Vcenter 5.5. Appliance and SSO dont work for me

[PeteNA]

Hi -

I am trying to get SSO for vcenter 5.5. appliance working. Here is what I have done and my environment.

My environment is a win2K8R2 domain. My vcenter is in a one way trusted domain. For example my domain is something like this:

My logon (sso) is in the ACME domain but i have a group in the LAB.ACME.COM called VC Admins that my sso is a member of.

ACME.COM --> one way trust to --> LAB.ACME.COM the vcenter appliance is joined in the LAB.ACME.COM Domain. I am using the embedded database for everything in vcenter 5.5. appliance.

I have set my identity source to LAB.ACME.COM

I selected Active directory integration

rebooted.

I add that VC Admins group to vc administrators group whihc i can access via administrator@vsphere.local account.

I would see all the child domains and would select that correct domain that I am looking for which is the LAB.ACME.COM domain. (howver I would see an error saying unable to see users in the domain (or something).

So I woud still be able to add the group to the admins group by typing it in the "groups" section:

When i try to logon with the client or webclient via acme\sso or sso@acme.com it will not work. The message i would get is"

Provided credentials are not valid.

ifI check the 'use windows credential box" I would get the following messgae:

The authentication server returned an unexpected error: ns0:RequestFailed: IDM threw unexpected error during authentication :: Native platform error [code: 40041][LW_ERROR_INVALID_PARAMETER][Invalid parameter]. The error may be caused by a malfunctioning identity source.

When I use the windows client - the following messgae would display:

"Windows session credentials cannot be used to log into this server. Enter a username and password"

I have rebooted the vcenter several times I wiped out the vcenter and tried again fresh and still no go. my vcenter host name IS the FQDN. I am not sure what else to try. However this did work for me in on the windows vcenter 5.5. However I want to use the appliance.

Any hints or tips please?

thanks

[abhilashhb]

Have you added this group in the permissions tab of vcenter? After you add the group you will have to grant them permission to login into vcenter. Do this. Go into your vcenter using Web client. Go to permissions tab and verify that the VC Admins group are added there. if not present please add it. then try logging in. it should work.

[PeteNA]

Thanks for the reply. But yes the group is already setup there and is also a member of the administrators group.

Any other tips or suggestions are welcomed

[PeteNA]

Another observation I forgot to add:

when I go to users and groups and lick the "Users" tab

the list does not enumerate instead i get the following error:

Error: Idm client exception: Failed to establish server connection

[GYeohAMAL]

Hi PeteNA,

Did you end up finding a solution for this problem as I'm experiencing the same issue.

Thanks.

[PeteNA]

No,

I actually opened a ticket with vmware - long story short they were able to replicate the issue in their own lab and communicated to me that I had found a bug. They were going to review the code and try to fix it. I do not knwo of an ETA of if and when the fix will come out. (This conversation with them took place with them last thursday on Oct. 31st.

I highly recommend to you and to anyone else to go ahead and open a ticket with vmware describing this issue to them and perhaps they will put some urgency behind this and provide us all with a solution. I am glad to hear they are able to replicate it and that I am not the only one that is facing this issue.

[GYeohAMAL]

Thanks Pete, Lucky for me this is a test system before I upgrade production, but I'll log a ticket shortly to show it isn't an isolated incident.

[jackshu]

I'm seeing the same issue.  Upgraded to 5.5.0 A today and it didn't fix it.  Have two tickets open with vmware.  First ticket has been open for a month already (for version 5.5.0) the second was opened today for 5.5.0.A.

the tech I'm working with doesn't know anything about this.  Would you guys be able to share your ticket #'s so I can have the tech look at your cases to see if they can all work together to figure this out?

[GYeohAMAL]

Hi Jack,

Because my setup was not the same as Pete I did a bit more investigation and found that while I was getting the error "Error: Idm client exception: Failed to establish server connection" when trying to add groups from Active Directory I was still able to login to the Web Client with my AD accounts.  In the end my issue was that I was missing a PTR record for my domain controller (test environment so hadn't done it).  Although I also upgrade my appliance to 5.5.0.5101 Build 1398493, which may have also helped.

The following are links that helped me in the end,

5.5 - authentication problem with AD DS

http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=203374...

So no ticket logged, but I hope you guys get an answer soon.

[PeteNA]

Hello here is the ticket number I have opened. SR 13390762610. Please voice your opinions on this matter and hopefully you opening a ticket will help escalate this.

[jackshu]

Which ptr record were you missing?

We are able to login with our AD accounts.  Sometimes when we login we can see and access vcenter server, other times we can login but see no vcenter servers we can access.

We get the Error: Idm client exception: Failed to establish server connection error when we try to pull up users and groups in sso.

[jackshu]

PeteNA, I have 2 tickets open on this issue.  Been working with VMware support for over a month and they have not been able to resolve it.  It seems whatever fix they put in place only lasts a few hours or until the next reboot of the appliance.

[PeteNA]

@jackshu - Really? They put in some sort of "fix" for you? Sounds like they made you add some domain entries to your resolv.conf file which I believe by design is not persisant on reboots. you will have to re-enter them then again I am not a super linux admin. But I "think" thats what they did? Correct me if i am wrong.

Update: vmware contacted me yesterday regarding my sso issue. They escalted it to thier interal enginnering team to get the code reviwed for a possible fix. I know this doesnt sound lime much of an update but they seem to acknowledge there is an issue. this is why whoever else has the same thing going on that I do should also submit a ticket and feel free to reference my ticket number which I already posted.

[jackshu]

Well I gave up waiting for VMware to find a solution.  I went ahead and built a new appliance from scratch.  Ofcourse it still had the same issue.  But based on what GyeohAMAL said about pointers I decided to take a look at the AD DNS server.  It turns out the appliance joins it self to the domain but doesn't register itself in the AD DNS for some strange reason.  We had manually defined an entry for the appliance, but there was no reverse lookup PTR record.  Once I manually added a reverse lookup PTR record into the AD DNS, the appliance started working correctly.  I now have full AD integration working properly on this.

Told VMware about this, and they said they will forward it to engineering.  They think its a bug in the code.  (normally when we join a computer/server to the AD domain, it will automatically register its IP (static or dynamic) into the AD DNS and create the appropriate revers lookup ptr records as well).

So far it's been 3 days and the appliance has been working flawlessly.  we've rebooted it about a dozen times and it continues to work.

Only other issue now is a health warning about performance stats not rolling up and vmware has  KB article about it, its a known bug.

[ChrisElsen]

Have a look at Handling the VMware vSphere 5.5 Active Directory error - Edge Cloud for a workaround.

Hope that helps.

Chris