vCenter Discovery in ServiceNow results in Credentialless CI and missing relationships
Article ID: 438372
Updated On:
Products
Issue/Introduction
- VMware vCenter Server Appliance (VCSA) is discovered as a generic "Credentialless" CI in the cmdb_ci_computer table.
- Consequently, Discovery fails to build relationships between the vCenter, ESXi Hosts, Clusters, Virtual Machines, and Datastores.
- Software Asset Management add-on is configured and active in ServiceNow.
Environment
VMware vCenter Server
Cause
- ServiceNow Discovery fails to authenticate at the VMware API (Web Services) layer due to incorrect credential configuration
- Insufficient system-wide permissions configured at the vCenter root level.
- Can also be expected behavior as per ServiceNow KB: CI created with Credentialless discovery source in Computer table.
Resolution
Resolution will depend on the cause that has been identified as the source of the issue:
Configure VMware Credentials:
Navigate to Discovery > Credentials.
Ensure a record of type VMware Credentials exists using the format
username@domain(e.g.,<REDACTED_USER>@vsphere.local).Set the Order value to be lower than generic SSH or SNMP credentials to ensure priority.
Verify vCenter Permissions:
Log into the vSphere Client.
Navigate to the vCenter Root Object.
Assign the Read-Only role to the discovery service account.
CRITICAL: Ensure the Propagate to children checkbox is selected. Failure to propagate prevents the API from traversing the inventory tree.
Establish IP Service Affinity:
Navigate to Discovery > IP Service Affinity.
Create a new record mapping the VCSA Management IP to the VMware credential type to force the MID Server to bypass credentialless host probes.
Network Validation:
Verify that Port 443 is open between the MID Server and the VCSA.
From the MID Server, run:
Test-NetConnection <REDACTED_IP> -Port 443.
Re-run Discovery:
Clear the existing "Credentialless" CI from the
cmdb_ci_computertable.Execute Discover Now on the vCenter IP.
Additional Information
Feedback
