vcheck constantly asking for vcenter credentials

[Dingo80]

hi all

im looking at deploying vcheck to all our regional offices which are spread around the world. So far i have managed to do 2 locations without too much trouble... but ive gotten stuck on the next office where i cannot for the life of me figure out why vcheck keeps asking for login credentials.

it doesnt matter if i run vcheck as administrator, as my admin account or as the vcheck service account it does not want to remember the login credentials so every time i re-run the script even if its in the same window session the credentials window pops up!
even logging onto the server as the vcheck service account and running everything from there doesnt seem to work.
i can confirm that my admin account and the vcheck service account have admin access within vcenter.

im not sure if ive missed a step but the setup process for this is quite easy so im a little stumped as to what is happening.

pre-requisites are all installed.
i have run the initial config setup and when i re-run -config, the details are still there so info is being saved.

where are the credentials meant to be stored?
am i missing a step?

entering in the login credentials manually works and script completes and emails me correctly.

any thoughts or suggestions will be greatly appreciated!

let me know if you need any more details

thanks

[LucD]

I always connect to all vCenters before I run vCheck against multiple vCenters.

I use the configuration as I described in  7.  Re: run vCheck for mutliple VC

In the script from point 3, you could add the different Connect-VIServer entries.

And use the Credential Store to retrieve the credentials.

[Dingo80]

thanks

but i need to be able to set this up as a scheduled task hence why i need it to run automatically without me having to constantly input login credentials.

if i do set it up as schedule task the task doesnt run correctly because in the background its asking for credentials.

confused as to why i didnt have this issue with the first 2 locations that i setup vcheck on... but now all of a sudden its giving me all this grief 😕

[LucD · Accepted solution]

Have a look at the New-VICredentialStoreItem cmdlet.

But make sure to create the entry with the same account as the one you use to run the scheduled task.

The reason you see this behaviour could be due to the way you configured SSO on these vCenters.

Is the account (the one you use to run the scheduled tasks) member of the default authentication source (Windows AD) in all the SSO?

[Dingo80]

aaaaaahhhhhh... SSO... yes that might be it, i do know that in certain locations we have issues with SSO and the windows credentials button doesnt work properly when trying to log in via the client.

this office might very well be one of those effected.. i havent checked this yet but i will do that when im back at work tomorrow.

the service account is in the vcenter admins group and it does work in the first 2 locations i did this so i would say yes it is part of the default authentication source... saying that i will double check this as well.

thanks for the tip!

also thanks for the cmdlet, i will look into it if the SSO thing is not the reason for this.

i will post back tomorrow

cheers!

[Dingo80]

ok so it seems like there is a authentication issue with SSO for the locations that are not working with vcheck.

to test I found another location where I was able to tick the windows credentials check box and roll out vcheck... this worked perfectly without any dramas.

I have followed a number of kb articles that show how to fix broken sso with the main ones being this...

Logging into vCenter Server 5.1 or 5.5 using the "Use Windows session credentials" option fails with...

Unable to log in to VMware vCenter Server Appliance with the Use Windows session credentials option ...

unfortunately this did not resolve the issue.

doing more digging around I found posts and blogs saying to check the network settings and hostname within the vcsa admin page.

so after logging in there is definitely something weird going on because the hostname is different to the hostname I'm connecting to.

eg..

vcenter01 is the hostname I'm connecting to

vcenter02 is the hostname in vcsa !

DNS entries only show vcenter01

there is no vcenter02

as a test I created a HOST (a record) DNS entry with vcenter02 and the ip number.. and surprise surprise I can now log in using the windows authentication check box.

so the question now is, why is the hostname different to the dns record... I wasn't the one who set this up but ill be the one who now has to clean it up. :smileyshocked:

ill have to test now to see if this new DNS entry I just entered resolves the problem of vCheck constantly asking for credentials.

either way I think these locations and the dns entries have to be resolved. :smileyplain:

hopefully changing the hostname is easy and wont break anything... Id rather avoid having to rebuild vcenter from scratch

[Dingo80]

success !

pointing vCheck to vcenter02 works... credentials box did not show up!

now I know what the issue is and how to fix it and resolve it.

thanks everybody for your help.. with your input I managed to find the solution!

[LucD]

Great!

Glad you have it working