IDM Connector joining to a Domain may fail if residing on an ESXi Host which is not Domain joined and NTP is not configured
search cancel

IDM Connector joining to a Domain may fail if residing on an ESXi Host which is not Domain joined and NTP is not configured

book

Article ID: 325468

calendar_today

Updated On:

Products

VMware

Issue/Introduction

Creating an AD/IWA Directory will fail.
When creating an AD/IWA Directory the connector will automatically attempt to join the Domain.
Creating an AD/LDAP Directory may succeed because the connector joining the Domain is not mandatory.
All other features of IDM function as normal.
There have been no recent environmential recorded issues.
IDM Appliances are in good health.
All is ok with the Appliance(s) in vCenter
Recently there may have been an ESXi Host added to the ESXi Cluster.

Symptoms:
Attempting to create an AD/IWA Directory in IDM fails.
Joining the IDM connector to the Domain also fails.


Error when creating IWA Directory.png

Error when joining domain.png

Attempting to create an AD/LDAP Directory may succeed.

Environment

VMware Identity Manager 3.3.x

Cause

VMware Identity Manager was recently migrated to a new ESXi Host that is not Domain joined and/or does not have NTP configured.
IDM on current Host.png

As seen above the symptoms show that an AD/IWA Directory fails to create and the connector cannot join the Domain.
Via SSH to the IDM Appliance go to /opt/vmware/horizon/workspace/logs.
The connetcor.log shows the following error:


Error in Connector.log.png

In the horizon.log the following can be seen:

Error from horizon.log.png

Running /opt/likewise/bin/domainjoin-cli query shows the Appliance is not joined to the domain:

Appliance not domain joined.png

The system.journal file for the Appliance can be located in /var/log/<latest system file>
The file can be viewed by running -  journalctl --no-pager --file system.journal


system.journal location.png

The system.journal file shows issues with time skew:

Error messages from system.journal file.png

Resolution

To resolve this issue the IDM Appliance should be migrated to another ESXi Host in the Cluster that is Domain joined OR has Domain Access and has NTP configured.
Time across all ESXi Hosts in the cluster should be the same.


Appliance migrated to different domain joined host with NTP.png

Time on domain joined host with NTP.png

Creation of AD/IWA Directory succeeds:

Creating an AD-IWA Directory.png

Creating AD-IWA succeeds.png

SSH shows the Appliance is Domain joined:

Appliance shows as domain joined via ssh.png

Appliance shows as Domain joined in the system.journal file:

system.journal shows domain joined.png

Connector is joined to the Domain:

Applinace Domain Joined.png