Failed to start Horizon Service on VMware Identity Manager Node, the Service remains in an "Inactive" State

Products

• VMware Aria Suite

Issue/Introduction

Unable to start Service "Horizon" in VMware Identity Manager Cluster node, the Service remains in an "Inactive" State

Environment

VMware Identity Manager 3.3.X

 

 

Cause

The issue is related to the truststore on the affected node, which may either be missing or corrupted. This can be confirmed by reviewing the following logs:

Evidence from Logs:
1. Catalina.log
    Location: /opt/vmware/horizon/workspace/logs/catalina.log
    Error Observed:
    
        2024-11-08 05:14:57,315 INFO: Initializing ProtocolHandler ["https-jsse-nio2-0.0.0.0-6443"] 2024-11-08 05:14:57,637 SEVERE: Failed to initialize connector [Connector[org.apache.coyote.http11.Http11Nio2Protocol-6443]] 2024-    11-08 05:14:57,639 INFO: Initializing ProtocolHandler ["http-nio2-0.0.0.0-8080"] 2024-11-08 05:14:57,645 INFO: Initializing ProtocolHandler ["https-jsse-nio2-8443"] 2024-11-08 05:14:57,773 SEVERE: Failed to initialize          connector [Connector[org.apache.coyote.http11.Http11Nio2Protocol-8443]] 2024-11-08                        05:14:57,774 INFO: Initializing ProtocolHandler ["https-jsse-nio2-7443"] 2024-11-08 05:14:57,819 SEVERE: Failed to      initialize connector [Connector[org.apache.coyote.http11.Http11Nio2Protocol-7443]]  
        
2. Workspace.log
    Location: /opt/vmware/horizon/workspace/logs/workspace.log
    Error Observed:
        
    at org.apache.tomcat.util.net.AbstractJsseEndpoint.createSSLContext(AbstractJsseEndpoint.java:106)        ... 21 more    Caused by: java.security.KeyStoreException: problem accessing trust store        at                      sun.security.ssl.TrustManagerFactoryImpl.engineInit(TrustManagerFactoryImpl.java:73)        at javax.net.ssl.TrustManagerFactory.init(TrustManagerFactory.java:250)        at com.vmware.horizon.tomcat.CustomTrustManager.        <init>(CustomTrustManager.java:39)        ... 28 more 
        
This points to an issue accessing the truststore, either due to corruption or a missing file.

Resolution

The trust store is located at /usr/local/horizon/conf/idm-cacerts.

This trust issue is preventing the Horizon service from functioning properly, which in turn is affecting the startup of OpenSearch.

Follow these steps to restore the service:

    1. Retrieve the latest snapshot of the affected node.
    2. Stop the Horizon service:
          service horizon-workspace stop
    3. Copy the idm-cert file from any functioning node within the vIDM cluster.
    4. Restart the Horizon service:
         service horizon-workspace start