vCenter 8 Session Timeout Settings and the 8.0 U3b vSphere Client Idle Session Bug (Fixed in 8.0 U3c)

How to set the vSphere Client session timeout in vCenter 8.0 and 9.x, and why sessions broke after 50 idle minutes on 8.0 U3b until the 8.0 U3c fix.

Short answer: In vCenter 8.0, the vSphere Client session timeout is set in Administration > Deployment > Client Configuration > Edit > Session timeout (minutes, default 120). Alternatively, set session.timeout in /etc/vmware/vsphere-ui/webclient.properties. If sessions die after about 50 idle minutes on vCenter 8.0 U3b (8.0.3.00200), that is a Tomcat bug, not a setting. It is fixed in 8.0 U3c (build 24305161) and later.

vCenter 8 session timeout settings (vSphere Client)

By default, vSphere Client sessions close after 120 minutes of inactivity. You need the Global > Settings privilege to change it.

  1. In the vSphere Client Home menu, select Administration.
  2. Under Deployment, click Client Configuration.
  3. Click Edit. The Edit client configuration dialog opens.
  4. Enter the new value in minutes in Session timeout and click Save.
  5. Log in to the vSphere Client again for the change to take effect.

Alternative: webclient.properties

The same value lives in the vSphere Client properties file on the appliance. The file method is documented for vSphere 7.0 and 9.1:

# /etc/vmware/vsphere-ui/webclient.properties
session.timeout = 60

# apply
service-control --restart vsphere-ui

Uncomment the line if needed. The value is in minutes. The documentation says that a negative value or 0 means the client never times out. That is convenient in a lab but a bad idea in production. The vSphere Security guide recommends setting timeouts so that idle sessions cannot be misused.

vCenter 9 session timeout

The vSphere 9.1 documentation keeps both methods: Home > Administration > Deployment > Client Configuration > Edit, or session.timeout in /etc/vmware/vsphere-ui/webclient.properties. Default is still 120 minutes. After the change, restart the VMware vSphere Client service. Use service-control --restart vsphere-ui over SSH, or VAMI (https://<vcenter>:5480) > Services > VMware vSphere Client > Restart.

VersionUI pathFileApply
vCenter 8.0Administration > Deployment > Client Configurationwebclient.properties (session.timeout)Re-login (UI); restart vsphere-ui (file)
vCenter 9.xAdministration > Deployment > Client Configuration/etc/vmware/vsphere-ui/webclient.propertiesRestart VMware vSphere Client service

What went wrong in vCenter 8.0 U3b (8.0.3.00200)

vCenter Server 8.0 Update 3b (17 Sep 2024, build 24262322, patch VMware-vCenter-Server-Appliance-8.0.3.00200-24262322-patch-FP.iso) upgraded Apache Tomcat to 9.0.91. That Tomcat version changed the default of org.apache.catalina.connector.RECYCLE_FACADES from FALSE to TRUE. As a result, a vSphere Client session left idle for more than 50 minutes became invalid (PR 3439359). You could not log in or out, or use the client in that browser, until you cleared all cookies.

Symptoms listed in Broadcom KB 377734, usually after 1 to 2 idle hours:

  • The loading circle keeps spinning, and session timeouts occur.
  • Inventory errors: You have no privileges to view this object or it is deleted.
  • The login button is greyed out, or login fails with An error occurred while fetching identity providers.
  • ServiceClosedException: AsyncTokenProvider has been closed in /var/log/vmware/vsphere-ui/vsphere_client_virgo.log and /var/log/vmware/apig/apigw.log.

Raising the session timeout does not help here. The session breaks because of the Tomcat change, not because the configured timeout expires.

The fix: vCenter 8.0 U3c or later

vCenter Server 8.0 Update 3c (09 Oct 2024, ISO build 24305161, patch VMware-vCenter-Server-Appliance-8.0.3.00300-24305161-patch-FP.iso) contains only this fix (PR 3439359). Any later 8.0 U3 patch also includes it. Download the patch from the Broadcom Support Portal; this requires a login with an entitled account. If you patch now, go straight to the latest 8.0 U3 build rather than to U3c.

Workaround for 8.0 U3b (KB 377734)

If you cannot patch yet, disable RECYCLE_FACADES for the vSphere Client. SSH to vCenter as root:

root@vcsa-home [ ~ ]# cp /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties /root/catalina.properties.bak

root@vcsa-home [ ~ ]# echo "org.apache.catalina.connector.RECYCLE_FACADES=false" >> /usr/lib/vmware-vsphere-ui/server/conf/catalina.properties

root@vcsa-home [ ~ ]# service-control --restart vsphere-ui

I ran exactly this on my home lab vCenter before 8.0 U3c was out. It only restarts the vSphere Client service.

Same symptoms on a newer build?

KB 377734 says that if you see this behaviour on a later version, you should hide third-party client plug-ins to find the cause. Go to Administration > Solutions > Client Plugins, select the third-party plug-in and click HIDE. This removes the plug-in’s UI extensions while its service keeps running.

Sources

Related on vdan.cz

Author: Daniel Micanek

Senior Service Architect, SAP/TDL Platform Services Team at Vivicta | vExpert ⭐⭐⭐⭐⭐⭐⭐ | Broadcom Knight: vSphere Kubernetes Service, VCF Networking (NSX), VCF Automation | Broadcom Software Knight: vSphere | Cisco Champion. Notes from running about 1,000 ESXi hosts on Cisco UCS, VCF 9 and SAP HANA on vSphere.