vsphere showing invalid credential for vRO

[rupamc2016]

I have  lab setup for vcenter server 6.0.2 and vRA 6.0.2

I am using vco embedded system.

But I cannt see the vsphere instance on the vCO configuration page.

I also removed the old plugin for the old vCO server

The extension manager shows the vco plugin .

Any help appreciated

When i look ate the logs from vcenter i get the below message

200003 org.springframework.web.client.RestTemplate	GET request for "https://cac.domain.com:8281/vco/api/users" resulted in 401 (Failed to create IdP configuration for tenant domain.com); invoking error handler
[2016-11-25T20:33:40.907Z] [WARN ] data-service-pool-955	70000301 100009 200003 com.vmware.vco.session.impl.VcoServiceFactoryImpl	Error creating vCO service on [Configuration [servicePath=/vco/api/, vcoServiceUri=https://cac.domain.com:8281, serviceGuid=cac.domain.com]] org.springframework.web.client.HttpClientErrorException: 401 Failed to create IdP configuration for tenant domain.com
[2016-11-25T20:33:41.125Z] [INFO ] data-service-pool-960	70000307 100009 200003 com.vmware.vco.adapter.dataservice.WorkflowRunInfoProcessor	Delegated token requested for vCO host: cac.domain.com
[2016-11-25T20:33:47.198Z] [WARN ] data-service-pool-960	70000307 100009 200003 org.springframework.web.client.RestTemplate	GET request for "https://cac.domain.com:8281/vco/api/users" resulted in 401 (Failed to create IdP configuration for tenant domain.com); invoking error handler
[2016-11-25T20:33:47.200Z] [WARN ] data-service-pool-960	70000307 100009 200003 com.vmware.vco.session.impl.VcoServiceFactoryImpl	Error creating vCO service on [Configuration [servicePath=/vco/api/, vcoServiceUri=https://cac.domain.com:8281, serviceGuid=cac.domain.com]] org.springframework.web.client.HttpClientErrorException: 401 Failed to create IdP configuration for tenant domain.com

[iiliev]

Hi,

I'm a bit confused. Are you sure you have vRA 6.0.2? I can't seem to find such version in our build system. Could you check what is the build number of your vRA appliance?

Also, check if the embedded vCO version you have is compatible with vCenter 6.0.2; here is the version interop matrix - https://www.vmware.com/resources/compatibility/sim/interop_matrix.php#interop&13=&2=

What do you mean exactly by 'removed the old plug-in' and 'can't see the vsphere instance'?

It is not clear to me what is configured/working and what is not. What type of authentication the vCO is configured with? Is it the same SSO instance used by vCenter Web client? Have you imported the SSO and vCenter certificates, and are they valid/non-expired? Are you trying to configure vCenter plug-in in 'shared session' or 'per user session' mode?

The provided logs are from vCenter Web client, not from vCenter, and are not very relevant to vCO server configuration. You need to check vCO server/config logs, vCenter logs and SSO server logs; vCenter Web client logs are useful when you are trying to troubleshoot connection problems between vCO plug-in for Web client and vCO server.

[rupamc2016]

Here is the complete version for vRA.(6.2.4.0 Build 3624994).

Now i alreday had a vRA of same version integrated with vcenter,Now for some reason we are removing the old deployment of vRA and installing a new vRA instance and integrate with the vcenter.

Now I have remove the plugin for the old vRA from extension manager of vcenter server .Some how i try to install the plugin and now i can see the plugin in the vcenter extension manager pointing toward the new vRA deployemnt.

Now when i login to the embedded orchestrator i cannot see the vcenter option in the botton of the option to configure vcenter and below log in previous post was pasted from the vcenter.

my vcenter is integrated with AD for authentication and when i configured the SSO in the identity server i used the vsphere.local domain for authentication,

My vRA and the identity server SSO is connected properly.

What logs can i look to troubleshoot the reason of the unvailaibilty of the vcenter option in the orchestrator config

I also installed the license and certificate in the embedded orchestrator

I am attaching the orchestrator screenshots.

[iiliev]

Thanks for the screenshots.

vRA 6.2.4 contains an embedded vRO 6.0.4. vCenter plug-in that ships with this version of vRO (and newer) is not configurable in the Web Configurator application anymore. Instead, it is configurable via vRO workflows.

So you need to launch vRO Java client (workflow designer), then navigate workflow inventory tree Library > vCenter > Configuration, and use the workflows available there to configure your vCenter instances. The main workflows are 'Add a vCenter Server instance' (to register your vCenter in vRO) and optionally 'Register vCenter Orchestrator as a vCenter Server extension' (to register extension for accessing the plug-in in vSphere Web client).

[rupamc2016]

Thanks for the prompt reply.

I already added the vcenter through the workflow and completed the two step you mentioned.

But the vcenter server is showing invalid credential in the orchestrator client.

Appreciate your response

[iiliev]

OK, so there seems to be some issue with login into vCenter. A few more questions:

• When you added the vCenter instance in vRO, did you specify 'shared session' or 'per user session'?
• Is the user you use to login to vRO client a member of the admin group specified when configuring authentication, or a regular/non-admin user?
• Are you able to login with the same user/password to https://{vcenter-ip-or-host}/vsphere-client  (https://vcs-01/vsphere-client) ? And also browse the MOB at https://vcs-01/mob ?

Also, could you check vRO log file at /var/log/vco/app-server/server.log for errors/exceptions ?

[rupamc2016]

Here are my reply

            When you added the vCenter instance in vRO, did you specify 'shared session' or 'per user session'?

      Ans: Attached screenshot  for info., I think its per user

• Is the user you use to login to vRO client a member of the admin group specified when configuring authentication, or a regular/non-admin user?

       Ans: Its a Local admin user that I created while installing the vRA plaform ( administrator@vsphere.local)

• Are you able to login with the same user/password to https://{vcenter-ip-or-host}/vsphere-client  (https://vcs-01/vsphere-client) ? And also browse the MOB at https://vcs-01/mob

        I am using the domain ( AD ) user to login to the vcenter since my vcenter is integrated with AD, But I am not able to login to orchestrator using the same AD credential.

the logs still says my old vrealize server which I removed from the Mob ,In MOB it shows my new server name .

Attached are the files for reference.

Appreciate you response

[iiliev]

Yes, it is 'session per user' mode. This means the username/password the vCenter plug-in use to connect to vCenter server are the same you use to login to vRO client. If you are not able to login to vSphere Web client UI with the same username/password, then you'll get invalid credentials error in vRO inventory tree view.

What do you mean by you've created administrator@vsphere.local? Isn't this the default SSO administrator account that is already available? Sorry, I got totally lost what (and how) is configured in your environment and what are the accounts you are using in different products

[rupamc2016]

Yes administrator@vsphere.local? is the same default account.

What should be done in order to resolve the issue . and what will be the reason of getting the old vRA server I mentioned in my previous reply  in the server.log I shared.

[dvatov]

From where does this 'domain.com' comes? Is it provided as the default tenant in vSphere authentication settings in Control Center?

[rupamc2016]

domain.com is my domain( AD)