Splitting Enhanced Linked Mode (ELM)

Products

• VMware vCenter Server

Issue/Introduction

• Enhanced Linked Mode (ELM) is a feature of VMware vSphere that allows multiple vCenter Server instances to be joined together in a unified management environment, forming a single vSphere Single Sign-On (SSO) domain.
  This enables administrators to use the vSphere Client to view, search, and manage the inventories of all linked vCenter Servers from any participating node.
  
  
• Administratively, ELM provides the following benefits:
  • Unified access: Users can log in with a single account and manage resources across all linked vCenter Servers.
  • Centralized visibility: Inventories and resources such as VMs, hosts, clusters, and datastores are accessible from any node in the environment.
    
    
• All vCenter Servers in ELM are members of the same SSO domain, which ensures that the contents of the vmdir database are automatically replicated to every node. The replicated items typically include:
  • Local SSO users and groups
  • Tags and categories
  • Global permissions
    
    
• Within an ELM setup, vCenter Servers utilize a shared Security Token Service (STS) signing certificate to authenticate user sessions and service interactions. Additionally, the TRUSTED_ROOTS store is replicated across all nodes, ensuring consistent trust anchors for SSL/TLS communications within the SSO domain.
• At times, it may become necessary to break Enhanced Linked Mode, such as when removing a node from the Single Sign-On (SSO) domain.

Environment

VMware vCenter Server

Resolution

If able to, it is recommended to upgrade to vSphere 9 and perform the split after doing so following the steps outlined in TechDoc Deactivate Enhanced Link Mode from vCenter Using the cmsso-util break-elm Utililty.

• The benefits of doing this is to help avoid losing custom roles and permissions, as well as make the process easier.

===============================================================

If unable to upgrade to vSphere 9 at this time follow the steps below.

 

Prerequisites:

• Offline snapshots off all nodes in linked mode must be taken to allow for single point in time roll back. See "Snapshot Best practices for vCenter Server Virtual Machines" and "VMware vCenter in Enhanced Linked Mode pre-changes snapshot (online or offline) best practice" for more information.
• If vCenter HA is in use on any of the nodes it must be destroyed before attempting this process. See "Remove a vCenter HA Configuration" for more information.

A vCenter can be removed from Enhanced Linked Mode by repointing its node from the shared SSO domain to its own standalone domain. This process breaks the link and isolates the vCenter, allowing it to operate independently.

1. Shut down the node being repointed (for example, vCenter C)
2. With the node to be moved powered off, the next step is to decommission it from the existing SSO domain. For example, to decommission Node C, log in to either Node A or Node B and execute the following command:
   
         cmsso-util unregister --node-pnid Node_C_FQDN --username Node_B_sso_administrator@sso_domain.com --passwd 'Node_B_sso_administrator_password'
   
               Example:
   

         cmsso-util unregister --node-pnid nodeC.example.com --username [e-mail] --passwd '#####'

   This command unregisters Node C from the SSO domain. After execution, all vCenter services on the node where the command was run will automatically restart. References to Node C are removed from that vCenter, and the changes replicate to all remaining SSO partners, maintaining domain consistency.
   
   Note: You can also run the above command without the --passwd flag and you will be prompted to enter the password. 
   
   
3. Power on vCenter C to begin the domain repointing process.
4. Using the following command on vCenter C will repoint the node to its own domain/SSO. The value for "destination_PSC_domain" can be any valid domain name; however, using "vsphere.local" is recommended for consistency and best practice:
   
        cmsso-util domain-repoint -m execute --src-emb-admin Administrator --dest-domain-name destination_PSC_domain

   Example:

   cmsso-util domain-repoint -m execute --src-emb-admin Administrator --dest-domain-name vsphere.local

5. If the environment consists of two nodes (Node A and Node B), the cmsso-util unregister command must be executed on the second node (Node B) to release the partner information associated with the node
   

   Note: The following information/configuration is lost on the vCenter following a domain repoint and may need to be re-created:

   • • Custom local SSO user accounts
     • Global Permissions
     • Rejoin vCenter Server to Active Directory Domain, if needed
     • Re-register external plugins and solutions
6. Follow the steps to remove stale global permissions of previous domain: Remove stale global permissions of previous domain after domain repointing

•  

Additional Information

• vCenter Enhanced Linked Mode
• Join an existing vCenter Single Sign-On domain
• Part 3: Splitting Enhanced Linked Mode (ELM)
• Note: If there are issues with running the unregister command where host id can't be found, running a repoint for each vcenter, will get the vcenters set into their own sso domains and remove the old sso domain from all vCenters.