vCenter client plugins deployment fails with error "Plug-in configuration with Reverse Proxy failed"

Products

• VMware vCenter Server 8.0

Issue/Introduction

• Download or Deploy plug-in task fails at 0% with error "Plug-in configuration with Reverse Proxy failed"
• Under Client Plugins status shows as "Failed"
• Removing Plug-in from vCenter server MOB page and re-starting vsphere-ui does not help. 

 

• vsphere_client_virgo.log located in /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log contains the following error messages:

[YYYY:MM:DD] [ERROR] sdk-plugin-deployer-196       c.v.v.p.p.JsonFileBasedRemotePluginReverseProxyConfigurer         Cannot add proxy rules for {packageRef = com.vmware.vlcm.client:8.0.#.2###1, manifestUrl = https://example_vCenter_FQDN:9087/vci/downloads/vlcm-ui/plugin.zip=[url = https://example_vCenter_FQDN:9087/vum-fileupload/,type = HTTP_FILE_UPLOAD,sslPeerAuthenticationData = SslPeerCertificateThumbprintData{thumbprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##}, url = https://example_vCenter_FQDN:443,type = cis.common.skipreg,sslPeerAuthenticationData = SslPeerCertificateThumbprintData{thumbprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##}, url = https://example_vCenter_FQDN:9087/vci/downloads/vlcm-ui/plugin.zip,type = MANIFEST_SERVER,sslPeerAuthenticationData = SslPeerCertificateThumbprintData{thumbprint=##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##:##}]}. Plugin service initial configuration is not ready/was not successful.
[YYYY:MM:DD] [INFO ] sdk-plugin-deployer-196       com.vmware.vise.plugin.extension.VcExtensionManager               Cleaning up extension: com.vmware.vlcm.client:8.0.#.2###1
[YYYY:MM:DD] [INFO ] sdk-plugin-deployer-196       c.vmware.vise.extensionfw.impl.plugin.PluginExtensionManagerImpl  Extensions for plugin com.vmware.vlcm.client:8.0.#.2###1 were removed from the cache.
[YYYY:MM:DD] [ERROR] sdk-plugin-deployer-195       com.vmware.vise.plugin.status.RemotePluginStatusServiceImpl       DEPLOYMENT_FAILED: Error deploying plugin package com.vmware.vsan.client:8.0.##.###. Reason: Plugin configuration with Reverse Proxy failed. 

• rhttpproxy-##.log located in /var/log/vmware/rhttpproxy/rhttpproxy-##.log contains the following error message:

[YYYY:MM:DD] error rhttpproxy[2501235] [Originator@6876 sub=RhttpProxy] [Rhttpproxy JWT] Missing privilege! Global.Proxy is required. [YYYY:MM:DD] error rhttpproxy[2501235] [Originator@6876 sub=RhttpProxy] [Rhttpproxy REST PUT Handler] JWT verification failed

Cause

Role name "vSphere Client Service Account" is missing the Global.Proxy privilege.

Resolution

Follow the below steps to grant the missing Global.Proxy privilege to the "vSphere Client Service Account" role.

 

Note: Take a snapshot of the vCenter server(s) or file-based backup before making any changes. 

• Open the browser and login to vCenter Server webclient using SSO Administrator ex: [email protected]
• Navigate to Administration >Access Control > Roles
• Select vSphere Client Service Account and click on edit.
• Navigate to the Global section and select the Proxy option
  
• Re-start the rhttpproxy and vsphere-ui service using the below commands
  • service-control --restart rhttpproxy
  • service-control --restart vsphere-ui
    Note: If the vCenter servers are in linked mode re-start both the services on all the linked nodes.
• The Status under the Client Plug-in section shall be updated to 'Deployed' upon successful completion of the task