VIDB incorrectly identified as "Embedded" after VCF 9.1 Upgrade
search cancel

VIDB incorrectly identified as "Embedded" after VCF 9.1 Upgrade

book

Article ID: 444003

calendar_today

Updated On:

Products

VCF Operations

Issue/Introduction

  • After upgrading VMware Cloud Foundation (VCF) from version 9.0.2 to 9.1, the VMware Identity Broker (VIDB) may incorrectly display its deployment type as "EMBEDDED" within the VCF Operations UI. This incorrect status prevents administrators from configuring or registering an external VIDB appliance.
  • VIDB deployment mode in VCF Operations > Manage > Identity & Access incorrectly displays as "Embedded," even when deployed as an external appliance.
  • The "Choose deployment mode" task may appear stuck "In Progress."
  • API queries to GET /suite-api/api/fleet-management/iam/vidbs return the deployment type as EMBEDDED for the management domain (To execute this Public API query refer to KB Due Date passed or unable to update license usage in VCF Operations 9.0 due to License Usage file generation failure ).
  • ManagementAdapter logs in VCF Operations contain an error indicating the identity broker is incorrectly identified as Embedded and is unavailable.

    vcops/log/adapters/ManagementAdapter/ManagementAdapter_97.log

    YYYY-MM-DD:T:HH:MM:SS ERROR ManagementAdapter ##### [ops@#### threadId="####" threadName="Collector worker thread ####" instanceId="##"] [(##) com.vmware.adapter.management.components.iam.client.monitor.LdapDomainsSyncer.sync] - Failed to check and update LDAP domains for IDP EmbeddedIdp_#### in vIDB ####.local com.vmware.ops.api.client.exceptions.ServerException: Service "identity broker" is not available. Try again in 5 minutes. at com.vmware.ops.api.client.internal.ResponseHandlerImpl.handleResponse(ResponseHandlerImpl.java:105)

Environment

  • VMware Cloud Foundation (VCF) 9.1
  • VCF Operations 9.1

Cause

This issue is caused by stale metadata remaining in the VCF Operations database and the vCenter inventory from the legacy 9.0.2 environment. During the upgrade to VCF 9.1, which introduces unified VCF Management Services, the presence of these legacy artifacts causes VCF Operations to misidentify the existing VIDB registration as an embedded instance rather than a migrated external appliance. This leads to authentication failures due to mismatched client credentials.

Resolution

To resolve this issue, the stale embedded registration must be purged from the VCF Operations database using the cleanup script provided by Broadcom Engineering.

  1. Snapshot the VCF Operations primary node. Reference KB Snapshot Creation in VMware Aria Operations.
  2. Confirm the external VIDB 9.1 appliance is powered on and accessible
  3. Run the cleanup script reset_idb_vcf91_sso_for_vcf_operations.ps1. to delete the stale "Embedded" registration. This clears the status and allows VCF Operations to recognize the external VIDB correctly.
  4. In the VCF Operations UI, Navigate to Lifecycle > Build > Components , Verify that the Identity Broker displays the correct external FQDN and is ready for SSO configuration.

Additional Information

KB 441333: Scripted components cleanup from VCF Operations 9.1
KB 441285: VCF Identity Broker upgrade failure from VCF 9.0.x to 9.1

Powered by Wolken Software