VCF Operations 9.0.2 - Component Configuration for vCenter is failed

Products

• VCF Operations

Issue/Introduction

• An external VCF Identity Broker is in use, not embedded
• It is not possible to use SSO to log in to vCenter
• On the VCF Operations UI page > Fleet Management > Identity & Access > VCF Instances > VCF Instance > Component Configuration > vcenter_fqdn > Status Failed is displayed
• On that Component Configuration UI page - clicking the REFRESH button, does not resolve the status Failed
• Attempting to deregister the component, and register the component again does not resolve the status Failed
• This UI error is observed on register attempt after deregister action:
  • Error occurred while configuring the component for SSO. Check Support Logs under Control Panel for more details
• In the VCF Operations log logs/vcops-bridge.log the below is observed:
  • YYYY-MM-DDThh:mm:ss.sssZ INFO  vcfops-bridge #### [ops@#### threadId="####" threadName="DistTaskAuthSourceTaskTimer"] [com.vmware.vcops.bridge.server.vidb.persistence.VidbAuthSourceService.updateAut
hSource] - Updating the Auth source configuration AuthSourceConfig{vidbResourceId='####-####-####-####-####', clientId='null', vidbHostname='vidb_fqdn', vcfInstan
ceId='####-####-####-####-####', vcfComponentId=####-####-####-####-####, componentHostname='vcenter_fqdn', errorMessage='Unable to create auth source for
 VCENTER', componentType=VCENTER, status=FAILED, createdAt=####, lastActiveTime=####, editable=true, updatedAt=####}
• The command below run on vCenter returns this error:
  • curl 'https://<vidb_fqdn>/acs/t/CUSTOMER/.well-known/openid-configuration' -k

curl: (56) CONNECT tunnel failed, response 503

timed out waiting for input: auto-logout

Environment

VCF 9.0.2

Cause

There is a network connectivity issue (potentially caused by a proxy) between the vCenter and VIDB, that is preventing the successful registration of the vCenter with the VCF Identity Broker.

Resolution

Resolve the network connectivity issue by working through the steps below:

1. Review https://ports.broadcom.com to ensure that the network traffic that needs to be able to traverse between vCenter and VCF Identity Broker can traverse:

https://ports.broadcom.com/view/?vcfVersion=9.0+vCenter

https://ports.broadcom.com/view/?vcfVersion=9.0+Identity-Broker

2. Compare and contrast the networking/firewall configuration that applies to traffic between the problematic vCenter and VCF Identity Broker and a successfully registered vCenter and VCF Identity Broker.

3. Use this article for testing port status.