lookupservice

vCenter Server 6.0 Tidbits Part 4: Finding all deployed vCenter Servers

04/16/2015 by William Lam 2 Comments

In vSphere 6.0, there are a list of recommended topologies which can viewed in VMware KB 2108548. In the event that you need to locate all available vCenter Servers in your environment, you have a couple of options depending on type of access you have and the state of your environment (e.g. vSphere Web Client is down). For locating all deployed Platform Service Controllers (PSC), please take a look at my previous article here. Before taking a look at the solutions, here is a diagram of my vSphere 6.0 lab environment and its configuration: 2 PSCs configured for replication with 2 VCs joined to PSC1 and another VC joined to PSC2.

Option 1:

The first option to find this information is using the new System Configuration UI which is available in the vSphere 6.0 Web Client. You can quickly view all Nodes and their type as seen in the screenshot below. This would be the quickest and most efficient method if access to the vSphere Web Client is available.

Option 2:

We can also connect to a new service in vSphere 6.0 known as the Component Manager via its MOB (Managed Object Browser) interface. You will need to open a browser and connect to the following URL and substituting it with the Hostname/IP Address of one of your PSC:

https://psc-01.primp-industries.com/cm/mob/?moid=ServiceManager&method=Search

If you do not know the Hostname/IP Address of your PSC Server, you can always find it by going to the vCenter Server Advanced Settings and searching for pattern "sso.admin" and you will see the address of your PSC Server as seen in the screenshot below.

Once you have authenticated in, you will need to add the following snippet into the text box:

<searchCriteria>
<serviceType>
<productId>com.vmware.cis</productId>
<typeId>vcenterserver</typeId>
</serviceType>
</searchCriteria>

Note: For programmatic access, please refer to Option 3 for more details.

Next, click on Invoke Method to execute the query and if everything was successful, you should see entries under "serviceAttributes" for all your vCenter Servers as seen in the screenshot below.

Option 3:

The final option is to of course retrieve this information programmatically using the new vCloud Suite SDK which is part of the vSphere 6.0 release. There are 6 new SDKs: .Net, Java, Perl, REST, Python & Ruby and you can find more information here. In this example, I will be using the vCloud Suite SDK for Python and using the sample located under the "lookupservice" directory called print_services.py You will need to download and extract the contents of the SDK onto a system that has a Python interpreter installed and below are the instructions for running this particular sample script.

First, you will need to edit a configuration file and provide some details to one of your PSC's

VMware-vCloud-Suite-SDK-Python-6.0.0/client/samples/src/sample.cfg

Here is an example of what the file should look like for my environment:

[connection]
lswsdlurl=file:///root/VMware-vCloud-Suite-SDK-Python-6.0.0/client/wsdl/lookupservice.wsdl
lssoapurl=https://psc-01.primp-industries.com/lookupservice/sdk
ssousername=*protected email*
ssopassword=VMware1!

Next, change into the following directory:

cd VMware-vCloud-Suite-SDK-Python-6.0.0/client/bin/

Finally, to run the sample script you will need to ensure run_sample.sh (wrapper script) is set to executable and then run the following:

./run_sample.sh ../samples/src/com/vmware/vcloud/suite/sample/lookupservice/print_services.py

If everything was configured successfully, you should see similar output as shown in the screenshot below:

vCenter Server 6.0 Tidbits Part 3: Finding all deployed Platform Services Controller

04/08/2015 by William Lam 9 Comments

In vSphere 6.0, there are a list of recommended topologies which can viewed in VMware KB 2108548. In the event that you need to locate all available Platform Services Controllers in your environment, you have a couple of options depending on type of access you have and the state of your environment (e.g. vSphere Web Client is down). Before taking a look at the solutions, here is a diagram of my vSphere 6.0 lab environment and its configuration: 2 PSCs configured for replication with 2 VCs joined to PSC1 and another VC joined to PSC2.

Option 1:

Option 2:

https://psc-01.primp-industries.com/cm/mob/?moid=ServiceManager&method=Search

Once you have authenticated in, you will need to add the following snippet into the text box:

<searchCriteria>
<serviceType>
<productId>com.vmware.cis</productId>
<typeId>sso:admin</typeId>
</serviceType>
</searchCriteria>

Note: For programmatic access, please refer to Option 3 for more details.

Next, click on Invoke Method to execute the query and if everything was successful, you should see entries under "serviceEndpoints" for all your PSCs as seen in the screenshot below.

Option 3:

First, you will need to edit a configuration file and provide some details to one of your PSC's

VMware-vCloud-Suite-SDK-Python-6.0.0/client/samples/src/sample.cfg

Here is an example of what the file should look like for my environment:

Next, change into the following directory:

cd VMware-vCloud-Suite-SDK-Python-6.0.0/client/bin/

Finally, to run the sample script you will need to ensure run_sample.sh (wrapper script) is set to executable and then run the following:

./run_sample.sh ../samples/src/com/vmware/vcloud/suite/sample/lookupservice/print_services.py

If everything was configured successfully, you should see similar output as shown in the screenshot below:

vCenter Server 6.0 Tidbits Part 2: What is my SSO Domain Name & Site Name?

04/07/2015 by William Lam 27 Comments

When deploying an Embedded vCenter Server or an external Platform Services Controller, one of the configurations you will be asked for is the vCenter Single Sign-On Domain Name and Site Name as seen in the screenshot below.

In addition to troubleshooting, you will also need to know about the SSO Domain Name + Site Name if you plan on deploying additional Platform Services Controller for replication purposes or additional vCenter Servers. It is important to note that you do not need to know this information explicitly when deploying using the new Guided UI Installation. You just need to know the hostname/IP Address of your PSC as the rest of the information will automatically be obtained by the tool.

The issue only arises when you are trying to perform a Scripted Installation and this is where you will need to provide both the SSO Domain Name and Site Name and below are the instructions on retrieving this information.

First off, you will need to login to your Platform Services Controller whether that be on a Windows Server or the VCSA.

SSO Domain Name

You will find it in the following two configuration files:

Windows:

C:\ProgramData\VMware\vCenterServer\cfg\install-defaults\vmdir.domain-name

VCSA:

/etc/vmware/install-defaults/vmdir.domain-name

VCSA 6.0u2:

/usr/lib/vmware-vmafd/bin/vmafd-cli get-domain-name --server-name localhost

For more details, check out my previous blog post: vCenter Server 6.0 Tidbits Part 1: What install & deployment parameters did I use?

SSO Site Name

First, you will need to identify where your Lookup Service is running on which is located on your PSC or your Embedded VC instance. What we are ultimately looking for is Lookup Service URL which is in the following format: https://[SERVER]/lookupservice/sdk If for whatever reason you do not know where your PSC is, then you can login to your vCenter Server and find the Lookup Service URL by running the following command:

Windows:

"C:\Program Files\VMware\vCenter Server\vmafdd\vmafd-cli.exe" get-ls-location --server-name localhost

VCSA:

/usr/lib/vmware-vmafd/bin/vmafd-cli get-ls-location --server-name localhost

Once we have the Lookup Service URL, we can then find the SSO Site Name by running the following command:

Windows:

"C:\Program Files\VMware\vCenter Server\python\python.exe" "C:\Program Files\VMware\vCenter Server\VMware Identity Services\lstool\scripts\lstool.py" get-site-id --url https://vcenter60-6.primp-industries.com/lookupservice/sdk"

VCSA:

/usr/lib/vmidentity/tools/scripts/lstool.py get-site-id --url https://vcenter60-6.primp-industries.com/lookupservice/sdk 2> /dev/null

VCSA 6.0u2:

/usr/lib/vmware-vmafd/bin/vmafd-cli get-site-name --server-name localhost

As you can see the process to find the SSO Site Name is not really intuitive, but I know Engineering is aware of this and has plans to simplify this in the future.

Dude, Where’s My vCenter Server 5.1 Components Installed At?

04/03/2013 by William Lam 5 Comments

You would be surprised at the number of times I have heard this question get asked and this is not regarding the installation path but the specific server a given vCenter Server 5.1 component is installed on. I am just wondering if people are somehow miss-placing their infrastructure? I would hope that most organizations have some type of CMDB (Configuration Management Database) even if it is just a spreadsheet or at a minimum a memorable hostname. In any case, this question is only relevant for those of you who decided to separate out the vCenter SSO (Single Sign-On) Server, vSphere Web Client, Inventory Service and the vCenter Server and are now wondering where a given component is installed at.

To begin, you will need to know at a minimum where your vCenter Server is installed at. If you do not know that, then you should take the walk of shame and install this utility (be-careful with port scanning tools, as it may not be allowed by your Security Operations team). Go to the advanced settings of your vCenter Server and look up one of the following settings:

config.vpxd.sso.sts.uri
config.vpxd.sso.groupcheck.uri
config.vpxd.sso.admin.uri

All three of these settings should contain the same hostname or IP Address which is the location of where your SSO Server is installed. You can also find this information by looking at the vCenter Server configuration file located in the following location:

Windows vCenter Server: C:\ProgramData\VMware\VMware VirtualCenter\vpxd.cfg
vCenter Server Appliance: /etc/vmware-vpx/vpxd.cfg

Next, you will need to login directly to your vCenter Server (RDP or SSH) depending on the version you are using. Using the hostname or IP Address of our vCenter SSO Server, we will now connect to the Lookup Service which is installed alongside the vCenter SSO Server. This service will provide us with the location of all services registered to vCenter SSO and we will be able to identify the location of the remainder vCenter Server components.

For Windows vCenter Server, make sure you have the JAVA_HOME environmental variable set to C:\Program Files\VMware\Infrastructure\jre and open up a command prompt and run the following (subsitute in the hostname or IP Address of your vCenter SSO Server):

vSphere 5.5

"C:\Program Files\VMware\Infrastructure\VMware\CIS\vmware-sso\ssolscli.cmd" listServices https://winvc.primp-industries.com:7444/lookupservice/sdk

vSphere 5.1

"C:\Program Files\VMware\Infrastructure\SSOServer\ssolscli\ssolscli.cmd" listServices https://winvc.primp-industries.com:7444/lookupservice/sdk

We can take a look at the serviceName which describes the specific vCenter Server component such as the vSphere Web Client or Log Browser and endpoints property will tell you which server it is installed on.

For vCenter Server Appliance, there is a similar command by running the following:

/usr/lib/vmware-sso/bin/vi_regtool listServices https://172.30.0.186:7444/lookupservice/sdk

The only vCenter Server component that we have not found is the Inventory Service. To find the server where this component is installed, we just need to look at the vCenter Server Extensions and and we can simply open up a web browser and connect to the following URL (substitute in your vCenter Server address):

https://vcsa.primp-industries.com/mob/?moid=ExtensionManager&doPath=extensionList[%22com.vmware.vim.inventoryservice%22].healthInfo

Hopefully at this point you are able to figure out where all your vCenter Server 5.1 components are installed at and you are also documenting all this information in your CMDB or spreadsheet 🙂

Configuring Additional VCSA 5.1 as vSphere Web Client Servers

09/24/2012 by William Lam 6 Comments

In my previous article, I showed you how to configure additional vSphere Web Client 5.1 Servers for a Windows environment. For those interested in using the VCSA (vCenter Server Appliance) instead to configure additional vSphere Web Client Servers, here is the process.

Disclaimer: This is for educational purposes only, this is not officially supported by VMware. Please test this in a development environment before using it on actual systems.

Before getting started, it is very important to ensure you have proper DNS resolution (forward / reverse working) on all your VCSA's.

Step 1 - You will need to know the IP Address or hostname of your vCenter SSO Server (If you are using the VCSA, then it is the same address as your vCenter Server). Next, deploy a brand new VCSA and go ahead and configure the IP Address, hostname, etc. in preparation for the next step.

Step 2 - Create a script called configureVCSAvSphereWebClientStandalone.sh (this script reside on the new VCSA itself or on a remote host) which contains the following

#!/bin/bash
# William Lam
# www.virtuallyghetto.com

# User Configurations

VCENTER_SSO_IPADDRESS=172.30.0.181

## DO NOT EDIT BEYOND HERE ##

echo "Adding Lookup Service URL to /etc/vmware/ls_url.txt & /etc/vmware-sso/ls_url.txt"
echo "https://${VCENTER_SSO_IPADDRESS}:7444/lookupservice/sdk" > /etc/vmware/ls_url.txt;echo "https://${VCENTER_SSO_IPADDRESS}:7444/lookupservice/sdk" > /etc/vmware-sso/ls_url.txt;

echo "Retrieving ${VCENTER_SSO_IPADDRESS} SSL Certificate"
echo "" | openssl s_client -connect ${VCENTER_SSO_IPADDRESS}:7444 2> /dev/null 1> /tmp/cert

echo "Storing ${VCENTER_SSO_IPADDRESS} SSL Certificate in /etc/ssl/certs/VMware-Lookup-Service-Root-CA.pem"
openssl x509 -in /tmp/cert > /etc/ssl/certs/VMware-Lookup-Service-Root-CA.pem

echo "Registering vSphere Web Client with ${VCENTER_SSO_IPADDRESS}"
/usr/lib/vmware-vsphere-client/vsphere-client-sso-hook install --ls-server https://${VCENTER_SSO_IPADDRESS}:7444/lookupservice/sdk --user root --password vmware

#!/bin/bash

# William Lam

# www.virtuallyghetto.com

# User Configurations

VCENTER_SSO_IPADDRESS=172.30.0.181

## DO NOT EDIT BEYOND HERE ##

echo "Adding Lookup Service URL to /etc/vmware/ls_url.txt & /etc/vmware-sso/ls_url.txt"

echo "https://${VCENTER_SSO_IPADDRESS}:7444/lookupservice/sdk" > /etc/vmware/ls_url.txt;echo "https://${VCENTER_SSO_IPADDRESS}:7444/lookupservice/sdk" > /etc/vmware-sso/ls_url.txt;

echo "Retrieving ${VCENTER_SSO_IPADDRESS} SSL Certificate"

echo "" | openssl s_client -connect ${VCENTER_SSO_IPADDRESS}:7444 2> /dev/null 1> /tmp/cert

echo "Storing ${VCENTER_SSO_IPADDRESS} SSL Certificate in /etc/ssl/certs/VMware-Lookup-Service-Root-CA.pem"

openssl x509 -in /tmp/cert > /etc/ssl/certs/VMware-Lookup-Service-Root-CA.pem

echo "Registering vSphere Web Client with ${VCENTER_SSO_IPADDRESS}"

/usr/lib/vmware-vsphere-client/vsphere-client-sso-hook install --ls-server https://${VCENTER_SSO_IPADDRESS}:7444/lookupservice/sdk --user root --password vmware

You will need to change the VCENTER_SSO_IPADDRESS variable to the address of your vCenter SSO Server.

Step 3 - Set the script to executable by running the following command:

chmod +x configureVCSAvSphereWebClientStandalone.sh

Step 4 - You can either execute the script locally on the VCSA or my preferred method is just to execute it remotely by running the following command:

ssh [email protected] < configureVCSAvSphereWebClientStandalone.sh

Note: Make sure to replace the IP Address with address of your VCSA

As part of the configuration, the vSphere Web Client service will automatically start up at the very end. Once the service has successfully started, you will be able to connect to the vSphere Web Client URL by going to https://[webclient-hostname-ip]:9443/vsphere-client and you now should be able to see all the vCenter Servers that have registered with the same vCenter SSO server.

Here is another view using the new VIN 1.2 (vSphere Infrastructure Navigator) to show that I have two vSphere Web Client servers (webclient1 and webclient2) registered to my primary vCenter SSO Server (vcenter51-1) as well as two additional vCenter Server (vcenter51-2 and vcenter51-3) that are also registered with the same SSO Server.

As you can see, if you need to add additional vSphere Web Client Servers, the VCSA can easily be configured to enable only this feature to help you scale out and provide additional capacity as well as redundancy. Stay tuned for some more details on configuring a Load Balancer to load balance multiple vSphere Web Client Servers.

Additional Resources:

Configuring Additional Windows vSphere Web Client 5.1 Servers

09/20/2012 by William Lam 10 Comments

Did you know in vSphere 5.1, you can now configure multiple vSphere Web Client servers to multiple vCenter 5.1 Servers and get a single view of your entire infrastructure as well as provide redundancy to the vSphere Web Client? This is all made possible with the new vCenter SSO (Single Sign-On) and Lookup Service feature.

When you first install vCenter Server, you can install the vSphere Web Client on the same machine or you can install it on a separate machine. If you decide to install the vSphere Web Client on a separate system or add additional vSphere Web Client servers, you simply just need to point them to your main vCenter SSO instance.

Note: If you wish to re-point or re-register other vCenter Server components, there is nice VMware KB that goes over all the steps.

Before getting started, it is very important to ensure you have proper DNS resolution (forward / reverse working) on all your Windows servers.

If you are running Windows, when you install the vSphere Web Client, you will be brought to a screen to specify your SSO Administrator credentials ([email protected] for windows) or (root for VCSA) as well as the Lookup Service URL which will be the same system running your vCenter SSO service.

Note: In my lab, I am using the VCSA for my vCenter Server as well as my SSO server, but this can also be a Windows vCenter Server and SSO Server.

You also have the ability to re-point your vSphere Web Client to another vCenter SSO server and you can do so by using the following script: C:\Program Files\VMware\Infrastructure\vSphereWebClient\scripts\client-repoint.bat To use the script, you just need to specify the new Lookup Service URL along with the SSO Administrator credentials.

C:\Program Files\VMware\Infrastructure\vSphereWebClient\scripts\client-repoint.bat https://172.30.0.181:7444/lookupservice/sdk root vmware

Once the script has finished registering with the new vCenter SSO server, you can now connect to the vSphere Web Client URL by going to https://[webclient-hostname-ip]:9443/vsphere-client and you now should be able to see all the vCenter Servers that have registered with the same vCenter SSO server.

Here is another view using the new VIN 1.2 (vSphere Infrastructure Navigator) to show that I have two vSphere Web Client servers (webclient 3 and webclient4) registered to my primary vCenter SSO Server (vcenter51-1) as well as two additional vCenter Server (vcenter51-2 and vcenter51-3) that are also registered with the same SSO Server.

As you can see this provides me with single view of all my vCenter Servers and I can now connect to either vSphere Web Client servers which can be used for both load balancing as well as redundancy. You probably might have guessed, the next logical step is to put an actual load balancer in front of multiple vSphere Web Clients and simply expose a single entry point for your end users .... stay tune 🙂

FYI - If you are interested in using the VCSA and only enabling the vSphere Web Client feature, the process is slightly different and I will share the procedure in a separate post.