Verify SSO Dependencies Before Decommissioning Stale PSC Entries in VMware vCenter Server

Products

• VMware vCenter Server

Issue/Introduction

Before decommissioning stale Platform Services Controller (PSC) entries, verify that active vCenter Server nodes and registered solutions do not have dependencies on the stale metadata. This process ensures that the SSO domain remains stable after unregistering the stale nodes.

Environment

VMware vCenter Server 8.0.x

Cause

Stale PSC entries often remain in the VMware Directory Service (VMDir) after nodes are improperly removed or migrated, causing pre-update check failures.

Resolution

1. Verify vCenter Endpoint: Run the following command on the active vCenter Server Appliance (VCSA) to confirm which PSC the node is currently pointing to
   # /usr/lib/vmware-vmafd/bin/vmafd-cli get-ls-location --server-name localhost 
   Note: If the output points to the active VCSA or an active PSC, primary dependencies are healthy.

2. List Registered Services: Check the Lookup Service for entries tied to the stale PSC FQDN
   #/usr/lib/vmidentity/tools/scripts/lstool.py list --url http://localhost:7080/lookupservice/sdk 2> /dev/null \| grep -E "URL\|Owner"

3. Identify Stale LDAP Entries: Export the VMDir database to search for stale endpoints
   #/opt/likewise/bin/ldapsearch -b "dc=vsphere,dc=local" -s sub -D "cn=Administrator,cn=Users,dc=vsphere,dc=local" -W > /tmp/vmdir_export.ldif 
   Search the exported file for the stale PSC FQDN or IP address.

4. Decommission: Once dependencies are cleared, refer to Unregister vCenter with External PSC or vCenter with Embedded PSC to safely unregister the stale node using cmsso-util.