Deletion of Identity Broker from VCF Operations 9.1

Products

• VMware Cloud Foundation
• VCF Operations

Issue/Introduction

In VCF Operations 9.0, it is possible to delete VCF Identity Broker appliance from the Fleet Management > Lifecycle > Components page. However, in VCF Operations 9.1 such an option to delete the Identity Broker component is not provided.

Environment

• VCF 9.0.x (Identity broker in 9.0.x version, however, VCF Operations should be in 9.1.x version)
• VCF 9.1

Resolution

Table of contents

• Identity Broker deletion script
• When to use this script
• Prerequisites
• Script usage
  • Script parameters
• Running the script
• Sample script execution result

Identity Broker Deletion script

1. To delete the Identity Broker, use the delete_vidb.py script attached to this KB.
   1. If the Identity Broker is older than version 9.1, it is deleted from Fleet lifecycle and VCF Operations resources only; the corresponding VIDB deployment from vCenter is not deleted.
   2. If the Identity Broker is version 9.1, it is also deleted from the VCF Services Runtime.
2. This script will also clear the SSO configuration made on the Identity Broker that it is deleting.
3. The data related to Identity Broker is stored in several places. This script removes it from all of them, in order:
   
   1. VCF Operations SSO / identity provider configuration (reset).
   2. VCF Operations resource (external Identity Broker registration, followed by the Identity Broker monitoring resource).
   3. VCF Operations component manager.
   4. Fleet lifecycle.
   5. VCF Services Runtime (VSP).

Warning: This script removes the Identity Broker from multiple systems. Do not interrupt the script once it has started.

When to use this script

Use this script only as a last resort when the Identity Broker is in an unrecoverable state and must be completely removed and reinstalled.

Before you run this script:

1. Try to repair the existing Identity Broker first. If the Identity Broker is experiencing issues, investigate and resolve the root cause.
2. Do not use this script as a routine upgrade mechanism. This script is not a way to upgrade an Identity Broker by removing an older version and installing a newer one. It permanently removes the Identity Broker's SSO configuration — this is a destructive operation that cannot be undone. After running this script, you must re-configure SSO from scratch on the newly installed Identity Broker.

Run this script only when:

1. The Identity Broker is irrecoverably broken and cannot be fixed in place.
2. You need to remove all traces of the existing Identity Broker from VCF Operations, Fleet, and VCF Services Runtime before installing a fresh one.
   
   Note: If you are installing a new Identity Broker after deleting the current one in order to configure SSO, wait at least 15 minutes after the new Identity Broker is installed before attempting to configure SSO on it. IAM needs this time to recognize the newly installed Identity Broker.

Prerequisites

1. The script can be run from any system that has Python 3 installed and network access to the VCF Operations, Fleet, and VCF Services Runtime endpoints, plus SSH access (TCP port 22) to the VCF Operations node.
2. The script is self-contained and uses only the Python standard library — no additional Python packages need to be installed.
3. The sshpass command must be installed on the machine running the script. The script uses it to SSH into the VCF Operations node (as root) to remove the cached SSO entries from the database. If sshpass is not found, the script exits with an error before making any changes.
4. Gather the following values (available from VCF Operations UI -> Build -> Lifecycle -> VCF Management -> Components):
   
   1. The Identity Broker FQDN (for example, identity-broker.example.com).
   2. The Fleet LCM FQDN.
   3. The VCF Services Runtime FQDN.
   4. VCF Operations admin credentials and VCF Services Runtime credentials.
   5. The VCF Operations appliance root password (used to SSH into the VCF Operations node for the database cleanup).

Note: Use username admin for <vcf-services-runtime-username>; the password of vmware-system-user is the same as the admin password.

Warning: Prior to deletion, verify that you have a backup of any critical component data which needs to be retained.

Script usage

python3 delete_vidb.py \
    --vidb-fqdn <vidb-fqdn> \
    --fleet-fqdn <fleet-lcm-fqdn> \
    --vcf-services-runtime-fqdn <vcf-services-runtime-fqdn> \
    --vcf-services-runtime-username <vcf-services-runtime-username> \
    --vcf-operations-fqdn <vcf-operations-fqdn> \
    --vcf-operations-username <vcf-operations-username>

Replace each placeholder (such as <vidb-fqdn>) with the actual value for your environment.

Script Parameters

Parameter	Short	Required	Description
--vidb-fqdn	-vf	Yes	FQDN (host) of the Identity Broker component to be deleted.
--fleet-fqdn	-ff	Yes	Fleet LCM FQDN.
--vcf-services-runtime-fqdn	-vsrf	Yes	VCF Services Runtime FQDN.
--vcf-services-runtime-username	-vsru	Yes	VCF Services Runtime username.
--vcf-services-runtime-password	-vsrp	No	VCF Services Runtime password. Prompted in the console if not provided.
--vcf-operations-fqdn	-vof	Yes	VCF Operations FQDN.
--vcf-operations-username	-vou	Yes	VCF Operations username.
--vcf-operations-password	-vop	No	VCF Operations password. Prompted in the console if not provided.
--vcf-operations-root-password	-vorp	No	VCF Operations appliance root password, used to SSH into the VCF Operations node and remove cached SSO entries from the database. Prompted in the console if not provided.
--force-delete	-fd	No	Skip the confirmation prompt before delete.

Note: If there are multiple VCF services runtime deployments, provide the details of the one that has Identity broker you are planning to delete.

Running the script

1. Copy delete_vidb.py to a host with Python 3 and network access to the required endpoints.

2. Run the script with the required parameter
   
   python3 delete_vidb.py \
    --vidb-fqdn <vidb-fqdn> \
    --fleet-fqdn <fleet-lcm-fqdn> \
    --vcf-services-runtime-fqdn <vcf-services-runtime-fqdn> \
    --vcf-services-runtime-username <vcf-services-runtime-username> \
    --vcf-operations-fqdn <vcf-operations-fqdn> \
    --vcf-operations-username <vcf-operations-username>

3. When prompted, enter the passwords for the VCF Services Runtime user, the VCF Operations user, and the VCF Operations appliance root account. The script authenticates against both platforms and verifies root SSH access to the VCF Operations node up front, so any incorrect password is reported before any deletion is attempted.

4. Review the confirmation prompt that lists every location to be cleaned up, and enter y to proceed (or n to abort). Use --force-delete to skip this prompt for unattended runs.

5. The script then performs the cleanup and prints an informational line as each stage completes. The SSO deletion is asynchronous: the script polls every 10 seconds for up to 30 minutes for the identity provider to be removed. If the SSO configuration is not removed within 30 minutes, the script fails and asks you to manually delete the SSO configuration on the given Identity Broker and retry. As part of Step 1, after the SSO configuration is cleared, the script also SSHes into the VCF Operations node (as root) and removes the Identity Broker's cached entries from the vcopsdb database.

Note: Power off the VCF Identity Broker 9.0.x virtual machines from the vSphere Client after the script completes.

Sample script execution result

The script logs each stage and its completion, for example:

Authenticating with VCF Services Runtime (...)...
VCF Services Runtime authentication successful.
Authenticating with VCF Operations (...)...
VCF Operations authentication successful.

About to remove Identity Broker '{self.vidb_fqdn}' and its SSO configuration from all required locations.

WARNING: This removes the Identity Broker from multiple systems. Do not interrupt the script once it has started.
Proceed with cleanup? (y/n): y

=== Step 1: VCF Operations SSO and resource cleanup ===
...
[INFO] Step 1 completed: VCF Operations SSO and resource cleanup.

=== Step 2: VCF Operations component manager cleanup ===
...
[INFO] Step 2 completed: VCF Operations component manager cleanup.

=== Step 3: Fleet and VCF Services Runtime cleanup ===
...
[INFO] Step 3 completed: Fleet and VCF Services Runtime cleanup.

[INFO] Identity Broker cleanup completed successfully.