AD Sync Fails with 'Connector Not Activated' in VMware Identity Manager

Products

• VCF Operations

Issue/Introduction

• The error "Connector is not Activated" appears when attempting to modify safeguard thresholds or manually initiate a directory sync.
• Initial sync failures may be accompanied by alerts regarding safeguard limit breaches (e.g., changes exceeding the 5% threshold).

Environment

VMware Identity Manager 3.3.x

Cause

This issue typically occurs when the trust relationship between the vIDM appliance and its embedded connector is disrupted. While a safeguard limit breach (such as a more than the default 5% change in user objects) triggers the initial sync failure, the underlying "Connector not activated" error prevents administrators from adjusting thresholds to permit the sync.

Resolution

Take the snapshot of all the nodes.

Step 1: Validate Cluster Services and Database Locks 

1. Log into each vIDM node via SSH as the root user.

2. Verify that the core workspace application and directory indexing services are active and running:

   service horizon-workspace status
   /etc/init.d/opensearch status
   

3. Inspect the application logs to ensure schema migrations are not stalled by database locks:

   cat /opt/vmware/horizon/workspace/logs/catalina.log | grep -i "liquibase"
   

   • Note: If active Liquibase database lock exceptions are present in the log outputs, follow the remediation procedures outlined in KB 315176 to force-release the schema locks before proceeding.
     
     

Step 2: Isolate the Faulty Connector

1. Log into the vIDM Admin Console as a local administrator using the System Domain.

2. Navigate to Identity & Access Management -> Directories.

3. Select your target directory, click Sync Settings, and navigate to the sync connector parameters.

4. From the connector dropdown menu, systematically select each individual connector instance and attempt to save the configuration.

5. If the administration console throws an initialization or communication error upon saving a specific node, isolate that connector as the faulty instance and proceed to the step below.

Step 3: Reset the Connector Bindings via the UI

If an error is encountered when modifying or saving directory profiles, clear and re-establish the cluster runtime mappings for the affected node:

1. Navigate to Identity & Access Management ->Directories.

2. Click on the Setup tab located on the far right side of the directory dashboard configuration plane.

3. Select your assigned Identity Provider (IdP) to view its active configurations.

4. Locate the Connectors grid section displaying your cluster components.

5. Uncheck the box next to the faulty connector instance to decouple it from active authentication policies.

6. Scroll to the bottom of the workspace pane and click Save.

7. Once the page refreshes and updates the database tracking records, return to the exact same Connectors listing on that page.

8. Check the box next to the target connector instance to re-introduce it back into the available pool.

9. Click Save to commit the fresh cluster state synchronization.

Additional Information

Steps to re-create embedded connector in vIDM