Fix vCenter “Exception in invoking authentication handler User password expired”

If logging in to the vCenter Server Appliance Management Interface (VAMI, https://<vcenter>:5480) fails with “Exception in invoking authentication handler User password expired”, the appliance’s root password has expired. Since vSphere 6.5 the root password expires after 90 days by default. SSH and the VM console still let you in, so the fix takes two minutes: log in to the shell, run passwd root, and then set an expiry policy that fits your environment.

Reference: Broadcom KB 332308 (formerly VMware KB 75107).

Symptoms

• The appliance was deployed more than 90 days ago with default settings.
• VAMI login fails with Exception in invoking authentication handler User password expired.
• Login to the appliance shell (SSH or VM console) still works, and may ask you to change the password immediately.

1. Check the password expiration

root@localhost [ ~ ]# chage -l root
You are required to change your password immediately (password expired)
chage: PAM: Authentication token is no longer valid; new one required

2. Change the root password

root@localhost [ ~ ]# passwd root
New password:
Retype new password:
passwd: password updated successfully

VAMI login works again straight away.

3. Set an expiry policy

After logging in to VAMI, you can change the root password settings under Administration: the expiry period, “never expire”, and an email address for the expiration warning. Keep expiry enabled in production and set the warning email so this doesn’t catch you again.

For labs only, you can disable expiry from the shell:

root@localhost [ ~ ]# chage -M -1 root

Verify the result:

root@localhost [ ~ ]# chage -l root
Last password change : Dec 21, 2021
Password expires : never
Password inactive : never
Account expires : never
Minimum number of days between password change : 0
Maximum number of days between password change : -1
Number of days of warning before password expires : 7

Still can’t log in?

If VAMI or the vSphere Client still fails after the root password is fixed, the cause may be a certificate rather than the password. See checking vCenter certificates with vCert and STS signing certificate expiration. If you don’t know the root password at all, or root is locked after too many failed logins, see Reset vCenter root password without restarting.