SSO continues to bind to demoted AD server

[mark_chuman]

Anyone seen this before?  IE, you add an identity source, the AD server gets demoted yet SSO continues to try and bind to it?  I've removed and re-added identity sources, but it continues to try for the demoted server:

In this log - C:\ProgramData\VMware\CIS\logs\vmware-sso\vmware-sts-idmd.log you see:

2014-07-21 09:50:41,562 WARN   [ServerUtils] cannot bind connection: [ldap://adserver.domain.COM, null]

2014-07-21 09:50:41,562 ERROR  [ServerUtils] cannot establish connection with uri: [ldap://adserver.domain.COM]

5.5 SSO

[rcporto · Accepted solution]

The domain controller was demoted successfully ? Without /forceremoval option ? If not, you may need run a metadata cleanup for the old DC... and cleanup any services records on DNS pointing to the old DC.

Anyway, did you restarted the SSO services after add/remove the identity sources ? And you may try add the identity source using the option "Active Directory as an LDAP Server" instead of "Active Directory (Integrated Windows Authentication)".

[mark_chuman]

Many thanks for the input.  SSO service restart didn't resolve the issue, but an actual server reboot resolved it.  Trying to pinpoint exactly how and what this would "refresh" to remedy the situation.

[jcouch]

Why does VMWare think it would be a good idea to point to a single DC? What a junk design!