Error: "Unable to login because you do not have permission on any vCenter Server systems connected to this client" when trying to login to vCenter Server with Active Directory user

Products

• VMware vCenter Server
• VMware vSphere ESXi

Issue/Introduction

• After migrating the identity source from Integrated Windows Authentication (IWA) to Active Directory (AD) over LDAP, users are unable to log in to vCenter Server when permissions are assigned via AD groups. Individual user accounts with direct permissions function correctly, but group-based authorization results in a permission error. This issue typically appears in multi-domain forests where groups and users reside in different child domains. 

Unable to login because you do not have permission on any vCenter Server systems connected to this client

Environment

• VMware vCenter Server 7.x
• VMware vCenter Server 8.x

Cause

• Standard LDAP queries (port 389/636) are scoped to the specific domain controller's partition and do not traverse referrals for cross-domain nested group memberships. Verification of users in a child domain against groups in a parent domain requires Global Catalog connectivity. 

Resolution

1. 1. Log in to the vSphere Client as [email protected]. VMware 
   2. Navigate to Administration > Single Sign-On > Configuration.
   3. Select the Identity Sources tab and highlight the AD over LDAP source.
   4. Click Edit and update the following:
      1. Primary/Secondary Server URL: Update the port to 3268 (for LDAP) or 3269 (for LDAPS).
      2. Base DN for users/groups: Set this to the root of the forest (e.g., DC=ege,DC=ds) to ensure global lookup.
      3. Domain Alias: Ensure the NetBIOS name for each domain is mapped correctly.
   5. Click Save.
   6. Allow 15 to 45 minutes for the vCenter Single Sign-On service to rebuild its internal directory cache 

Additional Information

• Add or Edit a vCenter Single Sign-On Identity Source
• To speak with a customer representative or a Support Engineer , see Contact Support.