Updating VCSA 7.0. Pre-Update Check Results in Error - Internal error occurs during execution of update process "'vmdir:Validation' failed"

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• Unable to update the vCenter server appliance in 7.x to any further version.
• Pre-Update Checks fails.
• Error - Internal error occurs during pre-upgrade checks
• Resolution - Send upgrade log files to VMware technical support team for further assistance.

Updating through command line fails with the same error.

PatchRunner.log:
 

2021-10-11 11:04:04,972.972Z vmdir:Validation INFO vmdir Checking for VMDir legacy schema and mixed mode vCenter
2021-10-11 11:04:05,686.686Z vmdir:Validation ERROR vmware_b2b.patching.executor.hook_executor Patch hook 'vmdir:Validation' failed.
Traceback (most recent call last):
  File "/storage/core/software-update/updates/7.0.2.00100/scripts/patches/py/vmware_b2b/patching/executor/hook_executor.py", line 74, in executeHook
    executionResult = systemExtension(args)
  File "/storage/core/software-update/updates/7.0.2.00100/scripts/patches/libs/sdk/extensions.py", line 106, in __call__
    result = self.extension(*args)
  File "/storage/core/software-update/updates/7.0.2.00100/scripts/patches/libs/sdk/extensions.py", line 123, in _func
    return func(*args)
  File "/storage/core/software-update/updates/7.0.2.00100/scripts/patches/payload/components-script/vmdir/__init__.py", line 153, in validate
    old_dc_list = check_psc_version(passwordval)
  File "/storage/core/software-update/updates/7.0.2.00100/scripts/patches/payload/components-script/vmdir/__init__.py", line 113, in check_psc_version
    if obj.get_attribute(node, "vmwPlatformServicesControllerVersion").startswith(("6.5")):
  File "/usr/lib/vmware-vmdir/vmdir-tool/ldap_utils.py", line 204, in get_attribute
    return val[0]
IndexError: list index out of range

Environment

VMware vCenter Server 7.0.x

Cause

This issue occurs when there is one or more stale entries of PSC server.

Confirm the stale entries are present using the LDIF of the vCenter server. 

Get the LDIF file of the vCenter server:
/opt/likewise/bin/ldapsearch -b "dc=vsphere,dc=local" -s sub -D "cn=Administrator,cn=Users,dc=vsphere,dc=local" -W > FQDN.ldif 

You can use the  JXplorer to navigate through and validate the stale entry. 

1. Download and install JXplorer, available at JXplorer.
2. Open JXplorer and select File > Connect.
3. In the Open LDAP/DSML pane, make these configuration changes:
4. For host, enter the FQDN of your Platform Services Controller.
5. The Port should be 389 or 11711.
6. The protocol is LDAP v3.
7. Base DN will be dc=vsphere,dc=local
   
   Note: If you are using a custom vCenter Single Sign-on domain name, you have to replace vsphere and local with the name of your custom domain name. For example, if you chose vsphere.vmware.corp as your vCenter Single Sign-on domain, the value would be: dc=vsphere,dc=vmware,dc=corp
8. The Security Level will be User + Password.
9. The Security User DN will be cn=administrator,cn=users,dc=vsphere,dc=local.
10. The Security Password will be your administrator password for your vCenter Single Sign-on administrator account.
11. Expand vSphere>Domain controllers. Check for stale entries. 

 

Resolution

Run the cmsso-util unregister command - Using the cmsso command to unregister vCenter with External PSC or vCenter with Embedded PSC from Single Sign-On

Run the cmsso-util unregister command to unregister the stopped Platform Services Controller:
cmsso-util unregister --node-pnid Platform_Services_Controller_System_Name --username administrator@your_domain_name --passwd vCenter_Single_Sign_On_password

NOTE: If running the command encounters any failures, remove the entries using the jxplorer. 
Run the update again, the pre-checks should succeed.

Additional Information

Impact/Risks:
Take snapshot of the vCenter server before proceeding with the stale entry removal.