vCenter domain-repoint failure due to identical SSO and Active Directory domain names (VMware vCenter Server)

Products

• VMware vCenter Server

Issue/Introduction

During a cmsso-util domain-repoint process, the task fails during the "Registering Infra services" or "Starting all services" phase.

Specific Errors:

• UI/CLI Error: Registering Infra services ...Failed

/var/log/vmware/vmon/vmon.log: AttributeError: 'NoneType' object has no attribute 'serviceId'

/var/log/vmware/vpxd-svcs/vpxd-svcs.log: Shows solution users attempting to authenticate with the old domain (e.g., Domain: old-domain.local).
  
  
• Local SSO domain matches Active Directory domain name
  
  
• During a domain-repoint process, it fails at "Starting all services"
  
  
• All Repoint configuration settings are correct; proceed? [Y|y|N|n]: y
  
  Starting License export ... Done
  Starting Tagging Data export ... Done
  Starting Authz Data export ... Done
  Export Service Data ... Done
  Uninstalling Platform Controller Services ... Done
  Stopping all services ... Done
  Updating registry settings ... Done
  Re-installing Platform Controller Services ... Done
  Registering Infra services ... Done
  Updating Service configurations ... Done
  Starting License import ... Done
  Starting Tagging Data import ... Done
  Starting Authz Data import ... Done
  Applying target domain CEIP participation preference ... Done
  Starting all services ... Failed

Environment

• vCenter 7.x
• vCenter 8.x
• vCenter 9.x

Cause

This is by design. If the SSO domain name is identical to the Active Directory (AD) or LDAP domain name, vCenter cannot distinguish between the local and external identity authorities, leading to authentication and service start failures (Split-Brain Identity)

 

Understanding vSphere Domains and Domain Names - Provide the  domain a unique name. To prevent authentication conflicts, use a name that is not used by OpenLDAP, Microsoft Active Directory, and other directory services

Resolution

This is by design, since the SSO domain name and AD domain must be unique. 

 

The supported resolution is to redeploy the vCenter Server with a unique SSO domain (e.g., the default vsphere.local).

 

1. To check local SSO domain name from Appliance:
   /usr/lib/vmware-vmafd/bin/vmafd-cli get-domain-name --server-name localhost
   
   Example:example.com
   
   
2. To check hostname:
   hostname -f
   
   Example:vcenter.example.com

Additional Information

For more information refer - Understanding vSphere Domains and Domain Names