Let me describe this in detail. There seems to be a "well known behaviour" of the linux appliance of Vcenter 5.0 that's causing trouble.
Once there is a machine in the Active Diretory that is out of time sync it causes the authentivation to fail completely for all Vcenter 5 appliances.
This can cause problems at the time of joining the domain or after you've successfully joined the domain and you run for some time.
In both of these cases if any of the windows domain controllers detects a server with time skew - the integrated authentication of the Vcenter stops working.
Symptom: your web interface tells you you've joined the domain, but you can't use it. Once you log in via ssh to the appliance you can use the command
/opt/likewise/bin/lw-get-status
If it tells you -> local provider only you are having issues with the domain. I can't speak for all reasons arround the world, but here my expirience:
You have to go through your whole acive directory. Make sure all your servers are synchronized. The easiest way is to run this command on your domain controller: w32tm /monitor this should tell you if all servers are in sync.
Also make sure all servers in your trusted zones are synchonized. For this just use w32tm /monitor /domain xxxx.xxx
In some cases this might be a pain. It is not unusual to have 20 trusted domains and in many cases you don''t have priviledges to check the time synchonization. Now what can you do?
Deactivate your domain membership in the linux vcenter appliance. Delete your server from windows active directory users and computers.
Login to the vcenter appliance via ssh and make yourself ready for doing the whole join procedure again.
Before you do that you need to start a sinffer in background to log all activity. Run this command on the vcenter appliance
tcpdump -s 1514 -i eth0 -w /tmp/join.cap not host <notebook> change the address <notebook> to whatever you are logged in from, to the appliance
Keep this program running untill you finish the join procedure. Now try to join the windows domain again. It will produce the same output and it won't
work the same way as before. Once the web server stops and tells you to restart, stop the sniffer tcpdump command ctrl c.
The sniffer produced the file /tmp/join.cap . Now download this file to your PC and open this file in wireshark (free program).
Go through all packets and look for a packet containing an error message krb5krb_ap_err_skew.
Analyze the packets and the server sending this message most likely causes the trouble.
Synchonize this server and try again. You need to repeat this whole procedure untill you get it done.
I asked vmware people to fix this. There are multiple ways how they could do it. Upgrade likewise, use an option to ignore trusts etc.
This has been ignored although it is well known.
regards Radomil in Prague
Wonder what stops the web interface from working.