Repointing vCenter Server to a New SSO Domain

Products

• VMware vCenter Server 8.0

Issue/Introduction

How to repoint a vCenter Server Appliance (VCSA) to a new Single Sign-On (SSO) domain. 

Environment

VMware vCenter Server 7.0.x
VMware vCenter Server 8.0.x
VMware vCenter Server 9.0.x
Warning: Cross-domain repointing is not supported in VMware Cloud Foundation (VCF) environments and may break SDDC Manager functionality.

 

Cause

In environments requiring SSO domain consolidation, domain renaming, or resolving issues where vCenter SSO and Active Directory domain names conflict, it becomes necessary to repoint a vCenter Server Appliance (VCSA) to a new Single Sign-On (SSO) domain.

Resolution

Prerequisites
Before performing a repoint operation, perform following steps are completed to prevent data loss or service degradation:

Backup/Snapshot: Perform a file-based backup. Additionally, take a simultaneous, powered-off (offline) snapshot of all vCenter Server nodes if they are part of an Enhanced Linked Mode (ELM) topology.

DNS Verification: Confirm that the vCenter Server has valid forward and reverse DNS entries configured for the new SSO domain.
Metadata Documentation: Because the vmdir structure is recreated, the following must be manually documented and recreated post-repoint:

Global Permissions (Administration > Global Permissions).
Custom local SSO users and groups.
Identity Sources (Active Directory/LDAP configuration).
Current LDU-GUID (record using: /usr/lib/vmware-vmafd/bin/vmafd-cli get-ldu --server-name localhost).

Procedure
The cmsso-util utility is used to perform the repoint.

Repoint the First Node: SSH to the VCSA using the root account and execute:

cmsso-util domain-repoint -m execute --src-emb-admin Administrator --dest-domain-name [New_SSO_Domain]

Repoint Subsequent Nodes (if in ELM): For nodes in an ELM group, run a pre-check first, followed by the execution command using an already repointed node as the replication partner:

Pre-check:

cmsso-util domain-repoint -m pre-check --src-emb-admin Administrator --replication-partner-fqdn [Repointed_Node_FQDN] --replication-partner-admin administrator --dest-domain-name [New_SSO_Domain]

Execute:

cmsso-util domain-repoint -m execute --src-emb-admin Administrator --replication-partner-fqdn [Repointed_Node_FQDN] --replication-partner-admin administrator --dest-domain-name [New_SSO_Domain]

 

Post-Repoint Cleanup:

Re-join the vCenter Server to the Active Directory domain if applicable.
Recreate local SSO users, groups, and Global Permissions.
Re-register external solutions (NSX, Aria Operations, etc.).
References
Fixing VMDIR inconsistencies with SSO domain repoints (Broadcom KB 376443)
vSphere 8.0 Documentation: Repoint vCenter Server

Additional Information

Fixing VMDIR inconsistencies with SSO domain repoints (Broadcom KB 376443)
vSphere 8.0 Documentation: Repoint vCenter Server