SSO login failures and incorrect vIDB deployment mode after upgrade to VCF Operations 9.1

Products

• VCF Operations

Issue/Introduction

• After upgrading VCF Operations from version 9.0.2 to 9.1, the Identity Broker (vIDB) deployment mode may incorrectly display as "Embedded" in the user interface, even when an external vIDB is configured. This inconsistency results in SSO login failures for integrated components.
• Review of the /var/log/salt/vcf-salt-ext.log on the Cloud Proxy shows minion_service_enabled: false during the time of the upgrade
  
  
• Review of the /storage/vcops/log/adapters/ManagementAdapter/ManagementAdapter#.log on the Cloud proxy shows:
  

  WARN ManagementAdapter...com.vmware.adapter.management.components.salt.client.OpsApiClient.getFleetFqdn] - Fleet FQDN not found in SALT_RAAS component inventory
WARN ManagementAdapter ..com.vmware.adapter.management.components.salt.SaltComponent.performBootstrapping] - Unable to get Fleet FQDN. Skipping the salt infrastructure setup and validation
WARN ManagementAdapter...com.vmware.adapter.management.components.salt.task.OpsSaltExecutionHandler.lambda$bootstrapMinions$0] - Unable to bootstrap Ops minion id [UUID] due to Unable to get MasterFqdn and/or MasterPublicKey from response. wait for next cycle

   

Environment

• VCF Operations 9.1.0.0 (upgraded from 9.0.2)
• vIDB deployment mode: External

Cause

During the 9.1 upgrade, the Salt minion service on the Cloud Proxy was disabled. Consequently, the system failed to purge legacy "Embedded" configuration metadata from the kv_sso_current_idp_config database table, creating a conflict that blocks the integration of the new external vIDB.

Resolution

Note: Create offline snapshots of all cluster nodes and cloud proxies - Snapshot Creation in VCF Operations

1. Take offline, powered-off snapshots of the VCF Operations primary node and all associated vCenter instances.
2. Navigate to Build > Lifecycle > VCF Management > Backup & Restore and temporarily remove any active VMSP backup schedule involving the 9.1 Identity Broker to avoid parameter validation errors.
3. Navigate to Manage > Identity & Access > VCF SSO Overview.
4. Select the Identity Broker displaying "Embedded" status.
5. Execute Delete SSO from the Actions menu.
6. Configure VCF SSO using "Instance" mode. This triggers the auto-discovery of the 9.1 external identity broker.
7. Re-enable the VMSP backup schedule.

 

Workaround

If the UI action fails to clear the conflict, a manual cleanup of the kv_sso_current_idp_config table in the vcopsdb database may be required to remove entries where deploymentType is EMBEDDED and vidbVersion is 9.0.2.
Open a ticket with Broadcom Support. for additional assistance and reference this KB.

 

Subscribe to this knowledge article to get updates on this issue.

Additional Information

Terminology:

• Access Control (Operate > Administration) manages local/domain permissions for the VCF Operations UI.
• Access Management (Manage > Identity & Access) manages scope for individual VCF instances (vCenter, NSX, etc.).

 

Related KB:

After upgrading to VCF 9.1, configuration of the instanced VCF Single Sign-On (SSO) fails with the error: "An identity broker instance is not available for configuring Single Sign-On."