Unable to remove permissions in vCenter Appliance 6.0 U2, how to fix.

//Unable to remove permissions in vCenter Appliance 6.0 U2, how to fix.

Unable to remove permissions in vCenter Appliance 6.0 U2, how to fix.

Today had a very strange problem with our new vCenter Appliance 6.0(VCSA).

First query users and Groups in the Domain(searching to add in the permissions) was very slow and in the Web Client sometimes we see the Domain with double entries, or could not find the users/groups.

Also when we look at the vCenter permissions(vCenter level, or just Folder / Cluster level) we see also the user/group with double entries(like domain.com\user and domain\user) and when try to remove any of these permissions one was always resident and will not be deleted. No errors, no warnings, just cant delete.
Note: vsphere.local users and groups did not show this behavior. So my focus needs to be in the AD and Identify Sources to troubleshoot.

Try to Stop/restart the Services to see if it fix the issue, but no luck. Rebooting the VCSA also did not work. While troubleshooting the issue, and knowing that there was double AD entries, somehow Domain alias and Domain Full Name was set in the system identity. Checking logs did not find anything related that could help(just some references to domain and domain.com), not the issue itself.

Googling the issue, did not find anything related to the same issue(exactly), but did find a VMware KB regarding some VCSA upgrade(that was not the case here, since is a new installation), but it shows a workaround to fix the issue regarding vCenter Server Appliance database to have the full domain name instead of an alias. Since we had both, it makes since to me that this could fix the issue.

How to fix the issue:

Before started, do a full backup of your VCSA, or at least do a Snapshot. In case of problems, you can always rollback.

So login to your VCSA using shell and root user.
Note: Don;t forget that after you login you need to enable the BASH shell and run it. If you get: Shell is disabled, then you need to run the shell.set to enabled.

After you are inside your VCSA console, you need to connect to the postgress database and set your DB to use Full Domain Name.

Note: Just replace the ‘DOMAIN’ for your alias Domain, and ‘DOMAIN.COM’ for your Domain Full Name.

Just reboot your VCSA and the issue is fixed.

Final Note: What did trigger this issue? In this particular case I was not able to identify the source of the issue, but I suspect that by changing our Identity Sources to a different LDAP(that is in a different location and in a different country) could have a different trust in the Forest and did trigger the issue. Since VMware informs that one of the source for this type of issues could be problems connecting to LDAP server and update the changes that we make in our permissions.

Hope this can help you.

Note: Share this article, if you think is worth sharing.

By | 2017-12-30T02:50:07+01:00 September 23rd, 2016|Virtualization|0 Comments

About the Author:

I am over 20 years’ experience in the IT industry. Working with Virtualization for more than 10 years (mainly VMware). I am an MCP, VCP6.5-DCV, VMware vSAN Specialist, Veeam Vanguard 2018/2019, vExpert vSAN 2018/2019 and vExpert for the last 4 years. Specialties are Virtualization, Storage, and Virtual Backups. I am working for Elits a Swedish consulting company and allocated to a Swedish multinational networking and telecommunications company as a Teach Lead and acting as a Senior ICT Infrastructure Engineer. I am a blogger and owner of the blog ProVirtualzone.com

Leave a Reply

%d bloggers like this: