Unable to edit tag category due to IllegalArgumentException error

Products

• VMware vCenter Server

Issue/Introduction

This article will provide a method to fix "IllegalArgumentException" thrown when trying to fetch category which doesn’t have the namespace URI and only consists of a local part and update the associable types via jExplorer.

Below snippet is observed in /var/log/vmware/vpxd-svcs/vpxd-svcs.log

java.lang.IllegalArgumentException: Illegal associableType : VirtualMachine

        at com.vmware.cis.core.tagging.internal.helper.TaggingConverter.getLocalPart(TaggingConverter.java:260)

        at com.vmware.cis.core.tagging.internal.helper.TaggingConverter.internalToVmodlAssociableType(TaggingConverter.java:172)
        at com.vmware.cis.core.tagging.internal.helper.TaggingConverter.internalToVmodl(TaggingConverter.java:72)
        at com.vmware.cis.core.tagging.vmodl.MoCategory.getInfo(MoCategory.java:60)
        at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
        at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)
        at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43

Environment

VMware vCenter Server 8.x

VMware vCenter Server 7.x

VMware vCenter Server 6.x

Cause

Before vCenter Server 7.0U1, if you had only passed local part while creating category it would have automatically added the namespace. From tagging view, "associable types" is just a string that user stores, usually associable types consist of two things namespace uri + local def. i.e., if you see an associable type "urn:vim25:Folder" then namespace is "urn:vim25" and local object def is "Folder".

For example, when before vCenter Server 7.0U1 using REST call passing only local part in request body was valid and tagging service would have prepended namespace uri to associable type:

{
"create_spec": {
"associable_types": [
"ClusterComputeResource",
],
"cardinality": "SINGLE",
"description": "example category description",
"name": "cat-name"
}
}

After vCenter Server 7.0U1, you have to pass namespace and it's not prepended anymore, and above request body should look like:

 

{
"create_spec": {
"associable_types": [
"urn:vim25:ClusterComputeResource",
],
"cardinality": "SINGLE",
"description": "example category description",
"name": "cat-name"
}
}

 

Hence, we have to add namespace uri to associable type on vCenter Servers with version higher than 7.0U1.

Resolution

Currently there is no resolution. Please follow the below workaround steps.

Workaround:
If upgraded to VC version "greater than 7.0 u1" the namespace URI has to be added to associableType. Associable types are also harder to update because once you add a type you can't remove it, you can only add more types to it. Hence, it may be necessary to recreate tags and reassign associations under new categories since after version 7.0 u1, you have to pass namespace and it's not prepended anymore so you don't lose the associations when you delete the old categories with invalid associable type.

Method 1:

You may use jXplorer to update associable types of existing categories.
For every entry, we need to update associableType field(s).
Login -

jxplorer-3.3.1.2.app/Contents/MacOS/jxplorer

To login to vCenter Server ldap table, use the input params as below:

host: <vc-ip or hostname>,
port: 389
user dn: cn=Administrator,cn=Users,dc=vsphere,dc=local
base dn: dc=vsphere, dc=local
level : User + pwd

Note: Make sure to update the parameters as per your vCenter Server settings.

Once logged in we can browse the ldap tables, for example navigate to vsphere->services→Tagging

To edit the entry:

1. Click the entry row on left navigation pane.
2. On right side, click Table Editor tab.
3. Locate the attribute (row(s) with name) vmwTaggingCategoryAssociableType on first column.
4. For each row, append corresponding field value on 2nd column with urn:vim25 example. change value from StoragePod to urn:vim25:StoragePod
5. Click Submit button just below the right pane showing attributes.

Method 2:

• If the "vmwTaggingCategoryAssociableType" does not contain appropriate attributes, proceed with ldapmodify to edit the associable types for categories as mentioned below.

/opt/likewise/bin/ldapmodify -h localhost -p 389 -x -D "cn=administrator,cn=users,dc=vsphere,dc=local" -W << EOF
dn: cn=urn:vmomi:InventoryServiceCategory:########-####-####-####-e8cdc122ce8e:GLOBAL,cn=urn:vmomi:InventoryServiceScope:default-scope:GLOBAL,cn=Tagging,cn=Services,dc=vsphere,dc=local
Changetype: modify
Replace: vmwTaggingCategoryAssociableType
vmwTaggingCategoryAssociableType: urn:vim25:HostSystem
EOF

• One may replace the cn field of the category by using the Category REST APIs:
  • After creating a session and getting the session ID, you may use the APIs to list out all the categories:
    Cis Tagging Category list | vSphere Automation API
  • Get each category ID using this REST API:
    Cis Tagging Category get | vSphere Automation API
• If the "vmwTaggingCategoryAssociableType" is missing any desired attribute, proceed with adding them as mentioned below.

/opt/likewise/bin/ldapmodify -h localhost -p 389 -x -D "cn=administrator,cn=users,dc=vsphere,dc=local" -W << EOF
dn: cn=urn:vmomi:InventoryServiceCategory:########-####-####-####-e8cdc122ce8e:GLOBAL,cn=urn:vmomi:InventoryServiceScope:default-scope:GLOBAL,cn=Tagging,cn=Services,dc=vsphere,dc=local
Changetype: add
Replace: vmwTaggingCategoryAssociableType
vmwTaggingCategoryAssociableType: urn:vim25:HostSystem
vmwTaggingCategoryAssociableType: urn:vim25:VirtualMachine
EOF

Method 3:

1. Export the tag you want to work with:

/usr/bin/ldapsearch -LLL -h localhost -p 389 -b "cn=urn:vmomi:InventoryServiceCategory:########-####-####-####-d96b4bfb740f:GLOBAL,cn=urn:vmomi:InventoryServiceScope:default-scope:GLOBAL,cn=Tagging,cn=Services,dc=vsphere,dc=local " -D "cn=administrator,cn=users,dc=vsphere,dc=local" -o ldif-wrap=no -w <administrator_password> | grep -v nTSecurityDescriptor > /root/ldif.ldif

      2. Edit it and change the values to what you want.

      3. Delete the current tag:

/opt/likewise/bin/ldapdelete -r -h localhost -p 389 "cn=urn:vmomi:InventoryServiceCategory:########-####-####-####-d96b4bfb740f:GLOBAL,cn=urn:vmomi:InventoryServiceScope:default-scope:GLOBAL,cn=Tagging,cn=Services,dc=vsphere,dc=local" -D "cn=administrator,cn=users,dc=vsphere,dc=local" -w <administrator_password>

      4. Import the modified ldif:

/opt/likewise/bin/ldapmodify -a -x -h localhost -p 389 -D "cn=administrator,cn=users,dc=vsphere,dc=local" -w <administrator_password> -f /root/ldif.ldif

Note:

You can use "-W" instead "-w" (-W will prompt for password rather than requiring the password to be included in the command)

The mapping of the Associable Object type that we see on the vSphere UI to the actual associable types that is created by the backend service.

Folder = urn:vim25:Folder
Datastore = urn:vim25:Datastore
Datacenter = urn:vim25:Datacenter
Resource Pool = urn:vim25:ResourcePool
Content Library = urn:vim25:com.vmware.content.Library
Host = urn:vim25:HostSystem
Library Item = urn:vim25:com.vmware.content.library.Item
Cluster = urn:vim25:ClusterComputeResource
vApp = urn:vim25:VirtualApp
Virtual Machine = urn:vim25:VirtualMachine

Network:

urn:vim25:HostNetwork
urn:vim25:Network
urn:vim25:OpaqueNetwork

Distributed Port Group = urn:vim25:DistributedVirtualPortgroup
Datastore cluster - urn:vim25:StoragePod

Distributed Switch =
urn:vim25:VmwareDistributedVirtualSwitch
urn:vim25:DistributedVirtualSwitch