker running on the vCenter Server, follow the below steps to increase the default timeout value by appending -Ddirectory.query.conn.timeout.seconds=30 (or 60) to the container options

1. Login to vCenter via ssh as root
2. Navigate to the broker container directory:

   cd /storage/containers/vc-ws1a-broker/

3. Inside this directory, locate the subfolder (it will have a long hash-like name, e.g., c2318bb9...). Change into that subfolder:

   cd <hash_folder_name>

4. Make a backup copy of the config.json file by running:

   cp config.json config.json.bak

5. Open the config.json file using vim:

   vim config.json

6. Search for the line starting with "USERGROUP_OPTS= ..."
7. Navigate to the end of that line inside the quotation marks and append:

   -Ddirectory.query.conn.timeout.seconds=30

8. The line will look similar to this:

   "USERGROUP_OPTS= -XX:MaxRAM=250m -XX:MaxRAMPercentage=80 -Xlog:class+path=info,cds=debug,gc*:file=/opt/vmware/idm/logs/usergroup-gc.log:utctime:filecount=10,filesize=1m -Ddirectory.query.conn.timeout.seconds=30"

9. Save the changes and exit vim (Shift + :, then type !wq and press Enter).
10. Restart the WS1A Broker service to apply the configuration change:

    vmon-cli --restart vc-ws1a-broker

11. Attempt the login to confirm resolution of the workaround.

External Identity Broker (VCF 9.1 Services Runtime)
To increase the LDAP connection timeout for the containerized Identity Broker (VIDB) running on the VCF Services Runtime Kubernetes cluster, append the timeout property directly to the deployment's Java options:

1. SSH in to the VCF Control Plane of VCF Services Runtime where VIDB is running using vmware-system-user
2. Switch to root using:

   sudo -i

3. Open the external VIDB deployment configuration in your default terminal text editor:

   kubectl edit deployment vidb-service -n vidb-external

4. Scroll to the containers section and locate the JAVA_OPTS environment variable under the vidb-service container.
5. Navigate to the end of the JAVA_OPTS string, add a single space inside the quotation marks (if present), and append the following parameter:

   -Ddirectory.query.conn.timeout.seconds=30

6. Save the configuration and exit the text editor (for vim, press Esc, type :wq, and press Enter).
7. Trigger a rolling restart of the deployment to apply the new JVM argument:

   kubectl rollout restart deployment vidb-service -n vidb-external

8. Monitor the deployment to ensure the new pods start successfully:

   kubectl get pods -n vidb-external -w

9. Once all vidb-service pods are in a Running state, attempt the authentication flow again to confirm the 30-second timeout extension accommodates the MFA delay.

Additional Information

Note: While there is no hard technical limit on the timeout, Broadcom recommends capping it at 60 seconds. Allowing the system to wait longer for Active Directory risks making the application unresponsive or causing it to crash.