Unable to compute applicability for drift WorkspaceOneBrokerConfigDrift

Products

• VMware vCenter Server 8.0
• VMware SDDC Manager / VCF Installer
• VMware Cloud Foundation

Issue/Introduction

Introduction

Upgrading VMware Cloud Foundation (VCF) or performing Lifecycle Management (LCM) pre-checks may fail due to identity service drift failures. This typically results in a configuration realized check failure that blocks further management operations in the SDDC Manager UI.

Symptoms

When navigating to the Updates tab for a Workload Domain in SDDC Manager, the following red banner appears:

Retrieving configuration updates failed. Unable to compute applicability for drift WorkspaceOneBrokerConfigDrift. Because configuration realized check failed on resources [####-####-####-####]. Please check logs and fix the failures of drift configuration realized checks.

• The LCM Update Precheck completes with Passed and 0 Errors.
• The vSphere Diagnostic Tool (VDT) reports failures under SSO CHECKS:
  • [FAIL] ##NO_HOSTNAME##
  • [FAIL] 3rd party/Orphaned service registrations.
• In /var/log/vmware/trustmanagement/trustmanagement.log on vCenter: Failed to get a access token on host #### for tenant HWS
• vSphere Diagnostic Tool (VDT) reports [FAIL] 3rd party/Orphaned service registrations or [FAIL] ##NO_HOSTNAME##.
• The issue persists even if Workspace ONE is not utilized (e.g., using LDAP/AD only).

Environment

• VMware Cloud Foundation 5.x
• SDDC Manager 5.x
• vCenter Server 8.x
• Enhanced Linked Mode (ELM) configuration

Cause

This issue is caused by stale or orphaned service registrations lingering in the vSphere Lookup Service database across the Enhanced Linked Mode (ELM) SSO domain. When SDDC Manager runs background drift polling, these malformed entries (such as ##NO_HOSTNAME##) cause authentication requests to route incorrectly, preventing token acquisition for the identity broker.

Resolution

Prerequisites:

1. Take powered-on snapshots of all vCenter Servers in the Enhanced Linked Mode (ELM) domain.
2. Ensure you have root access to the Management vCenter.

Step 1: Purge Orphaned Lookup Service Endpoints

1. SSH into the primary Management vCenter Server as root.
2. Run the lstool.py utility to unregister the stale service IDs flagged by VDT: /usr/lib/vmware-lookupsvc/tools/lstool.py unregister --url http://localhost:7090/lookupservice/sdk --id <ORPHANED_ID> --user '[email protected]' --password '####' --no-check-cert
3. Allow 3 minutes for vmdir replication to synchronize the directory across all linked vCenters.

Step 2: Restart Services

1. On all linked vCenter Servers, restart the identity and lookup services:
vmon-cli -r lookupsvc 
vmon-cli -r vc-ws1a-broker 
vmon-cli -r trustmanagement
vmon-cli -r sts
2. On the SDDC Manager appliance, restart the domain service: systemctl restart domainmanager

Step 3: Verification

1. Re-run VDT on the vCenter Server and confirm all SSO CHECKS return [PASS].
2. Refresh the SDDC Manager UI and verify the red error banner has cleared from the Updates tab.