Login Active Directory issues for vCenter 5.5

[Alekhan]

Hi all,

I need some help on setup new vcenter 5.5.  I'm able to login with administrator@vsphere.local.  I'd able to add in identity source for Active Directory via the "active directory" or by LDAP.  Also, able to added AD domain groups or users and permission.  However when I cannot login to vsphere.  I tried to deleted and re-added Identity source AD but no prevail.  One of the webclient error:

"The authentication server returned an unexpected error: ns0:RequestFailed: Group was not found: GroupSID= 'S-1-........'  The error may be caused by a malfuntioning identity source."

Thanks for reading.

Joe

[abhilashhb]

Hi Joe,

See if this helps  VMware KB: Unable to log in to vCenter Server with the vSphere Client or vSphere Web Client

[Alekhan]

I think this article is referring to local user in a domain joined computer.  My issue is AD domain user login.

Thank you.

[admin]

Hi,

This should help

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=204307...

Thanks,
Avinash

[sree_30]

This KB is applicable only for 5.1

Regards,

Sree

[sree_30]

Does this happen with all the users from domain?. When the user logs in the SSO tries to fetch information of all the groups associated with the user. Some of the groups are not reachable which may result in this error. To test you can remove the user from all the group which it is a part of (except domain users and VC permission group).

Regards,

Sree

[grace27]

Hi

Welcome to the communities.

Unexpected error don't say about specific problem

First check all connectivity , port before proceeding any changes.

The worst enemy to creativity is self-doubt.

[admin]

This issue is resolved in vCenter Server 5.5.0a. For more information about this version, see the VMware vCenter Server 5.5.0a Release Notes. You can download the latest release from the VMware Download Center.

To work around this issue on vSphere 5.5 GA (Build Number 1312298), replace the %WINDIR%\System32\idm.dll file on all systems running vCenter SSO 5.5 with the idm.dll file attached to this KB article.

Note: The attached idm.dll file is provided by VMware. It has been tested and verified by VMware engineering. If you experience issues after replacing the dll file, contact VMware Technical Support.

To replace theidm.dll file on the Windows Server 2012 running SSO 5.5:

1. Ensure that you are logged in as an administrator
2. Stop the VMware Identity Management Service on the vCenter SSO server. For more information on stopping services, see Stopping, starting, or restarting vCenter services (1003895). This step also stops the VMware Secure Token Service.
3. Back up the existing idm.dll by copying %WINDIR%\System32\idm.dll to %WINDIR%\System32\idm.dll.orig.
4. Download the idm_patch09252013.zip attachment that contains the replacement idm.dll file from this article.
5. Run md5 checksum on the downloaded idm_patch09252013.zip. The md5 checksum should match the MD5 checksum in the note below.
6. Decompress the zip file to a temporary location then copy the idm.dll to %WINDIR%\System32\.
7. Confirm that you have both new (idm.dll) and old (idm.dll.orig) in the %WINDIR%\System32\ Directory.

Start the VMware Secure Token Service on the vCenter SSO server. For more information on starting services, see Stopping, starting, or restarting vCenter services (1003895). This step also starts the VMware Identity Management Service.

After replacing the dll and restarting services, the initial AD login may take longer than normal to authenticate.