Installing vCenter Server 5.1 fails on Registering with vCenter Single Sign On

[jmyren]

Hi All,

Server 2008R2.

Both upgrade from 5.01b and fresh install gives the same error message.

vCenter Single Sign On installed OK

vCenter Inventory Service installed OK

The installation of vCenter Server aborts when the installation dialog says:

Registering with vCenter Single Sign On

The error message is:

Error 29113. Wrong input - either a command line argument is wrong, a file cannot be found or the spec file doesen't contain the required information, or the clocks on the two systems are not synchronized. Check vm_ssoreg.log in system temporary folder for details.

Log file enclosed.

Do anyone know a solution for this?

John

[XavierWu]

I've got the same error as yours. Still looking for a solution...

[Two Expceptions]

[2012-09-12 14:44:20,391 main  ERROR com.vmware.vim.install.cli.RegTool] Invalid solution certificate. Certificate already expired
[2012-09-12 14:44:20,391 main  DEBUG com.vmware.vim.install.cli.RegTool]
java.lang.IllegalArgumentException: Invalid solution certificate. Certificate already expired
    at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.execute(VmomiClientCommand.java:125)
    at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.executeEnsuringDomainErrorIs(VmomiClientCommand.java:167)
    at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.executeEnsuringDomainErrorIs(VmomiClientCommand.java:159)
    at com.vmware.vim.sso.admin.client.vmomi.impl.PrincipalManagementImpl.createLocalSolutionUser(PrincipalManagementImpl.java:188)
    at com.vmware.vim.install.cli.commands.RegisterSolutionCommand.execute(RegisterSolutionCommand.java:48)
    at com.vmware.vim.install.cli.commands.CompositeCommand.execute(CompositeCommand.java:38)
    at com.vmware.vim.install.cli.RegTool.execute(RegTool.java:171)
    at com.vmware.vim.install.cli.RegTool.process(RegTool.java:102)
    at com.vmware.vim.install.cli.RegTool.main(RegTool.java:33)

------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------

[2012-09-12 14:44:28,109 main  DEBUG com.vmware.vim.install.cli.commands.UnregisterSolutionCommand]
com.vmware.vim.sso.admin.exception.InvalidPrincipalException: The specified principal (vCenterServer_2012.09.12_143630) is invalid.
    at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.execute(VmomiClientCommand.java:88)
    at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.executeEnsuringDomainErrorIs(VmomiClientCommand.java:167)
    at com.vmware.vim.sso.admin.client.vmomi.impl.VmomiClientCommand.executeEnsuringDomainErrorIs(VmomiClientCommand.java:154)
    at com.vmware.vim.sso.admin.client.vmomi.impl.PrincipalManagementImpl.deleteLocalPrincipal(PrincipalManagementImpl.java:209)
    at com.vmware.vim.install.cli.commands.UnregisterSolutionCommand.execute(UnregisterSolutionCommand.java:85)
    at com.vmware.vim.install.cli.RegTool.execute(RegTool.java:171)
    at com.vmware.vim.install.cli.RegTool.process(RegTool.java:106)
    at com.vmware.vim.install.cli.RegTool.main(RegTool.java:33)
[2012-09-12 14:44:28,109 main  INFO  com.vmware.vim.install.cli.RegTool] Return code is: UnregisterFailed

[firestartah]

Hi

Have a look at this kb article: http://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=203388...

Gregg

[jmyren]

I don't think that document is describing this exact error we are seeing.

We also have the same certificate error which leads to the "InvalidInput":

[2012-09-11 23:12:00,304 main  ERROR com.vmware.vim.install.cli.RegTool] Invalid solution certificate. Certificate already expired
[2012-09-11 23:12:00,304 main  DEBUG com.vmware.vim.install.cli.RegTool]
java.lang.IllegalArgumentException: Invalid solution certificate. Certificate already expired
......
[2012-09-11 23:12:00,320 main  INFO  com.vmware.vim.install.cli.RegTool] Return code is: InvalidInput

I am not sure which certificate this is, or how we can reissue or get a new one, with a new date, so it's not expired.

John

[XavierWu]

According to kb, seems we shouldn't use the Simple Install.

You  may see this error while trying to input a vCenter Server administrator  user or group while configuring SSO in HA or Multisite mode:

Wrong  Input - either a command line argument is wrong, a file cannot be found  or the spec file doesn't contain the required information, or the  clocks on the two systems are not synchronized. Check vm_ssoreg.log in  the system temprary folder for details

This error  indicates that HA or multisite mode does not recognize the local  identity source when specifying a user for the configuration.

To resolve this issue, qualify the user name with the source you want  to use. For example, instead of using Administrators use  Administrators@domain.com.

Default is using Adminstrators, we should install the components one by one.

My vCenter instance got some problem... cannot try now....

[jmyren]

We have not used Simple Install, but installed the components One by One, starting with SSO.

We dont't have HA or multisite for our vCenter Server.

We are not able to change the suggested username for SSO which is admin@System-Domain when starting SSO install.

Should we use an other username when installing vCenter Server? If so, how do we add this user to the SSO database?

John

[ManGroup]

Hi,

I have the same issue and logged an SR with a TSE. Have provided logs etc as mentioned in your message and other parts of this thread.

VMware's response was:

"This is a known issue that several customers are hitting at present and is under investigation by our product engineers. Could you please provide the following to help with the investigation, at this point there is as yet no resolution or workaround:"

So... we have to sit tight and wait for them to work the issue......

[PCECI]

Same here.  Opened an SR yesterday, spent 4 hours troubleshooting with no resolution. 

[ManGroup]

oh dear.

My experience has been upgrading rather than a fresh install.

vC in question was originally 4.1, bumped to 5.0.1.

Same for you guys, or is it failing on a fresh install too?

My only side comment would be the SSO is a pain to install and looks to have been rushed into the release (imb). Hopefully once up and running it pays off in terms of functionality.

[PCECI]

I was trying to upgrade from 5.0 to 5.1.  Tried a fresh install as well after a couple hours, same result.

[jmyren]

Hi all,

Thank you for the feedback so far..

Please post a message when a solution is ready.

John

[gwillms]

Got the exact same thing on a vCenter server (2008 r2 SP1) that was 4.1, then upgraded to 5.0 u1b.  Also got the same answer from support: they know about it and the developers are working on it; send us your logs.  Should be interesting to see what the resolution is here since this seems to be a fairly common issue, but it's not happening EVERYWHERE.

The SSO features look like they'll be nice, but I wish it was an optional component.

[Crinos512]

gwillms wrote:

Got the exact same thing on a vCenter server (2008 r2 SP1) that was 4.1, then upgraded to 5.0 u1b.  Also got the same answer from support: they know about it and the developers are working on it; send us your logs.  Should be interesting to see what the resolution is here since this seems to be a fairly common issue, but it's not happening EVERYWHERE.

The SSO features look like they'll be nice, but I wish it was an optional component.

Agreed...

Upgraded from 5.0 to 5.1 this morning and paniked when I lost my AD account access... I didn't realize that the local administrator account on the vCenter server was a valid vCenter Administrator fo what felt like hours! :smileycry:

I can ping my domain successfully (ie ping domain.net), and pinging the result with the -a switch supplies me with my DC hostname.

I even tried removing the vCenter server from the domain and readding it.

I am eagerly awaiting resolution on this issue.

[Crinos512]

Very Helpful video by  by VMwareTechPubs:

http://youtu.be/OT78DInhYRc "vCenter Single Sign On: Understanding the Administrators role"

I think I am close to figuring this one out... Basically what happened was the SSO install did not automatically configure the domain "Identity Source" so I had to login to the Web Client as admin@System-Domain and add it manually.

Tips:

• The Primary Server URL should be in the form ldap://domain.net:3268
• Base DN for Users and Groups both look like DC=domain,DC=net

Hope this helps!

[jmyren]

Hi all,

In my situation all my domains are added automatically as an Identity Source during installation of SSO, and I don't have to create them manually.

I have once more gone trough the installation routine and documentation, vSphere Installation and Setup for VMWare 5.1, and have found the following:

- Page 255, 13 If prompted to install or overwrite a certificate, follow the prompt.

    * I am not prompted to install or overwrite a certificate

- Page 256, 14 Register a vCenter Server administrator with vCenter Single Sign On, and select the check box if the administrator is a group.

The administrator or group you register here is granted the necessary privileges to administer the vCenter

Server instance that you are installing.

    * I am never asked for this administrator, and this "page" is not in my Setup Wizard

Should this "page" always appear in my Setup Wizard?

John

[schurl850 · Accepted solution]

i had the same problem with the certificate expired. vmware has made a new kb article:

http://kb.vmware.com/kb/2035413

this vcsso file is only there, if you do not click ok on the error window. but you do not need it anyway. look under C:\ProgramData\VMware\VMware VirtualCenter\SSL and see if the rui certificate has expired. mine did, and after removing all files in there and restarting the installation, everything went fine, and the new certificate is valid 10 years 😉

hope this does help somebody.

[ManGroup]

KB2035413 was just published with a suggested fix. Just applying those changes and starting the installer... will keep you guys posted.

[jmyren]

Thank you very much schurl850, this solved my problem.

John

[XavierWu]

I am able to come over the wrong input issues with SSO. However, the installation stalled at "Please wait while Windows configures VMware vSphere Profile-Driven Storage".

Anyone got the same issue?

[Update]

FYI. It took me about 20mins to finish finally...

All good now.

[jmyren]

Hi  XavierWu,

This was the same for me also, took a very long time about 20 minutes, but it finished at last.

John