vCenter Server does not appear in the vSphere Web Client Inventory after installing or upgrading to vSphere 5.5 / 6.0

Products

• VMware vCenter Server

Issue/Introduction

After installing or upgrading to vSphere 5.5 / 6.0 using vCenter Single Sign-On 5.5 / 6.0, you experience these symptoms:

• vSphere Web Client does not list the upgraded/installed vCenter Server in the inventory.
• vCenter Server is not listed in the inventory when you log in to the vSphere Web Client as the Domain Administrator or a user in the Domain Administrators Active Directory group.

Environment

• VMware vCenter Server 5.5.x
• VMware vCenter Server 5.1.x
• VMware vCenter Server 6.0.x

Cause

This issue occurs because:

• Permissions from the nested groups from dissimilar Identity Sources do not get propagated.

For example, if you add the Domain Administrators group to the Local Administrators group, the permissions do not get propagated because Local operating system and Active Directory are separate identity sources.

• The administrators@localos group is granted access to the vCenter Service and the Domain Administrators group is a nested within the local Microsoft Windows Administrators (LocalOS) group.
• The Domain Administrators group has not been granted explicit access to vCenter Server.
• The [email protected] account has access to vCenter Server after an installation.

Resolution

This is an expected behavior.

 

To resolve this issue, add explicit permissions to Users or Groups from their respective Identity Sources.

For example:

• Only populate Local OS groups with Local OS users or groups
• Only populate Active Directory groups with Active Directory users or groups

Additional Information

Unable to log into VMware vCenter Server after upgrading to vCenter Server 5.1
Logging in to the vSphere Web Client fails with the error: ns0:RequestFailed: Internal Error while creating SAML 2.0 Token