Error "[500] An error occurred while fetching identity providers" appears while login to vCenter Server UI

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to log in to the vCenter Server User Interface (UI), the authentication process fails with the following error: [500] An error occurred while fetching identity providers. Try again. If problem persists, contact your administrator.
• In Enhanced Linked Mode (ELM) environments, this error may impact all linked vCenter nodes.
  
  
• The following log entries may be observed in the vCenter Server Appliance:

• /var/log/vmware/vsphere-client/logs/vsphere_client_virgo.log: [ERROR] ... An error occurred while fetching providers com.vmware.vapi.std.errors.Unauthenticated
• /var/log/vmware/sso/websso.log: ERROR websso ... [com.vmware.identity.providers.SolutionUserHokTokenProviderImpl] Unable to get SAML HOK token for machine solution user com.vmware.identity.saml.UnsupportedTokenLifetimeException: Signing certificate is not valid
• /var/log/vmware/sso/vmware-identity-sts.log: com.vmware.identity.sts.InvalidCredentialsException: Solution user cert is not valid

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

This issue occurs due to the expiration of the Security Token Service (STS) signing certificate, Machine_SSL certificate, or Solution User certificates. In ELM environments, expiration on a single node can disrupt the identity provider service across the entire SSO domain.

Resolution

To resolve this issue, replace the expired certificates:

1. 1. Log in to the vCenter Server Appliance via SSH as the root user.
   2. Verify the certificate expiration status by running the following command: 

      for i in $(/usr/lib/vmware-vmafd/bin/vecs-cli store list); do echo STORE $i; /usr/lib/vmware-vmafd/bin/vecs-cli entry list --store $i --text | egrep "Alias|Not After"; done

   3. Replace the expired certificates using the vCert utility. For instructions, see vCert - Scripted vCenter expired certificate replacement (385107).
   4. If using Enhanced Linked Mode (ELM), take an offline snapshot of all vCenter nodes and perform the certificate replacement on the impacted node(s).
   5. Restart all services on all vCenter nodes in the ELM environment to ensure the new certificates are recognized: 

      service-control --stop --all && service-control --start --all

Additional Information

For further assistance, see the VMware Cloud Foundation documentation or contact support. To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.