Error: Required parameter is missing: password when editing host profile in vCenter 8.0

Products

• VMware vCenter Server
• VMware Telco Cloud Platform

Issue/Introduction

Symptoms:

1. When attempting to save or copy a host profile extracted from an ESXi 7.x host in a vCenter 8.x environment, the operation fails.
   
   
2. Validation errors specifically mention: b'Bad passphrase (not enough different characters or classes)'

   

   vpxd.all
   
   ####-##-##T##:##:##.###Z info vpxd[#####] [Originator@#### sub=vmomi.soapStub[###] opID=mqin1evt-########-####-####-##:########-##] SOAP request returned HTTP failure; <<io_obj p:0x00007fd4a01516b8, h:74, <UNIX ''>, <UNIX '/var/run/en
   voy-hgw/hgw-pipe'>>, /hgw/host-#####/vpxa>, method: bookKeep; code: 500(Internal Server Error); fault: (vim.fault.ProfileUpdateFailed) {
   -->    faultCause = (vmodl.MethodFault) null,
   -->    faultMessage = <unset>,
   -->    failure = (vim.fault.ProfileUpdateFailed.UpdateFailure) [
   -->       (vim.fault.ProfileUpdateFailed.UpdateFailure) {
   -->          profilePath = (vim.profile.ProfilePropertyPath) {
   -->             profilePath = "security_SecurityProfile_SecurityConfigProfile.security_UserAccountProfile_UserAccountProfile["##########################################################"]",
   -->             policyId = "security.UserAccountProfile.PasswordPolicy",
   -->             parameterId = "password",
   -->             policyOptionId = <unset>
   -->          },
   -->          errMsg = (vmodl.LocalizableMessage) {
   -->             key = "com.vmware.vim.profile.host.UpdateError.InvalidPassword.label",
   -->             arg = (vmodl.KeyAnyValue) [
   -->                (vmodl.KeyAnyValue) {
   -->                   key = "error",
   -->                   value = "b'Bad passphrase (not enough different characters or classes)\n'"
   -->                }
   -->             ],
   -->             message = "Password validation error: b'Bad passphrase (not enough different characters or classes)\n'."
   -->          }
   -->       }
   -->    ],
   -->    warnings = <unset>
   -->    msg = "Received SOAP response fault from [<<io_obj p:0x00007fd4a01516b8, h:74, <UNIX ''>, <UNIX '/var/run/envoy-hgw/hgw-pipe'>>, /hgw/host-#####/vpxa>]: bookKeep
   --> Received SOAP response fault from [<<io_obj p:0x000000d1c55b9618, h:20, <TCP '###.#.#.# : #####'>, <TCP '###.#.#.# : ####'>>, /sdk>]: bookKeep
   --> Profile validation failed. Check the profile for errors."
   --> }

   
   
   
3. The issue is specifically reported in environments with stateless hosts relying on host profiles.
   
   

Environment

vCenter: 8.0 U3j

Telco cloud platform: 5.0.1

Cause

In the host profile extracted from a newly installed or upgraded host, the password complexity value retry=3 min=disabled,disabled,disabled,12,12 is improperly populated under the requisite section. Strict schema validation in vCenter server 8.0 fails to parse this raw string when located in the requisite section, throwing the validation failure.

Resolution

Resolution Steps:

Convert the current resolution into a strict numerical list to comply with procedural standards:

1. Open the vSphere Client and navigate to Policies and Profiles > Host Profiles.
   
   
2. Select the affected Host Profile and click Edit Settings.
   
   
3. Locate the requisite section (PAM Entry) and remove the parameter string: retry=3 min=disabled,disabled,disabled,12,12


4. Navigate to the Advanced Configuration section of the Host Profile.
   
   
5. Add the retry=3 min=disabled,disabled,disabled,12,12 parameter under Security.PasswordQualityControl
   
   
6. Save the Host Profile and verify the validation completes successfully.

Additional Information

For further details on Host Profile configurations, search the VMware by Broadcom TechDocs.

Updating the host profile with a new ESXi root password fails with the errors: "Profile validation failed: check the profile for errors" and "Required parameter is missing."