AD Users login issues

[VMSavvy]

Hello vCAC Community,

I've setup a vCAC POC to test the product as we are planning to implement this by replacing vCD. I have vCAC 6.0 Appliance, IDM Appliance and IAAS component server configured. I've created a new tenant and created a new identity source with our domain na.test.com and alias is testmtn. I've given Tenant Admin and Infrastructure Admin access to our team's AD group. However none of them seems to be able to login except myself. When I login it takes me straight in and I can create endpoints and point vCenter and run data collection. But none of them can login into the application.

When other users try to login it tries to load something for a moment and jumps back to the login screen. I don't know if you call it a "Submit" error but there are no error messages what so ever.

Did anyone experience the same problem before? VMware support also doesn't seem to have a solution yet for this. One of the reps told me that he faced a similar issue in his lab setup and he had to rebuild the lab and it worked. That doesn't sound like a solution for me.. What if I set this up in production and if a set of users are unable to login and Vmware asks me to set this from the ground up? Need some help with this.

Please help if anyone has faced a similar issue before.

Regards,

VMSavvy

[jasondgarland]

Are you using VCAC 6.0.1?  6.0 has a bug in it that prevents users from logging in if they're a member of more than 75 AD groups.  I've also seen this problem crop up if you've got an OU in your AD that is hidden or otherwise unreadable to the account you're using for AD queries.  The account designated for queries has to have full access to all OUs or it will fail with the symptoms you've mentioned.  You can test this by narrowing your seach scope to the OU your users are in.  If they can log in after narrowing the scope (granted the account designated for searching has access to that OU), then there's some OU outside of that scope that's causing problems.

[VMSavvy]

Hello Jason,

The build version is 6.0-1569765 which I think is the latest one (pls correct me if I'm wrong). The AD account that I'm using for queries is the one which has access to search the domain. I don't know whats changed but apart from me there are other 2 users who were able to access and another 2 were unable to.. All of us are part of the same domain. This is strange.. Anyone else who is facing similar issues here?

Regards,

VMSavvy

[sbeaver · Accepted solution]

I have had to deal with this and what we did to make this work was to use a global catalog server for the identity source via port 3268.  We had groups that were members of groups with thousands of users which caused the header to be to big.  6.1 resolved this for us but we had to change the identity source as mentioned above. 

[VMSavvy]

Spot on!! Using a GC server with port 3268 worked like a charm.. Now all the users in my team can access the portal.. Kudos to you sbeaver.

And thanks to jasondgarland for the helpful answer as well.

Regards,

VMSavvy