Stale VIDB component prevents VCF SSO configuration

Products

• VCF Operations

Issue/Introduction

• Prior to the upgrade, VIDB 9.0 was removed from Fleet Management. Following the upgrade, VIDB 9.1 was successfully redeployed. However, an error is now occurring during VCF SSO configuration.
• When attempting to configure VCF SSO in the VCF Operations UI under Manage → Fleet Management → Identity & Access → VCF SSO Overview → Configure VCF SSO → Choose Deployment Mode → Select Instance(Recommended) , the following issues occur:
  • The Choose Deployment Mode screen shows no compatible VCF instances.
  • The following error message shows: An identity broker instance is not available for configuring Single Sign-On. If the identity broker in instance mode has not been deployed, navigate to the Lifecycle page to initiate its deployment. In cases where the identity broker has been set up in embedded mode within the VCF Instance, either reset the configuration or migrate from embedded mode to an instance.
• VIDB 9.1 shows under Build → Lifecycle → VCF Management → Components

Environment

• VCF Operations 9.1
• VIDB 9.0
• VIDB 9.1

Cause

Sometimes when the VIDB component is re-deployed without properly cleaning up the existing VIDB records, the tenant is not created as part of VIDB component registration. Because the tenant is not created, VCF Operations is unable to communicate with the external VIDB. In this situation the following error is visible in the adapter logs:

com.vmware.adapter.management.components.iam.exception.HttpResponseStatusException: API call https://<external-vidb-fqdn>/acs/t/CUSTOMER/token failed with status 401 and error {"error":"invalid_client","error_description":"Client is not authorized to perform this operation."}
        at com.vmware.adapter.management.components.iam.client.ApiInvoker.invoke(ApiInvoker.java:87)
        at com.vmware.adapter.management.components.iam.client.ApiInvoker.invoke(ApiInvoker.java:50)
        at com.vmware.adapter.management.components.iam.client.token.ExternalVidbTokenClient.getTenantAdminToken(ExternalVidbTokenClient.java:101)
        at com.vmware.adapter.management.components.iam.client.ApiClientProvider.getApiClient(ApiClientProvider.java:130)

Resolution

Options: 

Flag	Required	Description
--force	No	Bypass the existing-DB-rows safety check ( See ** ⚠️ --force Note below)
--help, -h	No	Show help
--ops-fqdn	Yes	VCF Operations platform FQDN
--user	No	VCF Operations admin username (default: admin)
--vidb-fqdn	Yes	External VIDB hostname to delete and re-register

 

Notes Must be run directly on the VCF Ops appliance VM as root. Runs all discovery/checks automatically, then pauses once with a full list of every mutation it's about to run for a single y/n confirmation. If /tmp/vidb-component.json already has a cached component for this exact Identity Broke hostname, the delete phase is skipped and the script goes straight to re-registration (resume after a prior run's delete phase already completed). That same file is also used as the create-component request body (pre-populated in place) — deleted on success, left behind on /tmp for manual retry if the recreate fails. Step 4 checks kv_vidb_sso_domain, kv_vidb_auth_sources, kv_vidb_identity_providers, kv_vidb_client_apps for existing rows tied to this Identity Broker's vidb_resource_id. If any are found, the script will not proceed and in that case reach out to Broadcom support refer to Contact Broadcom Support.  **⚠️ --force Do not pass --force . It exists to bypass a safety check that found real, pre-existing data in the tables above for this Identity Broker — that data usually indicates something about the Identity Broker's history (a prior partial migration, a stale SSO config, an in-progress cleanup) that isn't visible from this script alone.

 

Running the script

1. Copy reregister_vidb_component.sh to VCF Operations cluster node.

2. Run the script with the required parameter : 

   ./reregister_vidb_component.sh --vidb-fqdn <VIDB_FQDN> --ops-fqdn <OPS_FQDN> [OPTIONS]

   Example:

   ./reregister_vidb_component.sh \
    --vidb-fqdn <VIDB_FQDN> \
    --ops-fqdn <OPS_FQDN>

3. Wait 15 minutes for the VCF IAM config sync mechanism to detect the re-registered external VIDB. Should now be able to configure SSO.