Authentication problem after upgrade vcenter 5.1 to 5.5

[Rod1978]

Iv'e searched forums but don't seem to find this particular problem even though I have found a lot of related problems..

I upgraded vcenter 5.1 (without any patches) to vcenter 5.5. All went well so it seemed until I tried to login to vsphere webclient with my domain user account. I get the "Client is not authenticated to VMware Inventory Service - https://vcenter.domain.local:10443/" error as well as the yellow bar on the top saying "Could not connect to one or more vCenter Server systems: https://vcenter.domain.local:443/sdk". Thus unable to see the inventory.

I can only login as administrator@vsphere.local in order to see the inventory and not getting any errors. When I check the Identity Source it looks ok, it connects using LDAP, I'm not sure if it was LDAP or AD before the upgrade and It does not show a certificate but when I hit "test connection" it says it's ok.

Also under Access Control I have my domain user account listed with the administrator role, so as far as I can tell it looks fine but obviously something is wrong.

What else can I check? I want to leave the uninstall and install option as a last resort.

[abhilashhb]

Hi,

Welcome to the community,

Can you check if vcenter service is up and running? Are you able to login to the vcenter using vSphere client? That is for the error message that says could not connect to vcenter server.

In identity sources have you made your AD as Default domain? If you haven't then try doing that and see if you can login using AD accounts.

[Rod1978]

thanks for the quick reply,

vcenter service is running.

Weirdest thing, I can login with my AD account using vSphere client only when I check the "use windows credentials" box. If I manually type in my credentials it tells me it's the wrong username or password.

I did as you suggested and made my AD as default domain but no difference. I can not see anywhere though if the AD is the default domain.

[abhilashhb]

This is where you will see your default domain

Now login into your vCenter using vSphere client. click on the vcenter and then go to permissions tab. Click on add permission and from the dropdown see if AD is visible.

Now if your AD is visible. Add a user from AD and see if you can login using that user.

[memaad]

Hi,

Create new account for testing and provide permission to vCenter server  , and try logging in using it.

Regards

Mohammed Emaad

[Rod1978]

OK, this is just ridiculous. I added a AD user that never been added to vcenter before and also created a new test user and added him aswell. Guess what, they can login to with vSphere webclient and see the inventory without any errors.

So I deleted my AD user from vcenter, then added it again and I get the same problem...

It's like vcenter has my AD account cached somewhere resulting in truble

[Rod1978]

So, is there anywhere I can check for cashed credentials on vCenter server. My vCenter is a WIN2008 R2 VM by the way..

[John_B_]

I had the same issue.

What I've done:

1. Added a general user as administrator and logged in successfully
2. Added a new (active directory) group and gave it administrator permissions
3. Logged out with the general user
4. Made myself member of the new group and removed my account from the old group.
5. And I could login again with my own account
6. And of course I removed the general user

What I noticed was that I can't remove the old group, keeps saying that it can't find the group (DOMAIN.LOCAL\VC-Admins).

When I change permissions it creates a new group (DOMAIN\VC-Admins), after that I can delete the newly created group but still the old one exists and cannot be removed?

[MistaVanquish]

All -

I just installed a fresh instance of vSphere 5.5 on a Win2k8 R2 virtual machine, with a separate virtual machine running SQL 2008 R2 housing the database.  I've tried all of the recommendations in this forum, but when I log in with a domain account, I still receive the error: "Could not connect to one or more vCenter Server systems."  I added the AD identity source, made it default, created new user and group accounts, etc, but I still receive the same error.  I followed all of the install best practices and nothing else is running on the machines.  Someone mentioned something about Windows Updates potentially breaking vCenter and/or SSO?  How could that be possible?

If this happened to me in a pristine lab environment, then this can very well happen in a production environment.  How does one successfully implement vSphere 5.5 without the assistance of VMware support if there is no solution to this error?  I just don't understand how there are still issues with the vCenter installation since SSO was introduced.  The install now is more error-proof than ever and it is still broken after install.

Please, anyone?

[coolsport00]

Was there ever an answer for this? I just upgraded 5.1 > 5.5 and receive same Inv Svc error. It happens regardless of user, except the administrator@vsphere.local user.

Thanks.

[KarickTung]

Hi All

I have the exact same problem after upgrade from 5.1 to 5.5.  The yellow bar show the "https://domain.local:443/sdk" error when I use the administrator@vsphere.local or domain admin.  Further more, the path should be "https://vcenter.domain.local:443/sdk" with the computer name in front of the domain name.  And cannot see any inventory.

However, no problem with the vsphere windows client.

Regards

[coolsport00]

I resolved my issue. I searched EVERYWHERE to try & find something related/similar to my issue but couldn't find anything. All I ended up needing to do was log in with the administrator@vsphere.local acct > Administration > Configuration > Identity Sources tab, then simply remove my domain and re-add it as "Active Directory (Integrated)". I can now log in with my account to the Web Client. I was able to log in to the C# client ok, but was having issues with the Web Client. Hopefully this helps someone in the future.

Regards,

Shane

(twitter: @coolsport00)

[Matts_N_]

Hello!

I have seen this on two occasions. First was an upgrade from vCenter 5.1 to 5.5 update 1a, later upgraded again to 5.5 update 1b. Yesterday I did an upgrade from vCenter 5.0 update 1 to 5.5 update 1b.

In both cases I have a problem with AD-members belonging to a group in AD, they get the same message as the OP. If I grant the same user rights in vCenter as a user, instead of through a group, it works. I automatically added the AD during upgrade from 5.1 to 5.5 update 1a, but NOT during the upgrade from 5.0 update 1 to 5.5 update 1b. The installation of SSO failed when I tried to import the AD, so I added it later, once the entire upgrade was completed.

I haven't seen this in 5.5 update 1, only update 1a and update 1b. Anyone else recognize this behaviour?

Cheers,

Matts

[SteveO808]

Yes, I am experiencing the same issue after upgrading to 5.51b, removing the directory server and re-adding it does not work for me.  I specifically upgraded to help with intermittent  AD login issues.

[hostmistress2]

Same problem here, upgrading from last version of 5.1 (5.1.0-1917403) vCenter to 5.5 (5.5.0-1891310-20140201-update01). I've tried everything in this thread -- no luck.

[hostmistress2]

Adding the specific Domain-based groups back in through Web Client worked, but I have to re-add ALL of my custom users, groups and permissions, now. Not happy about this, but at least I got it working again. Once again, VMware has released another vCenter mess. I really miss the days of 5.0 double-click vCenter that took 5 minutes to build.

Anyway, try this article, if anyone is still stuck:

http://blog.asvignesh.in/vmware-vcenter-5-5-you-do-not-have-permission-to-login-to-the-server/

[SARTAinfotech]

This is the thing that worked. Adding permissions in the root of the web client logged in as administrator@vsphere.local did nothing until I followed this: http://blog.asvignesh.in/vmware-vcenter-5-5-you-do-not-have-permission-to-login-to-the-server/

Thank you!