vCenter Server root account showing disconnected in VCF Operations Manager UI

Products

• VMware SDDC Manager / VCF Installer
• VCF Operations

Issue/Introduction

• When viewing Fleet Manager > Password > VCF Management within VMware Cloud Foundation (VCF) Operations Appliance, the root account for the vCenter server (VCSA) appliance displays a status of Disconnected
• Alert in a VCSA after resetting a root password directly from the vCenter: "[1] account(s) has been disconnected. Visit Password Management page to take action."
• Adding the VCSA to linked groups in the VCF Operations Appliance displays the error when the credentials are expired :
  Unable to connect to the vcenter instance as the vcenter credentials are missing or invalid.

Environment

VMware Cloud Foundation Operations 9.x
vCenter Server 9.x

Cause

This issue occurs when the root password for the VCSA has expired.

Resolution

Proceed to reset the expired root password on the VCSA and then remediate the password within the VCF Operations Manager UI, using the following steps : 

1. Take a snapshot of the VCSA.
2. Retrieve the VCSA old root password from the SDDC manager UI:
   1. Navigate to the Developer Center >Credentials >Get (Retrieve a list of credentials)
   2. Enter a value VCENTER in resourceType and EXECUTE
3. Reset the vCenter's root password with its old password:
   
   1. SSH into the vCenter with root user using the new password
   2. Clear the password history with the following command:
          cat /dev/null > /etc/security/opasswd
   3. Reset the root vCenter's root password with the old password:
        passwd root 
4. SSH into the SDDC Manager with vcf user and elevate to root using the su command
5. Run the following command to get password failed workflow IDs:
   psql -h localhost -U postgres -d operationsmanager -c "select workflow_id, operation_type, transaction_status from passwordmanager.password_operations where transaction_status='FAILED' OR transaction_status='PREVALIDATION_FAILED';"
   Note:
   If there are some IDs, proceed to step 6.
   Else move to a step 7.
6. Delete the failed workflow ID from the SDDC Manager by navigating to the Developer Center >Credentials >DELETE (cancel a failed credential task by its ID) and delete them by entering each ID, then EXECUTE.
7. From the VCF Operations Appliance, navigate to Fleet Management >Passwords >VCF instances >vCenter server and remediate the root password.

Additional Information

Since the system performs password validation checks periodically, it may take 1 to 24 hours for the account status to visibly update to Active (green) in the UI after a successful remediation.