New to vCenter but not ESX - need help understanding SSO and DBs

[duvalld]

I've been gifted the task of upgrading our vCenter server, currently W2008, MS SQL2008 and vSphere 5.1. The previous owner upgraded from 5 to 5.1 and blew up the vCenter db and lost all VDS networking, which I had to recreate. He's gun-shy, hence the reason I'm doing it. We have a UCS blade system with 9 ESXi 5.1 hosts and about 220 guests. The prior owner forgot the master password and tried many other things to recover from aforementioned upgrade and we're reached hardware limits. I didn't build it, but before I upgrade, I like to know how stuff works to avoid making stuff not work. We have a small AD domain running for our VDI infrastructure so the vCenter server is bound to the DC as a client. I have full MS SQL running the vCenter db and the AD LDS role installed. I know vCenter 5.1 uses ADAM (AD LDS) as well as SQL.

Isn't SSO using a db as well? According to the docs I've read, the SSO installer asks about a db. Are there three dbs running on the box? SSO, ADAM and SQL? The docs also talk about users for the SSO db RSA_DBA and RSA_USER. This box only has vpxuser as an additional user. Where is the SSO db?

I want to make sure I understand this so I can recreate it on another box with my own master password, then upgrade from there.

BTW, we're not an AD shop, nor am I a db admin, so some of this is over my head for now.

Thanks,

Dale DuVall

Datacenter Admin

Lane Community College

Eugene, Oregon

[rcporto]

If you lost the SSO master password, you have only one option that is re-installing the vCenter Single Sign-On and re-register the vCenter to the SSO. See: Unlocking and resetting the VMware vCenter Single Sign-On administrator password (2034608) | VMware ...

Note: Resetting the password does not change the master password for vCenter Single Sign-On 5.1. The master password is stored in the database and can only be changed by re-installing vCenter Single Sign-On 5.1 with a fresh back-end database. This procedure only generates a secondary password for the admin@system-domain to utilize. The master password continues to remain the same.

So, my recommendation is build a new vCenter Server that can be even at newer version, like 5.5, and move the hosts from the old vCenter to the new one. The following KB shows how move a ESXi from another vCenter server: Moving an ESX/ESXi host with vDS from one vCenter Server to another (1029498) | VMware KB

[duvalld]

I understand that I cannot recover the master password. I also plan to use the same hostname and ip address on the new box. I have already backed up the certs as well. Moving hosts to another vCenter will be complex. I have a pretty extensive virtual distributed switch.

I was hoping to understand what I'm seeing on the existing box. If the prior admin chose the included db for SSO during the initial install, where is it? What db is it running on. I've looked in the AD LDS management tool and do not see a db that could be sso. I also don't see it in the SQL management tool. I have a VCDB there.  I assume that's my vCenter db. The vCenter SSO installer asks if I want to use an existing db. If I wanted to, where would I find it?

Dale

[rcporto]

To locate the database and instance of the SSO database, check the jndi.properties file (default location (C:\Program Files\VMware\Infrastructure\SSOServer\webapps\ims\web-inf\classes\) and look for the following values:

com.rsa.db.hostname

com.rsa.instanceName

[duvalld]

So, I found this.

com.rsa.db.msserverinstance=VIM_SQLEXP

This tells me that SSO is using SQL Express. Therefore, I have three DB engines running - SQL, SQL Express and ADAM/AD LDS, yes?

Dale

[rcporto]

Looks like yes 🙂 Note that you can consolidate the SSO and vCenter on the same SQL instance and when you upgrade your vCenter to version 5.5 you will don't need a SQL database to store the SSO, since at version 5.5, SSO do not require a SQL database anymore.