Backup user password validity precheck fails in VCF

Products

• VMware Cloud Foundation

Issue/Introduction

Symptoms:

Backup user password validity precheck fails in VCF even when the 'backup' user is not expired

lcm.log shows
2022-05-16T05:49:32.423+0000 DEBUG [vcf_lcm,08d0c38dd75b40d3,53fe,precheckId=125007a1-94a0-4680-a712-d730bc884390,resourceType=DEPLOYMENT_CONFIGURATION,resourceId=0a837d99-7cb4-4ee4-914d-5da77e109634] [c.v.e.s.l.c.v.p.PasswordUtils,Precheck-Single-1] Response object: {“statusCode”:200,“response”:{“id”:“bdce8f57-3e33-4c84-b7d1-009527c09cb4",“description”:“Validating Credentials for BACKUP.“,”executionStatus”:“*****“,”validationChecks”:[{“description”:“Validating Credentials for resource BACKUP_FTP_0a837d99-7cb4-4ee4-914d-5da77e109634.“,”resultStatus”:“*****“,”resourceName”:“sddcmanagervm.local”,“resourceId”:“0a837d99-7cb4-4ee4-914d-5da77e109634”,“resourceType”:“BACKUP”,“credentialType”:“*****“,”username”:“backup”,“passwordDetails”:{“validityStatus”:“INVALID”,“expiryDataRetrievalStatus”:“UNKNOWN”},“errors”:[{“errorCode”:“PASSWORD_MANAGER_COMMAND_EXECUTION_IN_VM_FAILED”,“arguments”:[],“message”:“*****“,”remediationMessage”:“Please verify that the account is active and is not locked, you might need to fix the workflow(s) for resources marked in error state. If the password of the account has expired, manually reset the password in the product and then perform a REMEDIATE operation in the SDDC Manager, to update its stored copy of the password.“,”causes”:[{“message”:“*****“}],“referenceToken”:“78DO4D”}]}]},“headers”:{“Server”:“nginx”,“Date”:“Mon, 16 May 2022 05:49:32 GMT”,“Content-Type”:“application/json”,“Connection”:“close”,“X-Content-Type-Options”:“nosniff”,“X-XSS-Protection”:“1; mode=block”,“Cache-Control”:“no-cache, no-store, max-age=0, must-revalidate”,“Pragma”:“no-cache”,“Expires”:“0”,“X-Frame-Options”:“DENY”}}

 

Resolution

Workaround:

• Take snapshot of SDDC Manager VM (Optional)
• Login to SDDC manager via SSH using vcf 
• su root
• Change the backup user password using "passwd backup"
• Run lookup_passwords and fetch the stored backup password
• Reset the backup password using "passwd backup" to the same as seen in lookup_passwords output
• Retry the precheck , it should pass 

Additional Information

Impact/Risks:
VCF prechecks for backup user  would fail with Red alert