Inventory sync failure with error LCMVIDMIMPORT0018 for VIDM

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Getting an error when trying to trigger inventory sync for identity manager from lifecycle manager.

Error Code: LCMVIDMIMPORT0018

   Unable to verify SSH user's password. Ensure the password is not already expired and retry after providing valid credentials.

   Cannot execute ssh commands. Exception encountered : Session.connect: java.security.spec.InvalidKeySpecException: key spec not recognized

 

The /var/log/vrlcm/vmware_vrlcm.log  file shows:

The above error info all over in it:

2025-09-08T20:01:03.292Z INFO vrlcm[1257] [http-nio-8080-exec-2] [c.v.v.l.r.c.RequestController] -- Retry error cause data : [ { "messageId" : "LCMVIDMIMPORT0018", "message" : "Unable to verify SSH user's password. YXYXYXYX the password YXYXYXYX already expired and retry after providing valid credentials.", "eventId"............, "exceptionMessage" : "Cannot execute ssh commands. Exception encountered : Session.connect: java.security.spec.InvalidKeySpecException: key spec not recognized"

 

It shows the error messages in the log file:

Sep 08 21:32:55 <FQDN of IDM node> sshd[12690]: error: Received disconnect from <LCM-IP> port Deprecated option RhostsRSAAuthentication

Sep 08 21:32:55  <FQDN of IDM node> sshd[12690]: error: Received disconnect from <LCM-IP> port 60324:3:java.security.spec.InvalidKeySpecException: key spec not recognized [preauth]

Sep 08 21:32:55  <FQDN of IDM node> sshd[12690]: Disconnected from <LCM-IP> port 60324 [preauth]

Environment

VMware identity Manager 3.3.x
Aria Suite Lifecycle 8.x

Cause

• SSH Mismatch: Aria Suite Lifecycle and the vIDM appliance cannot negotiate a secure SSH connection because the supported Ciphers, MACs, or Key Exchange (Kex) algorithms in /etc/ssh/sshd_config do not match between the two appliances.
• Stale Database Records: Following a datacenter migration or Re-IP, the vIDM ServiceInstance PostgreSQL table may contain duplicate entries for the old and new IP addresses, causing LCM to attempt connections to unreachable old IPs.
• Expired Credentials: The sshuser password on the vIDM appliance has expired or is locked.

Resolution

Step 1: Verify SSH Credentials

Confirm that the sshuser password is active and not locked on all vIDM nodes:

1. Log in to the vIDM appliance via console or SSH as root.
2. Run the following commands to check the account status:

   pam_tally2 --user=sshuser
   chage -l sshuser

3. If the account is locked or expired, reset it following Inventory Sync Failure for VIDM with Error Code: LCMVIDMIMPORT0018

Step 2: Align SSH Cryptographic Settings

Ensure that Aria Suite Lifecycle and all vIDM nodes support the same cryptographic algorithms:

1. Open /etc/ssh/sshd_config on the Aria Suite Lifecycle appliance and each vIDM node.
2. Locate the lines beginning with Ciphers, MACs, and KexAlgorithms.
3. Ensure these lines are identical across all appliances.

Step 3: Clear Stale Inventory Metadata (Post-Migration Only)

If the issue persists after a Re-IP or migration:

1. Stop the workspace service on the vIDM primary node:

   /etc/init.d/horizon-workspace stop

2. Connect to the local PostgreSQL database:

   /opt/vmware/vpostgres/current/bin/psql -U postgres -d saas

3. Identify and remove stale IP entries from the ServiceInstance table:

   SELECT * FROM "ServiceInstance";-- Delete rows containing the old/incorrect IP addressesDELETE FROM "ServiceInstance" WHERE "dataCenterId" = '####';

4. Restart services and retry the Inventory Sync in the Aria Suite Lifecycle UI.

If the deprecated SSH cryptographic settings were not removed from VIDM Appliance, that was recommend from Aria Suite Lifecycle 8.14 and later versions, follow the procedures explained in KB to Remove the deprecated SSH cryptographic settings from VIDM Appliance.