Cannot log in to vCenter with vSphere client but with web client

[christianhau]

Hi!

I've been struggling for a while with a vmware lab installation environment. I have installed ESXi 5.1 on two separate hosts and installed vcenter on one of them. After finishing the installation I cannot log into the vCenter administration panel from the vSphere client. I installed the web client as well to add the domain that the lab servers are members of to the authorized domains.

I can now log into the vCenter administration from the web client with my domain credentials but when I try to log into vCenter server with the vSphere client I get the following error: " The vSphere client could not connect to "hostname". You do not have permission to log in to the server "hostname".

I have also tried with the admin@system-domain account that was created during the install, but I get the same message there. I can log into the web client with the admin@system-domain username as well.

So I am struggling to see why I can log into the vCenter from the web console but not from the vSphere client, any tips? Thanks in advance!

[asrarguna]

Hi,

In web client, did you ad your id to the admin group?

Go to Home -> Administration -> SSO Users and Groups -> Add your ID there under _Administrators_

You will also have to add your domain id or the system-admin\_administrator_ group to the permissions in Vcenter. If your id is not added in vcenter permissions, you won't be able to login.

Thanks -AG

[christianhau]

Thanks for the quick reply! My user is added to the _Administrators_ group under SSO users and groups.

But I am not sure if I understand what you mean with "You will also have to add your domain id or the system-admin\_administrator_ group to the permissions in Vcenter. If your id is not added in vcenter permissions, you won't be able to login." What other permissions are there to set than the SSO users and groups?

[asrarguna]

Hi,

Please check the screenshot attached. Your user should be added to the vcenter and should have permission as admin, or read-only depending upon the access needed. You can provide those rights to the user by logging in to VC using either admin@System-Domain. I think you might also want to try logging in to VC using the service account that you used to install SSO and VC and then add the necessary permissions to the ids that need to access VC. Not sure if this is of any help.

Thanks -AG

[christianhau]

But that is my problem , I cannot log int vCenter with any account at all even when running the vSphere client on the vCenter server. So even with the admin@system-domain I can't log in to the administration panel. Both my domain account and my admin@system-domain account work on the web client...

[a_p_]

With vCenter Server for Windows, the local "Administrators" group should have permissions by default. What you may do is to login through the Web Client and check the permissions and/or try to login through the vSphere Client on the vCenter Server itself (using the local Windows Administrator credentials) to see whether this works.

André

[christianhau]

Thanks for the reply! I have tried logging into the vSphere client on the local machine using the both the local administrator username/password and the domain administrator username/password. Both accounts are members of the local Administrator group on the vCenter server.

I have even added new accounts to the SSO users and groups in the web client that I am allowed to log in with afterwards. In the web client login menu it's enough to just write the domain user name and password while on the vsphere client I have tried domain/username username@domain and just username with no luck..

[a_p_]

Afaik the Windows vSphere Client doesn't care about SSO. Did you already check the permissions for the vCenter Server to see whether the local "Administrators" group has been added?

André

[a_p_]

Not the SSO settings are important, the permissions on the vCenter Server and other objects is what you may need to look at.

Btw. you didn't grey out all occurances of the domain name.

André

[a_p_]

When you are logged in to the vSphere Web Client, select an object (vCenter Server, Datacenter, Cluster, ...) and open the "Permissions" tab to see who has access to the object.

André

PS: I can still see the domain in one of the screenshots

[Buddhi01]

I also had this issue. it was due to my AD evironment issue. i think this thing is also the same issue. Did you get any errors while trying to install the SSO? If that is so, definetely you have a error with your Domain. you should have to manually add the domain to the SSO. after that it will be ok...

[cnpatton]

We were experiencing this same issue for one user only.  I removed him from the AD group in that gave him his permissions for vcenter, and then re-added him to the group.  Had him log off and back on, and this fixed it.  Worth a shot at least.