Short answer: vc-ws1a-broker is the vCenter service that runs VMware Identity Services, which Broadcom calls “VMware Identity Broker – vCenter Server”. It is a container built into the vCenter Server Appliance (VCSA) since vSphere 8.0 Update 1. It handles federated login to external identity providers such as Okta, Microsoft Entra ID and PingFederate. Leave it running. If it fails, check for known database-lock and upgrade issues before you think about disabling it.
What vc-ws1a-broker does
The name comes from Workspace ONE Access (WS1A). vCenter reuses a trimmed-down version of that identity broker as an internal, containerised workload. Broadcom’s API documentation describes VMware Identity Broker – vCenter Server as a container built into vCenter that federates vCenter to an external identity provider. It supports OAuth 2.0 grant types (authorization code, client credentials, refresh token and password) and swaps the resulting JWT for a SAML token so the user gets a normal vCenter session.
With Okta, for example, the configuration guide uses OpenID Connect for the login itself and SCIM 2.0 for pushing users and groups from the IdP into vCenter. VMware Identity Services is enabled by default on new installs, and vCenter supports only one external identity provider at a time, alongside vsphere.local.
Which identity providers use it
| Identity provider | Supported since | Uses VMware Identity Services (vc-ws1a-broker) |
|---|---|---|
| AD FS | vSphere 7.0 | Not listed; AD FS federation existed before the broker |
| Okta | vSphere 8.0 Update 1 | Yes |
| Microsoft Entra ID (Azure AD) | vSphere 8.0 Update 2 | Yes |
| PingFederate | vSphere 8.0 Update 3 | Yes |
The version list comes from the vSphere 9.0 documentation page vCenter Identity Provider Federation. In Enhanced Linked Mode, Broadcom documents that Okta, Entra ID or PingFederate is configured through VMware Identity Services on one vCenter system in the group.
Resource footprint on the VCSA
The broker arrived with vSphere 8.0 Update 1. The VCSA installer now shows a step where it installs containers, and the broker runs under runc. William Lam observed that it is configured to use up to about 2 GB of memory, which explains why 8.0 U1 appliances need more RAM than earlier builds of the same size. Keep that in mind when you size small lab vCenters.
Common vc-ws1a-broker problems and fixes
| Symptom | Cause | Fix (Broadcom KB) |
|---|---|---|
Service stays stopped, Failed to start vc-ws1a-broker services. Error: Operation timed out, health check returns “No healthy upstream” | Stale database change-log locks in the vidm_schema tables in VCDB | Release the locks, then restart the service (KB 317439) |
Alarm vc-ws1a-broker status changed from green to unknown, clears after about 5 minutes; possible VCHA failover | Read error on the health check file | Upgrade to vCenter 8.0 Update 3g or later (KB 393133) |
File-based backup fails: Stopped services: 'vc-ws1a-broker' | Broker configuration lost during a Reduced Downtime Upgrade | Run Broadcom’s secret-rotation script; fixed in 9.0 (KB 402954) |
For the database-lock case, KB 317439 checks each lock table with psql first. It lists databasechangeloglock, acs_, fed_, ugs_ and cryptodatabasechangeloglock. Take offline snapshots first; in ELM that means all linked vCenters.
/opt/vmware/vpostgres/current/bin/psql -U postgres -d VCDB -c 'SELECT * FROM vidm_schema."databasechangeloglock";'
# after releasing the locks as described in the KB
service-control --restart vc-ws1a-brokerCan you disable vc-ws1a-broker?
It is technically possible with vmon-cli, and William Lam shows how in a homelab where memory is tight. If you do not use Okta, Entra ID or PingFederate federation, nothing obvious breaks at first. Still, it is not a supported production change. vCenter backups and upgrades check that all required services are running, and a stopped broker is exactly what the KBs above report as a failure. In production, fix the service rather than disable it. If identity problems go deeper, the lsdoctor guide and the STS certificate “no healthy upstream” article cover the next things to check.
Further reading
- William Lam: What is vc-ws1a-broker service on vCenter Server Appliance (VCSA)? (original post)
- Broadcom TechDocs: VMware Identity Broker – vCenter Server Workflows
- Broadcom KB 317439, 393133, 402954
