Cannot use orchestrator in vcenter

[padvou]

Why is that:

[abhilashhb]

Have you added the vCenter host in Orchestrator configuration page? It should auto discover the orchestrator if you have done that AFAIK.

[iiliev]

On the screenshot above, 'Registered as VC extension' radio button is grayed out, which means no vCO-related extensions are found in the vCenter. Please check the following:

1. As Abhilash mentioned, open Orchestrator Web configurator (at https://[vcoip]:8283), go to vCenter plug-in configuration page and verify that the vCenter host is configured.

2. Make sure that Orchestrator is configured to authenticate against the same SSO server instance as vCenter/NGC.

[mcfadyenj]

you also need to add a group in vCenter to allow the vCO server to show up in the registration page.

this took me a while to find. there is a post on vcoteam.info on adding the group.

[padvou]

mcfadyenj  I searched through vcoteam.info (very helpful website) but I could not locate the relevant article.. Could you please give me some more pointers?

[iiliev]

OK, so you have the vCenter host configured. Now, there are 2 more things to check:

1. Verify that there is an extension registered on this vCenter that links to Orchestrator. Go to vCenter managed object browser at https://198.200.200.31/mob/?moid=ExtensionManager and look for an extension with name starting with 'com.vmware.orchestrator.'. Click on it, and then click on 'server' property link. The 'url' property shown on the last row in the table should point to Orchestrator; in your case, it should be https://198.200.200.12:8281

2. 'Failed to connect' error could be due to an issue with user permissions. What user have you used to log in to vSphere Web Client? Are you able to log in using the same user to Orchestrator Java Client and browse orchestrator content (workflows/inventory/etc...) ?

[mcfadyenj]

yeah that part is correct but that's not the whole story .

In VMware you need to create a group such as vcoAdmins give that group the desired datacentre access (likely administrator)

ill try dig up the post ..

[mcfadyenj]

if your issue if that the server does not show up in the drop down in vcenter its almost definitely permissions.

the mob extension above is important also as mentioned above. If you see the server in the link listed above. Then set permissions on vco at the datacentre level.

restart for good measure (not sure if it helps in this case, but if in doubt)

then the drop down should be populated. One point to note if you are using external access to vco via rest / soap you may need to do an sso authentication against the endpoint as well. Not something I have ventured into as yet. But I can tell you when sso is on, authentication changes a little (I know this because all my soap endpoints failed to communicate).

[padvou]

I log on vsphere web client using user root.

When I try to use user root to access vcenter orchestrator client using user root it says "not authorized"

[padvou]

[mcfadyenj · Accepted solution]

https://communities.vmware.com/docs/DOC-20368

I found it, that was a mission not where I thought it was.

[padvou]

I read the whole article and followed the instructions, although in 5.5 it's somehow different at some points, but i still cannot see vco in vcenter..

I cannot figure out what i'm missing here.

[iiliev]

'Not authorized' means this user doesn't have enough permissions in Orchestrator.

Try to log in to Orchestrator Java Client using an user from the vCO admin group that you have configured in the Web Configurator (vsphere.local\Administrators). I think the SSO admin user - 'administrator@vsphere.local' (with password 'vmware' is member of this group.

Once logged to Orchestartor Java Client, click on 'Permissions' in the right pane. This should show the currently assigned permissions; I suppose in your case the list will be empty. Click on 'Add access rights...' button above the permissions list and assign permissions. In your case, type 'root' in the filter box, click on the 'root' group in the discovered groups list (it could take some time from group list to be populated), and assign some permissions by enabling the corresponding check boxes.

After assigning permissions, exit Orchestartor Java Client and try to log in again with an user from group that you just gave permissions to ('root'). This time, login should succeed.

Note that vCenter/vSphere Web Client have their own permissions management. By default, I think the 'root' user has admin permissions on vCenter. If you try to use a different user, make sure that the user has been given enough permissions on vCenter using vSphere Web Client.

[padvou]

Problem solved (for now, anyway), since I messed with permissions.

Now on to the races (workflows)..

Thank you very much people!

[Brad_P]

VMware wonders why Orchestrator doesn't have more market penetration - it could be that the configuration is super clunky, and the documentation is awful. I've spent an hour trying to figure this out on my own and beginning to google - very close to the point of "ah, why bother?!" since I don't have any reliance on Orchestrator in my org yet, and there are other automation frameworks.

[mcfadyenj]

Brad,

In my experience most give up before they get too far into it for this same reason. I am now finding out why it is such a valuable product and being that it is free it makes it even better. The capabilities are endless once you get past that initial configuration hurdle.

I too felt that very same pain, but I am also very glad I stuck at it. I have looked at the MS equivalent and find it lacks the finesse in comparison to VCO. Haven't ventured into too many others to compare your comments.

John