vCenter Service Account shows disconnected on 12/31/69 on SDDC Manager

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

Service Account showing disconnected in SDDC Manager on 12/31/69:

Environment

VMware Cloud Foundation 9.x 

Cause

Issue is cosmetic with vCenter reporting incorrect password validity. 

Resolution

This issue is fixed in VCF 9.1.2 and on VCF 5.2.5 

1. Confirm the account expiry:

• • SSH into the SDDC Manager Appliance with the vcf user and su to root 
    • Access the SDDC Manager database and run the following select query: 
      • psql -h localhost -U postgres 
      • \c operationsmanager
      • select * from passwordmanager.credential_expiry where resource_type='VCENTER';
        1. The output will be similar to this:
           Note: If output is not listed the same as shown below may need to enable "Expanded display" with command "\x". Once enabled run the select statement again. 
           

           -----------------------------------------------------------------------------------------------
           id              | <id>
           credential_id   | <cred_id>
           resource_fqdn   | <vCenterFQDN> 
           username        | <svcAccountUsername> 
           expiry_date     | 1970-01-01 01:00:20.233077

      2. Change the expiry on the Account:  

• • SSH into the vCenter with the root user and run the following command: 
    
    
    • /usr/lib/vmware-vmafd/bin/dir-cli user modify --account svcAccountUsername --password-never-expires
      
      Note: When entering the svcAccountUsername do not include the domain name (ie. @vsphere.local).

Additional Information

After modifying the password to never expire from vCenter using dir-cli, if the expiry date on the SDDC UI still reflects 1970-01-01, run the below commands to update the credential_expiry table from the database.

Note: Take a snapshot of the SDDC manager VM before you perform the update. The expiry_date value is taken as a reference from another resource type.

• psql -U postgres -h localhost


• \c operationsmanager


• update passwordmanager.credential_expiry set expiry_date='2299-01-01 01:00:20.233077' where id='<id>';  

 

Note: If the changes are not apparent in the UI (e.g., VC vSphere client, SDDC manager UI) it may be due to requiring synchronization.

• Auto inventory Sync is run daily at 0300 local server time.

• If desired you can also manually trigger the password expiry from the SDDC Manager API Explorer. 

  1. Log in to SDDC Manager UI.

  2. Navigate to Developer Center -> API Explorer -> Credentials -> POST /vi/credentials/expirations (Reference: Get Password Expiration).

  3. Under the Value for body enter the below:
     
     {
    "credentialIds": [ "" ],
    "domainName": "",
    "resourceType":"VCENTER"   
}