PowerCLI - Fails to logon to vCenter VCSA using integrated authentication

 I recently made a PowerCLI script to pull reports from 4 vCenters we got in our infra. Script was tested against once vCenter and was working great. So deployed it in out script host to be able to schedule and also configured to run it against all 4 vCenters. Then noticed it's getting stuck when it's at lab vCenter and pops up asking for credentials, which I was not expecting as it was suppose to run it using integrated authentication. Works fine against 3 remaining vCenters when I tried.

I was able to reproduce this issue by 

1) Opened PowerCli as service account that we are using to pull report.
2) tried to connect to Prod vCenter "Connect-viserver ProdvCenter" and it logged in immediately. 
3) "Connect-viserver LabvCenter" brought up credential popups again

 

4) To troubleshoot, I issued connect command again with verberos switch (-v) and cancelled the credential window. Below is the output from it.  

PS C:\Users\vCAdmin> Connect-VIServer -v VMwareLab
VERBOSE: Attempting to connect using SSPI
VERBOSE: Reversely resolved 'vmwarelab' to 'vmwaretest'
VERBOSE: SSPI Kerberos: Acquired credentials for user 'OurDomain\vCAdmin'
VERBOSE: SSPI Kerberos: InitializeSecurityContext failed for target 'host/VMwareLab'. Error code: 0x80090303
VERBOSE: Connect using SSPI was unsuccessful
Connect-VIServer : 2/08/2021 4:30:04 PM Connect-VIServer                Could not determine user name and/or password for server VMwareLab
At line:1 char:1
+ Connect-VIServer -v VMwareLab
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-VIServer], ViServerConnectionException
    + FullyQualifiedErrorId : ViCore_Login_CredentialNotFound,VMware.VimAutomation.ViCore.Cmdlets.Commands.ConnectVIServer


After comparting the configs, I found the issue and line highlighted in red above is the key. 

1) ProdVC DNS entry is "ProdVCenter.OurDomain.com" and it's joined to AD with same hostname.
2) LabvCenter DNS entry is "vmwarelab.OurDomain.com" and this is what I am trying to connect. But VC is joined to AD with another name vmwaretest.OurDomain.com

Note -: you may need to login as administrator@vsphere.local to be able to view AD Domain section.



So I could just use vmwaretest.OurDomain.com in my script.

If at all you want to use the other name, you can still do that by creating a SPN to connect the host name with AD object. 
In my case I used below command to do this

setspn -A "HOST/vmwaretest.OurDomain.com" vmwarelab

which is 

setspn -A "HOST/<FQDN of vCenter as per Active Directory Domain config of VC>" <alternate name you want to use>

After this , just restart your vCenter which would also allow some time for AD replication,


Thanks!




Comments

Post a Comment

Popular posts from this blog

vCenter Maintenance - Issue Non-ephemeral Portgroup

Image
Hi Friends, We had a issue last day due a miss configuration. We used to keep our vCenters on ephemeral port groups for troubleshooting purposes in case of any issue. We have a new vCenter now and as per standards our project team put that on a portgroup which was named as "ephemeral", but it was quiet late we found it was not actually setup as an ephemeral port group, but static instead :(. So issue was a config issue, but I wanted to share how we solved it hopping it might help someone in other situations too. The story is like this.  We planned to test an outage situation, by bringing down vCenter, to test if our VRA pre-build check can identify it. One of our lazy engineers went to Web Client of the ESXi server hosting vCenter and decided to turn the NIC off for the test. He received below error while turning it back on Description :- Reconfigure this virtual machine Virtual machine :- Non-PROD_vCenter State -: Failed - Invalid configuration for device '3
Read more

vMotion Failing at 21% with error ""The vMotion failed because the destination host did not receive data from the source host on the vMotion network. Please check your vMotion network settings and physical network configuration and ensure they are correct."

Image
vMotion Failing at 21% with error ""The vMotion failed because the destination host did not receive data from the source host on the vMotion network. Please check your vMotion network settings and physical network configuration and ensure they are correct." Scenario We built a new ESXi 6.7 Cluster and we couldn't make vMotions work there Troubleshooting steps 1) Make sure there is no IP address conflict. 2) SSH to ESXi and do a VMK Ping check For Default TCP/IP Stack vmkping 10.11.7.188 Or If you are using Multi NIC vMotion, you might want to specify which VMK interface to use vmkping -I vmk<vmkinterfacenumber> <Destination VMK IP to Ping> Eg -:  vmkping -I vmk3 192.168.1.1 For vMotion Stack I f you try above vmkping command on a ESXi host with VMK interfaces on VMK stack, they will fail with an error  Unknown interface 'vmk': Invalid argument Because the command is looking for TCP/IP stack by default and this VMK wont be listed there. So you need
Read more

applmgmt service wont start on PSC Appliace post converge operation

Scenario We had a vCenter with External PSC. We converged them and converge job was successful execpt a cert warning. After a week we tried to decommission the old PSC appliance and found that the status is shown in WebClient as "Unknown" Up on checking we found  applmgmt in stopped state. Tried to start it but it failed with below error [ ~ ]# service-control --status Running:  lwsmd pschealth vmafdd vmcad vmdird vmdnsd vmonapi vmware-analytics vmware-certificatemanagement vmware-cis-license vmware-cm vmware-rhttpproxy vmware-sca vmware-sts-idmd vmware-stsd vmware-vapi-endpoint vmware-vmon Stopped:  applmgmt vmware-statsmonitor [ ~ ]# service-control --start applmgmt Operation not cancellable. Please wait for it to finish... Performing start operation on service applmgmt... Error executing start on service applmgmt. Details {     "detail": [         {             "translatable": "An error occurred while starting service '%(0)s'",        
Read more