topic Re: PSC 6 - remove old PSC in VMware vCenter™ Discussions

PSC 6 - remove old PSC

virtual_dave1 — Thu, 17 Sep 2015 14:26:54 GMT

Some time ago I attempted to install the first external PSC on Windows into my existing multi-site 5.5 SSO. Despite effort i could not get it to complete successfully so gave up, used a PSC appliance, moved the rest of the environment to 6.0 and all has been well since. I forget what the exact problem was.

Zoom forward to today, all is working. I have 2x external PSC appliances and 2x VCSA appliances.

I attempted to upgrade to Update 1 but despite successful upgrades of PSCs and VCSAs I could not get the web client to load up after login (legacy client worked fine). "An internal error has occurred - index 0 out of bounds'. Web-client log files kept showing errors about not being able to contact this stale\old Windows PSC. I was under pressure to get access to vCenter back so i rolled back to snapshots i took before starting upgrade and all is well with the world again.

Before attempting to upgrade again I would like to clear up this stale record but am having trouble. I've been through KB2106736 but i get the following error:

cmsso-util unregister --node-pnid Old-PSC --username administrator@vsphere.local --passwd sso_pwd

Could not find a host id which maps to Old-PSC in Component Manager

Failed!!!

I also try the following but get the below error:

/usr/lib/vmware-vmdir/bin/vdcleavefed -h Old-PSC -u administrator -u sso_pwd

fdcleavefd offline for server Old-PSC

Leave federation cleanup failed. Error[13] - Confidentiality required.

I have run the above commands on both my PSC appliances with the same result.

Any ideas before I open a support case?

Thanks.

Dave

Re: PSC 6 - remove old PSC

Ganeshsekarbabu — Fri, 02 Oct 2015 05:22:29 GMT

Make sure first the PSC is powerdown and try by proper FQDN name.Mostly below error will come only if the IP or FQDN name failed to search..

or try this command with proper FQDN name /usr/lib/vmware-vmdir/bin/vdcleavefed -h -u [-w ] ( Refer VMware KB 2114233 )

VMware KB: Attempting to join an Appliance-based Platform Services Controller or vCenter Server to a vSphere domain …

Re: PSC 6 - remove old PSC

atikoo — Mon, 02 Nov 2015 20:06:39 GMT

Leave federation cleanup failed. Error[13] - Confidentiality required.

This could be because the stale entry does not exist for the PSC/vCenter installation from the previous/failed installation attempt.

Re: PSC 6 - remove old PSC

Ganeshsekarbabu — Mon, 02 Nov 2015 20:32:02 GMT

In my case PSC is showing in the Nodes but still it is failing with the error as " Confidentiality required " so I just re-installed the PSC with the same name and then successfully cleaned the PSC ..

Re: PSC 6 - remove old PSC

wreedctd — Sun, 10 Jan 2016 19:27:44 GMT

Did you ever get this fixed? I am having same issue.

Re: PSC 6 - remove old PSC

Agryppa — Thu, 14 Jan 2016 10:03:37 GMT

@GaneshsekarbabuGaneshsekarbabu

Could you explain it more widely " I just re-installed the PSC with the same name and then successfully cleaned the PSC" ?

Regards,

Piotr

Re: PSC 6 - remove old PSC

cabernocht — Wed, 25 Jul 2018 17:54:07 GMT

I had the same issue.

I was able to run cmsso-util unregister without errors, but I didn't get the full output I was supposed to.

I ran vdcleavefed but got the confidentiality error, or failed with an LDAP error in the logs.

I used this guy's advice to connect to my vsphere's LDAP.

http://www.electricmonk.org.uk/2017/03/07/using-jxplorer-to-connect-to-vsphere-psc-server/

When I went there, I saw that my PSC's each had a replication agreement with the defunct PSC, and not with each other.

I used vdcrepadmin -f createagreement to create a replication agreement between the two remaining PSC's.

It sorta looks like that's what was keeping the ghost of the old PSC around. After I fixed the replication agreement, I ran vdcleavefed and the old PSC went away.

- t2

Re: PSC 6 - remove old PSC

RajeevVCP4 — Fri, 27 Jul 2018 06:37:11 GMT

psc03:~ # /usr/lib/vmware-vmdir/bin/vdcleavefed -h psc02.alex.local -u administrator -w SSO-Admin-Pwd

change your psc name and try this command

Re: PSC 6 - remove old PSC

mj19922007 — Wed, 24 Nov 2021 08:49:54 GMT

This is a good solution, I have same problem and I saw that my PSC's each had a replication agreement with the defunct PSC, and not with each other.

But I can not recreate a replication agreement between the two PSC's because one PSC is down and I get this error when I try to create agreement.

vdcrepadmin failed. Error [Server down] [9127]

Any ideas ?

@cabernocht wrote:
I had the same issue.
I was able to run cmsso-util unregister without errors, but I didn't get the full output I was supposed to.
I ran vdcleavefed but got the confidentiality error, or failed with an LDAP error in the logs.

I used this guy's advice to connect to my vsphere's LDAP.
http://www.electricmonk.org.uk/2017/03/07/using-jxplorer-to-connect-to-vsphere-psc-server/

When I went there, I saw that my PSC's each had a replication agreement with the defunct PSC, and not with each other.
I used vdcrepadmin -f createagreement to create a replication agreement between the two remaining PSC's.

It sorta looks like that's what was keeping the ghost of the old PSC around. After I fixed the replication agreement, I ran vdcleavefed and the old PSC went away.

- t2