Hi,

My finding:

Connection Server uses old password for the given account.

It causes account block acording to existing locking policy.

Restarting SSO or the whole vCenter Server unlocks the locked account. So the workaround described in this thread resolves temporarily the problem. 

But the real problem are the wrong credentials used by the Connection Server for vCenter's SDK authentication.

It's not very easy to change the wrong credentials inside the Conection Server because the account is nerly permament locked.