The vCenter upgrade failed in Stage 2: "content-library-firstboot.py and vdcsvc firstboot failed with the error: com.vmware.Content.Registry.Admin - already exists."
search cancel

The vCenter upgrade failed in Stage 2: "content-library-firstboot.py and vdcsvc firstboot failed with the error: com.vmware.Content.Registry.Admin - already exists."

book

Article ID: 392535

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

There was a broken role entry for the content library.
During the vCenter upgrade, we see an error:

Encountered an internal error. Traceback (most recent call last): File "/usr/lib/vmware-content-library/firstboot/content-library-firstboot.py", line 177, in Main vdc_fb.register_cis() File"/usr/lib/vmware-content-library/firstboot/content-library-firstboot.py", line 86, in register_cis self ._ reg_info.registerAll(self.get_soluser_id(), self.get_soluser_ownerld()) File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 387, in registerAll self.registerUserAndService(user_name, user_id, service, service_id=service_id) File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 422, in registerUserAndService create_sso_groups(service_spec) File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 623, in create_sso_groups authz_patch.assign_groups_to_roles(service_spec['group-role']) File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 590, in assign_groups_to_roles self.authz_client.set_permission( File "/usr/lib/vmware/site-packages/cis/cisreglib.py", line 748, in set_permission ac = self.create_access_control(principal, rolenames, File "/usr/lib/vmware/site-packages/cis/cisreglib.py", line 728, in create_access_control role_ids.append(role_objs_dict[rolename]) KeyError: 'com.vmware.Content.Registry.Admin'
 

Environment

 VMware vCenter 7.0
 VMware vCenter 8.0x

 

Cause

 

           ELM Mode: The vCenter was part of ELM mode and not disjoined properly.
 

Duplicate Role Conflict:

The vCenter upgrade process attempts to create the com.vmware.Content.Registry.Admin role, but it already exists in the vSphere environment, leading to a conflict.

This can happen if the role was manually created or retained from a previous vCenter version.
 

Residual Role from an Older vCenter Version:

If the vCenter was previously upgraded from an older version (e.g., 6.x to 7.x or 8.x), some roles may not have been properly cleaned up, causing duplication.
 

Inconsistent vCenter Database Entries:

The vCenter database may contain stale or duplicate role entries due to incomplete role migrations.

The upgrade script detects this and fails when it tries to create the role again.
 

Permissions Assigned to the Role:

If the com.vmware.Content.Registry.Admin role is assigned to users, groups, or objects, the upgrade might fail when attempting to modify or replace it.



/var/log/firstboot/content-library-firstboot.py_###_stderr.log
 

Traceback (most recent call last) :

File "/usr/lib/vmware-content-library/firstboot/content-library-firstboot.py", line 177, in Mainvdc_fb.register_cis ()

File "/usr/lib/vmware-content-library/firstboot/content-library-firstboot.py", line 86, in register_cisself. reg_info.registerAll(self.get_soluser_id(), self.get_soluser_ownerId () )

File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 387, in registerAllself.registerUserAndService(user_name, user_id, service, service_id=service_id)

File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 422, in registerUserAndServicecreate_sso_groups (service_spec)

File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 623, in create_sso_groupsauthz_patch.assign_groups_to_roles (service_spec['group-role'])

File "/usr/lib/vmware-content-library/install_lib/cis_register.py", line 590, in assign_groups_to_rolesself.authz_client.set_permission (

File "/usr/lib/vmware/site-packages/cis/cisreglib.py", line 748, in set_permissionac = self.create_access_control (principal, rolenames,

File "/usr/lib/vmware/site-packages/cis/cisreglib.py", line 728, in create_access_controlrole_ids.append (role_objs_dict [rolename])KeyError: 'com. vmware. Content.Registry.Admin'

YYYY-MM-DDTHH:MM:SS.139Z VdcSvc firstboot failed. Return code is 1


 /var/log/firstboot/content-library-firstboot.py_###_stdout.log
 

YYYY-MM-DDTHH:MM:SS.427Z  Getting value for install-parameter: vmdir.password

YYYY-MM-DDTHH:MM:SS.428Z  Getting value for install-parameter: sca.hostid

YYYY-MM-DDTHH:MM:SS.431Z  Getting value for install-parameter: vmdir.domain-dn

YYYY-MM-DDTHH:MM:SS.431Z  Initiating new cloudvm_sso_cm_register operation

YYYY-MM-DDTHH:MM:SS.500Z  Getting value for install-parameter: vmdir.ldu-guid

YYYY-MM-DDTHH:MM:SS.521Z  Found 1 matching service. ID is cb24025a-###-###-###-5bc8ace642db

YYYY-MM-DDTHH:MM:SS.081Z  Getting value for install-parameter: vmdir.ldu-guid

YYYY-MM-DDTHH:MM:SS.104Z  Authz url https://vc-fqdn:443/invsvc/vmomi/sdk

YYYY-MM-DDTHH:MM:SS.105Z  Setting solution user permissions.

YYYY-MM-DDTHH:MM:SS.261Z  Load privilege definitions on to Authz.

YYYY-MM-DDTHH:MM:SS.525Z  Load role definitions on to Authz.

YYYY-MM-DDTHH:MM:SS.531Z  Role id 0, name com.vmware.Content.Admin - already exists

YYYY-MM-DDTHH:MM:SS.538Z  Role id 1006, name com.vmware.Content.Registry.Admin - already exists


Resolution


Note: Please take vCenter offline snapshot and backup before implement any changes.
 
Below are the suggested solutions:

1. Ensure Correct Role Exists in SSO

The role 'com.vmware.Content.Registry.Admin' may be missing or incorrectly configured in the vCenter SSO. You can try to manually add or re-register the role.

To check the role in vCenter SSO:

  • Log in to the vSphere Web Client or vSphere Client.
  • Navigate to the Single Sign-On section under Administration.
  • Go to Roles and check if 'com.vmware.Content.Registry.Admin' exists.

If the role is missing, try creating it manually or look for a way to restore the role from a backup if the upgrade failed earlier.


2. Reset the Content Library Configuration

Sometimes, the content library service might have encountered an issue during the upgrade that leaves it in an incomplete state. You can try to reset it.

Steps to reset the content library:

  • Log into the vCenter server via SSH (use root or an administrator account).
  • Navigate to the Content Library configuration folder:
    /usr/lib/vmware-content-library
  • Look for any configuration files or logs that indicate the failure point.
  • You may need to manually reconfigure the content library or uninstall and reinstall it if there's a corruption.



3. Modify or add the missing configurations with JXplorer.

If the issue persists and launch the JXplorer and follow the below steps to modify the content-library registry role manually:

  • Expand 'vsphere' -> Expand 'services' -> Expand 'vmwAuthz' -> Expand 'RoleModel'.
  • Select model ID -> right side look for "vmwAuthzRoleDescription" validate role.
  • Select HTML View -> replace "content Library Registry administrator (sample) to "com.vmware.Content.Registry.Admin".
  • Restart the vCenter services and try for vCenter upgrade.
  • You should be able to complete the vCenter upgrade.

Additional Information

How to export VMDir information from vCenter Server Appliance using the JXplorer
https://knowledge.broadcom.com/external/article/326305/how-to-export-vmdir-information-from-vce.html
 

Powered by Wolken Software