SSO domain ID is does not match (vCenter Install/Linked Mode)

[Julio_Ortiz]

I installed vcenter 5.1 as VC01 using vcenter Sinple Install.. no problems.

When I try to install my second vcenter, I install the SSO, Inventory Service, and when installing vCenter server,

I select to install as a Linked mode... during the process, I get an error.

When I look at "status.txt" it shows:

Operation "Create replica instance VMwareVCMSDS" failed: Action: Prepare for joinproblem: Remote VC's VC01.mydomain.local SSO domain ID

is does not match. Recovering from failed operation "Create replica instance VMwareVCMSDS"

Any idea what is wrong here?

[Crabillon]

Hello,

I have the same problem do you have found a solution ?

Thank you.

[slayer19]

Hello,

I have the same problem and no solution for that issue unfortunately. I just updated two linked vCenters from 5.0 to 5.1. And now, Linked Mode is not possible anymore due to the mentioned error.

Need help urgently!

[MaxStr]

I get a similar error message in status.txt

Operation "Join instance VMwareVCMSDS" failed:
Action: Join Instance
Action: Prepare for Join
Problem: Remote VC's vc1.mydomain.om SSO domain ID is does not match.

In the jointool.log, this is the full message:

[2012-10-09 14:34:13,057  com.vmware.vim.query.client.impl.ClientImpl] InitContext threw IllegalArgumentException:com.vmware.vim.binding.dataservice.QName
[2012-10-09 14:34:13,057  com.vmware.vim.query.client.impl.ClientImpl] This will happen if the context com.vmware.vim.binding.dataserviceis already initialized
[2012-10-09 14:34:13,067  com.vmware.vim.vmomi.client.http.impl.HttpProtocolBindingImpl] Asynchronous execution requested but no Executor configured. The request will be executed as synchronous one.
[2012-10-09 14:34:14,077  com.vmware.vim.sso.admin.client.vmomi.impl.AdminClientImpl] Client was created successfully
[2012-10-09 14:34:14,077  com.vmware.vim.jointool] Operation "Join instance VMwareVCMSDS" failed: : Action: Join Instance
Action: Prepare for Join

Problem: Remote VC's vc1.mydomain.com SSO domain ID is does not match.
[2012-10-09 14:34:14,077  com.vmware.vim.jointool] Recovering from failed Operation "Join instance VMwareVCMSDS"

[2012-10-09 14:34:14,077  com.vmware.vim.jointool] Recovery successful

[2012-10-09 14:34:14,077  com.vmware.vim.jointool] Execution error.

It gives me an option to "Click Yes to force this operation" but it fails anyway and rolls back.

[Slayer311]

Hello.

I faced the same problem and have no idea.

SSO domain ID is does not match

[SecureID]

Hello, have same situation.

Contacted support and they informed that it is most likely because I installed the first server with the simple install option and thus SSO was set to basic mode and that the second is installed as multisite which can't join the first SSO as it is basic mode.

To get the linked mode, both servers need SSO to be installed as multisite.

First as the primary node for a new SSO installation and the second joined to the primary node.

Haven't had time to check if it does do the trick, will let you know

[GabrielMcH]

That will do the trick - I worked with VMWare support last weekend and made them aware that was the fix. That fixed my test lab and I just fixed my production sites today.

Everything will be de-regestered with SSO (inventory, VC, webclient and update mgr). What I did was uninstall all the products in the reverse order of installation (with SSO last), then reinstall sso in multi site mode on both vc server (primary node in a multi site on th 1st, then join on the 2nd one), then install the other compoments.

Just be aware that when doing multi-site mode with SSO you lose the ability to use local windows accounts.

HTH,

Gabriel

PS... Having done that seems to have made SRM not work for me (service starts then stops) - I think because it's trying to use the local Administrators group. I'm working on that today.

[SecureID]

Hello all,

I have confirmed that this will do the trick and we're running 5.1 in linked mode.

regards

[slayer19]

Yeah, that's it!

Thanks for your help...

[AJBERGH]

Hi, what can you tell me about SRM 5.1 with linked vCenters? Can you detail the issues you had and the resolution? Thanks!

[GabrielMcH]

Sure, I actually figured it out and VMWare published my fix in their knowledge-base 🙂 (complete with the path I sent them, which was from a backup I made of the logs directory (see the logs.backup)). Rather than rehash it check out my knowledge article http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=2038046&sl... (KB 2038046)  if you have any questions feel free to post in this thread and I will try to answer them.

The short story is the SRM service may fail to start:

     - When you do linked mode with 5.1 you loose the ability to use the local windows accounts for authentication in vmware (only ad, ldap, and local sso logins)

     - However, srm might be set to authenticate using the local windows administrator user

     - If so you must delete (or modify, but I don't recommend that) the 'local' windows account in the srm database (see the KB for which tables to modify and don't forget to backup the database first!)

     - Do a modify srm install using the existing database it will update the tables with the correct SSO administrator user(s)

Good Luck!

Gabriel

[SHAMRIN]

Gabriel! Whether correctly I understand, what for creation of a simple Linked mode (on which 10 minutes earlier were required), now it will be necessary to remove all vSphere management and to put again? And only because the type of installation of SSO is critical and after of installation it is impossible to change?
In laboratory I can such make, but it to execute for real infrastructure in one hundred hosts and one thousand VM???

Alex

[GabrielMcH]

HI Alex,

Yes if you do want to do linked mode SSO needs to be installed in a multi-site setup during installation. I am unaware of any way to chage SSO to multi-site after the installation is done.

It is possible to un-install SSO and reinstall it in linked mode, but all of the components will NOT be associated with SSO (inventory, web client, vcenter). VMWare does have a document on how to manually register the components with SSO - http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=203362...

But I had difficulties doing so and honestly it's more work and I don't think it's as 'clean' a process as uninstalling the components, then installing SSO in multi-site mode and reinstalling the components once SSO is in multi-site mode. As long as you backup the configuration files and databases (SSO and vcenter) it's not that bad of a process. Give it a try in your lab.

What I did as a backup plan was to P2V my virtual center servers so if I broke the real ones I could simply boot off the copies I made.

Hope that Helps,

Gabriel

[SHAMRIN]

Thanks
Very much afflicts that the simple mechanism suddenly became such difficult. Now 10 times will think before making LM.

[datecinc]

When you fixed the SSO, by uninstalling all components in reverse order, did you uinstall SRM too? I am needing to run through this fix to get Linked Mode working again with 5.1 and I just want to ensure I do it right. I currenlty have VCenter 5.1 and SRM 5.1 on the same server. Thanks for the help.

[GabrielMcH]

I honestly don't remember, I don't think it really matters as I *don't think* SRM register's with SSO - I took a quick peek at my sso database and didn't see any referance or registrations for SRM.

But to be safe I would uninstall it and reinstall it once SSO is configured they way you want.

Also, check out KB 2038046 (which I submitted to VMWare for their knowledge base) - if the srm service failes to start after the upgrade.

http://kb.vmware.com/selfservice/microsites/search.do?cmd=displayKC&docType=kc&externalId=2038046&sl...

HTH,

Gabriel

[AJBERGH]

SRM 5.1 does not participate in SSO. SRM keeps it's own authentication database.

Regards,

Adam