This article provides information on some of the frequently asked questions about VMware Platform Services Controller (PSC) for vSphere 6.0. The PSC contains common infrastructure services such as vCenter Single Sign-On (SSO), VMware Certificate Authority (VMCA), licensing, and server reservation and registration services.

 

For more information, see:

• VMware vCenter Single Sign-On Server 5.5 FAQs (2057799) for historical reference
• vSphere Software Components section in the vCenter Server and Host Management guide for vSphere 6.0

How is PSC 6.0 different from SSO 5.5? How is it different from SSO 5.1?
 

The architecture remains the same between vSphere 5.5 and 6.0. However, there are new features and services introduced at the PSC layer which are discussed below. To get a list of all the changes between SSO 5.5 and PSC 6.0, see What’s New in VMware vSphere 6.0 platform and VMware Education's What's New V5.5 to v6.0. To get a list of changes from SSO 5.1, see What's New in VMware vSphere 5.5 Platform.
 

 

PSC 6.0 is supported with:

 

The Platform Services Controller is available on both the Windows vCenter Server ISO or within the vCenter Server Appliance (VCSA) ISO.

 

 

The Platform Services Controller, on both Windows and Appliance, is not a licensed product. It is currently bundled with the vCenter Server 6.0 in the vSphere and vCloud Suites, but only the vCenter Server component of the bundle requires a license.

 

New to vSphere 6.0, both the Appliance-based PSC and Windows-based PSC can be deployed in both multi-site or high availability configurations. Additionally, if you need multi-site in conjunction with high availability, you can now setup your vSphere environment to have multi-sites and then configure each site with secondary PSCs. A load balancer is still required per site to provide high-availability. Only local load balancers (often times referred to as LTM, or Local Traffic Manager) are supported for PSC HA. For more information about recommended and support topologies, see List of recommended topologies for vSphere 6.0.x (2108548).

Note: When configuring PSC High Availability, the load balanced pair are required to be the same type; it is not supported to mix Appliance-Base and Windows-Based PSCs in the same load balanced pair.
 

For information about setting up PSC High Availability (HA), see:

• Customer Connect Download Location of PSC HA Scripts
• Walkthrough Landing Page
  • PSC Setup for Windows
  • PSC Setup for Appliance
  • SSO HA 5.5 to PSC HA 6.0 Upgrade for Windows

 

 

Requirements when deploying the Appliance-based Platform Services Controller:

For more information, see the vCenter Server Appliance Hardware Requirements and Storage Requirements section in the vSphere Install and Setup Guide.

 

Requirements when deploying the Windows-based Platform Services Controller:

• Processor - Intel or AMD x64 processor with two or more logical cores, each with a speed of 2 GHz
• Memory - 2 GB
• Disk storage - 4 GB
• Network speed - 1 Gbps

 

 

 

If the PSC 6.0 server is down, you cannot log in to vCenter Server or any second party VMware products that depends on it. Existing connections and user sessions to the vCenter Server remains active, and the vCenter Server services remains up and running. However, once the session ends, if the PSC is still down, the user cannot log in again. Additionally, if the PSC is down and the vCenter Server's services are restarted, vCenter Server is unable to fully start until the PSC's services are restored or the vCenter Server is repointed to an operation PSC in the same vSphere Domain.

 

Regarding an environment in which multiple PSCs are in the same vSphere Domain and Enhanced Link Mode is being used, if a PSC in which a vCenter Server is connected to fails, access to this vCenter Server through a different vCenter Server's vSphere Web Client is not possible. This is due to a user's SAML token from the vSphere Web Client being unable to be passed to the failed PSC, thus to vCenter Server. Unless the PSC is brought back online or vCenter Server is repointed to a different PSC in the same domain, users cannot access it.

 

 

At this time the VMCA and VECS do not perform Certificate Revocation List (CRL) checking. This means that while the VMCA service is down, your vCenter Server(s) continues working and are able to be restarted. For more information, see Managing Certificate Revocation in the vSphere Security Guide.

 

Additionally, if your PKI is down, due to the the VMCA and VECS not performing CRL checking, your vSphere environment continues to run.

 

 

As with SSO 5.5, in vSphere 6.0 you do not need a database for the PSC.

 

 

For information on how to backup and restore the PSC, see How to back up and restore vCenter Server 6.0 external deployment models (2110294).

 

 

You can snapshot a single Platform Services Controller so long as it does not exist in a multi-site or highly available configuration within a vSphere domain. This is due to the use of Update Sequence Number (USN) for replication, and when restoring a PSC via snapshot or image-based backup, the sibling nodes are out of sync. For more information, see Possible vSphere.local domain inconsistencies after restoring a vCenter Server Single Sign-On 5.5 or Platform Services Controller 6.0 node (2086001).

 

You can use image-based backups for both stand-alone PSCs as well as multi-site or highly available configuration as long as the prescriptive backup and restore methodology covered in the section How to backup and restore PSC 6.0? has been followed.

 

 

For instructions to create and use a Service Principal Account in PSC 6.0, see Creating and using a Service Principal Account in vCenter Single Sign-On 5.5 (2058298).

 

 

 

A Site in the VMware Directory Service is a logical container in which we group the Platform Services Controllers' server objects within a vSphere Domain. You can name them in an intuitive way for easier implementation. Additionally, when Platform Services Controllers are deployed, they publish their service information (service registrations) into the defined Site. When vCenter Servers are deployed against the Platform Services Controllers, the vCenter Server will publish its service information into the Site in which the Platform Services Controller belongs. If you need to move vCenter Servers between Site, you must move their respective service information. For more information, see the section Can I repoint the vCenter Server to other PSCs in the same vSphere Domain? Can I repoint the vCenter Server to a new vSphere Domain? within this article.

 

Currently, the use of sites is for configuring PSC High Availability groups behind a load balancer.

 

 

The different types of Identity Sources that can be created with SSO 5.5 include:

For more information, see Identity Sources for vCenter Server with vCenter Single Sign-On in the vSphere 6.0 Security Guide.

 

 

Since both Appliance-based and Windows-based PSCs can be deployed external to the vCenter Server exist in the same environment in vSphere 6.0, there are multiple means to generate a support log bundle.

 

For the Platform Services Controller Appliance:

• From a Web Browser

1. 1. Open a Web Browser and navigate to: https://Platform_Services_Controller_FQDN/appliance/support-bundle
   2. When prompted enter the root credentials and click Enter.
   3. The download begins automatically as vm-support.tgz.

• From Command Line:

1. 1. Initiate an SSH connection to the vCenter Server Appliance.
   2. Provide the root user user name and password when prompted.
   3. Run this command to enable the Bash shell:
      
      shell.set --enable True
       
   4. Run this command to access the Bash shell:
      
      shell
       
   5. In the Bash shell, run the command to export logs to /storage/log/:
      
      vc-support -l
       
   6. This begins generating a log bundle as vc-<FQDN_of-PSC>-<Date>.tgz.
   7. After completing, use an SCP client to download the log bundle.

• From vSphere Web Client UI

1. 1. Log in to the vSphere Web Client from vCenter Server connected to the Platform Services Controller with [email protected]
   2. Click on Administration > System Configuration
   3. Click Nodes in the left pane.
   4. Locate the Platform Services Controller in the left pane, right-click and click Export Support Bundles.
   5. Click Export Log Bundle and select a location to export.
   6. Click OK.

For the Platform Services Controller for Windows:

• From Windows Server UI

1. 1. Remote Desktop into the Windows Server.
   2. Click Start > All Programs (Windows 2008R2) or Start > All Apps icon (Windows Server 2012R2)
   3. Locate the VMware folder
   4. Click Generate vCenter Server log bundle
   5. This will begin generating a log bundle as vc-FQDN_of-PSC-<Date>.tgz on the desktop.

• From Command Line:

1. 1. Remote Desktop into the Windows Server.
   2. Open an administrative command prompt.
   3. Run the below command to generate the log bundle:
      
      "%VMWARE_CIS_HOME%"\bin\vc-support.bat
       
   4. This will begin generating a log bundle as vc-FQDN_of-PSC-<Date>.tgz on the desktop.

• From vSphere Web Client UI

1. 1. Log in to the vSphere Web Client from vCenter Server connected to the Platform Services Controller with [email protected]
   2. Click on Administration > System Configuration
   3. Click on Nodes in the left pane.
   4. Locate the Platform Services Controller in the left pane, right-click and click Export Support Bundles
   5. Click Export Log Bundle and select a location export.
   6. Click OK.

If you are running an embedded Platform Services Controller on your vCenter Server, the support bundle contain logs and also the information for the PSC. For more information, see Collecting diagnostic information for VMware vCenter Server 4.x, 5.x and 6.0 (1011641).

 

 

A VMware Solution is defined as a product that creates a Machine Account and one or more Solution User (a collection of vSphere services) within the VMware Directory Service when the product is joined to the PSC, thus the vSphere Domain. The Machine Account and Solution User(s) are used to broker and secure communication between other Solutions available within the vSphere environment. In order to count against these maximums, the Machine Account and Solution Users must be fully integrated with all of the PSC's available feature sets (Identity Management and Authentication Brokering, Certificate Management, Licensing, etc.) such that the product makes full use of the PSC. At this time, only vCenter Server is defined as a fully integrated solution and counts against these maximums.

 

Partially integrated solutions, such as vCenter Site Recovery Manager, vCloud Director vRrealize Orchestrator, vRealize Automation Center, and vRealize Operations, do not count against these defined maximums

 

Upgrade Questions

 

If the SSO service is bundled with the vCenter Server, referred to as an embedded deployment, the upgrade from 5.x to 6.0 is handled all-inclusively via the installer for both Windows and the vCenter Server Appliance.

 

 

When planning your vSphere 5.x upgrade to 6.0, see Update sequence for vSphere 6.0 and its compatible VMware products (2109760) which cover when to upgrade the Platform Services Controller.

 

In vSphere environments in which multiple SSO nodes exist in the same vSphere domain, see Mixed-Version Transitional Environments in vCenter Server for Windows Upgrades in the vSphere Upgrade Guide.

 

 

After upgrading to PSC 6.0, the old SSO database is no longer needed. However, the database is not removed from your database server during the upgrade. You must manually remove the database and all users associated with it.

 

 

Yes, all your old Identity Sources are retained after the upgrade.

 

 

Yes, you can continue to log in to your SSO server with the old user (admin@system-domain) and password. This account is an alias of the [email protected] after you have upgraded.

 

However, VMware does not support fresh installs or repointing of vCenter Server 5.5 against a PSC 6.0, nor does VMware support leaving your environment in a hybrid-type deployment of vSphere 5.5 with vSphere 6.0. VMware recommends you to upgrade to vCenter Server to 6.0 along with your PSC. For more information, see Mixed-Version Transitional Environments in vCenter Server for Windows Upgrades in the vSphere Upgrade Guide.

 

For more information, see vCenter Single Sign-On and Platform Services Controller Compatibility Matrix with vCenter Server (2120504).

 

 

The Platform Services Controller Appliance and the Platform Services Controller for Windows use different update mechanisms to patch the software. This includes using the software-packages for the Appliance and running the autorun executable from Windows. Due to the differences, when using the appliance, it is often referred to as Patching; when using the Windows equivalent, it is referred to as Updating. The below operations results in updating your PSC(s) to the latest versions of vSphere 6.0.

• Patching the Platform Services Controller Appliance:
  
  The Patches for the Platform Services Controller Appliance are located on the Customer Connect Patch Repository.

1. 1. Download the Patch ISO for the the Platform Services Controller Appliance.
   2. Mount the ISO to the Appliance using the vSphere Client or vSphere Web Client
   3. SSH to the appliance and log in with root.
   4. Ensure you are running the Platform Services Controller appliance under the Appliance Shell. For more information, see Toggling the vCenter Server Appliance 6.x default shell (2100508).
   5. Stage the patches from the mounted ISO by running the command:
      
      software-packages stage --iso --acceptEulas
       
   6. Install the staged patches by running the command:
      
      software-packages install --staged
       
   7. If prompted, reboot the Platform Services Controller Appliance:
      1. Run this command to enable the Bash shell:
         
         shell.set --enabled True
          
      2. Run this command to access the Bash shell:
         
         shell
          
      3. Run this command to reboot the PSC:
         
         reboot
          
   8. After completion, repeat this process on a