Loading...
Loading...
The vSphere Web Client displays this error: A vCenter Single Sign-On service error occurred After an upgrading vCenter Server 6.0 to 6.5 editing a AD over LDAP or OpenLDAP Identity source fails if SSL protection is selected.The AD over LDAP or OpenLDAP Identity source has connect to any domain controller in the domain selected or two LDAPS servers are provided.With a single LDAPS server the issue does not occur. Note: If a loadbalancer is used with multiple LDAPS servers the issue may occur as well.After a fresh installation of vCenter Server 6.5 adding a AD over LDAP or OpenLDAP Identity source fails if SSL protection is selected.In the ssoAdminServer.log file, there are entries similar to: [<YYYY-MM-DD>T<time>.849Z pool-9-thread-6 opId=2854ae5d-4df1-46c5-a177-5fc430f991c4 ERROR com.vmware.identity.admin.server.ims.impl.IdentitySourceManagementImpl] Exception occurred: 'com.vmware.identity.idm.</time>InvalidArgumentException: 'IdentityStore certificates' value should not be empty'; stack='com.vmware.identity.idm.InvalidArgumentException: 'IdentityStore certificates' value should not be emptyat com.vmware.identity.idm.server.ServerUtils.getRemoteException(ServerUtils.java:121)at com.vmware.identity.idm.server.IdentityManager.addProvider(IdentityManager.java:9479)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)
This is a known issue affecting vCenter Server 6.5 & 6.7.This issue is resolved in: vCenter Server 6.5 U2d, available at Download VMware vCenter Server 6.5 U2d andvCenter Server 6.7 U1 available at Download VMware vCenter Server 6.7U1
To workaround this issue: Disable SSL support for LDAP. This works with two LDAP servers with the option connect to any domain controller in the domain. Note: Disabling SSL may impose a security risk as all information is transmitted in plain text. Configure the Identity source to use non-encrypted LDAP using these settings: To use any available domain controller in your domain: Select "Connect to any domain controller in the domain"Do not tick "Protect LDAP communication using SSL certificate (LDAPS)" To use 2 dedicated domain controllers in your domain: Select "Connect to specific domain controllers".As Primary and Secondary server URL use:If the domain controller is a Global Catalog Server: LDAP://<domain_controller1_fqdn>:3268If the domain controller is not a Global Catalog Server: LDAP://<domain_controller1_fqdn>:389Do not tick "Protect LDAP communication using SSL certificate (LDAPS)” Only provide a single LDAPS server. This requires that the LDAP server is manually provided (rather than using the option "connect to any domain controller in the domain"). Select "Connect to specific domain controllers".As Primary server URL use: If the domain controller is a Global Catalog Server: LDAPS://<domain_controller_fqdn>:3269 If the domain controller is not a Global Catalog Server: LDAPS://<domain_controller_fqdn>:636 Do NOT provide a Secondary server URL.Tick "Protect LDAP communication using SSL certificate (LDAPS)"In "3 Provide certificates" provide the SSL certificate of the domain controller used.Run the command to gather the SSL certificate information from any Domain Controller desired: # openssl s_client -connect <domain_controller_fqdn>:636 -showcertsWhen the openssl connect command completes, the full contents of the SSL certificate are displayed. The certificate chain appears similar to: Certificate chain 0 s:/CN=DC3.domain.com i:/DC=com/DC=domain/CN=BRM-CA -----BEGIN CERTIFICATE----- MIIFyjCCBLKgAwIBAgIKYURFHAAAAAAABDANBgkqhkiG9w0BAQUFADBCMRMwEQYK .......... ...snip... .......... TmqX6OuznopBJKNW5Z5LbHzuUCfY8ryBhYZhHKsf9CmZa12j/ODfznFtAgbPNw== -----END CERTIFICATE----- 1 s:/DC=com/DC=domain/CN=BRM-CA i:/CN=BRM-ROOT-CA -----BEGIN CERTIFICATE----- MIIFkjCCBHqgAwIBAgIKYSn5HgAAAAAAAjANBgkqhkiG9w0BAQUFADAWMRQwEgYD .......... ...snip... .......... N4C2CAlLaR3sXlHBRNlfsLO+rZo45hwW8Xw3rLD+ETtgKMmAVUI= -----END CERTIFICATE----- The top most certificate in this chain is the certificate of the domain controller.Copy the complete string including -----BEGIN CERTIFICATE----- until (including) -----END CERTIFICATE----- into a text file.Remove any additional characters after -----END CERTIFICATE-----.Save that file as .cer.Add this file to the identity source.
The vCenter Single Sign-On server failed to connect to or failed to authenticate to the service at the specified URL"There is already a native AD IDS or LDAP AD IDS registered", Unable to disjoin/leave vCenter Server Appliance from Active Directory Domain'Failed to check the status of VMware Directory Service' error while upgrading vCenter Server 6.7"Cannot load the users for the selected domain / Error while extracting local SSO users", Unable to add Active Directory users or groups to vCenter Server Appliance or vRealize Automation permissions"Setup failed to generate the SSL keys necessary to run VMware Server" when installing VMware Workstation
Click on a version to see all relevant bugs
VMware Integration
Learn more about where this data comes from
Bug Scrub Advisor
Streamline upgrades with automated vendor bug scrubs
BugZero Enterprise
Wish you caught this bug sooner? Get proactive today.