SDDC aware VMware Identity Manager root password locks frequently after manual change

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

The root password for an SDDC-aware VMware Identity Manager appliance locks frequently after it is changed manually.

This results in the following symptoms:

• Inventory synchronization fails from VMware Aria Suite Lifecycle.
• In the SDDC Manager user interface, the VMware Identity Manager component displays a status of "Disconnected".

Environment

• VMware Identity Manager 3.3.7
• SDDC Manager 5.2.x
• VMware Aria Suite Lifecycle 8.18.X

Cause

This issue occurs because SDDC Manager is not automatically updated with the new password.
As a result, SDDC Manager continuously polls VMware Identity Manager using the old, incorrect root credentials. This repeated polling with bad credentials triggers an account lockout on the VMware Identity Manager appliance.

Resolution

• Open an SSH session to the VMware Identity Manager appliance logging in as the sshuser.
• Run the following command to view recent failed login attempts:

  sudo lastb | head -n 20
  

• When prompted, enter the password for the sshuser.
• Review the output to identify the IP address and user polling the appliance.
• Review the IP address listed belongs to the SDDC Manager, this confirms that SDDC Manager is causing the lockouts.
  
• To stop the lockouts, update the password within SDDC Manager.
• Follow the standard procedure outlined in the document: SDDC Password remediation Steps
• Once the password is remediated in SDDC Manager, verify that VMware Identity Manager shows as "Active" in the SDDC Manager UI, that inventory synchronization is successful from VMware Aria Suite Lifecycle, and that the root account remains unlocked.