View Only
  • 1.  vCenter Repoint Bug

    Posted Dec 08, 2021 09:43 PM

    Encountered this bug when testing a SSO repoint we need to complete.  After a domain repoint, Administrator could no longer login to VAMI and other issues were discovered.  The trigger is the domain repoint.  Bug can be easily replicated.  Found this was true for latest 6.7 version and multiple versions in 7.0 series.


    Deploy VCSA with SSO domain of vsphere.local

     - Administrator can access VAMI (port 5480) and GUI (port 443).


    Perform SSO domain repoint from "vsphere.local" to anything else (say, "moonchild.local").  Repoint succeeds without errors. 

     - Administrator cannot access VAMI (port 5480)

     - Root can access VAMI (port 5480)

     - Administrator can access GUI (port 443) and perform all functions tested.


    After the SSO domain repoint is completed, the SSO group "Administrators" is no longer a member of the "SystemConfiguration.Administrators" group. Adding Administrators to that group solves the problem - Administrator is then able to login to the VAMI.


    However, that is not all.


    Any domain repoint results in these 4 changes, which all appear to be bugs:

    - SSO group "Administrators" is no longer a member of the "SystemConfiguration.Administrators" group

    - vAPI services option under VAMI reports errors. lsdoctor -l shows the following error:

    ERROR generateReport: default-first-site\fqdn_of_vcenter (VC 7.0 or CGW) found Duplicates Found: Ignore if this is the PSC HA VIP. Otherwise, you must unregister the extra endpoints.

    - "SystemConfiguration.BashShellAdministrators" group disappears (Administrator is part of this group by default).

    - waiter-xxxxxxxx account disappears from SSO domain (in fact, all accounts except Administrator, krbtgt, and K/M disappear).


    I can resolve the first issue by adding Administrators back to SystemConfiguration.Administrators. The errors in the second issue are resolved by running lsdoctor -r and replacing all services. I do not know how to resolve issues 3 and 4. Testing shows that the Administrator account loses the ability to access the shell after the repoint, so issue 3 impacts functionality.


    VMWare Support has not answered questions about issues 3 and 4.  On day 5 of the trouble ticket, the tech replied that issue 1 is a known bug and being worked on.


    These problems are only what I have identified by my own testing.  It concerns me about other functionality that is broken by a repoint.

  • 2.  RE: vCenter Repoint Bug

    Posted Jun 09, 2022 08:33 PM

    Almost a year later I see the same behavior on vCenter, did you ever hear back from support?

  • 3.  RE: vCenter Repoint Bug

    Posted Jun 10, 2022 05:14 AM

    As of vSphere 6.0U1, VMware allow an embedded vCenter server deployment to be reconfigured to an external deployment, which demotes the Platform Services Controller (PSC) components of the embedded node and points the VC server to an external PSC node which resides in the same Single Sign On (SSO) domain as the source embedded node.


  • 4.  RE: vCenter Repoint Bug

    Posted Jun 10, 2022 01:46 PM

    Unfortunately that's not viable for us as we're running 7.0.3 which doesn't allow for external PSCs anymore

  • 5.  RE: vCenter Repoint Bug

    Posted Jun 10, 2022 11:38 AM

    We gave up waiting.

    The number of problems seen when performing a repoint was too high a risk.  We deployed a new vCenter with the desired domain and migrated all of the hosts to it.  A lot more time was required than just performing a repoint, but it avoided an possibility of problems from the repoint.

  • 6.  RE: vCenter Repoint Bug

    Posted Jun 10, 2022 01:48 PM

    That's precisely what I'm thinking, however our environment is fairly big and integrated with external solutions which makes the buildout of new vCenters a little daunting... Will probably end up going that way though... I'll open an SR with support and update the thread if anything comes up

  • 7.  RE: vCenter Repoint Bug

    Posted Jun 02, 2023 06:44 AM

    It's possible that the bug you're referring to was discovered or reported after that date. It's recommended to consult the official VMware documentation, support forums, or contact VMware support directly for the most up-to-date and accurate information regarding any vCenter bugs or issues. They will be able to provide you with guidance on how to address and resolve the specific bug you're encountering.