"Permission Denied" error when creating new replications in Cloud Director Availability 4.x

Products

• VMware Cloud Director

Issue/Introduction

Symptoms:

• When creating an On-Premises to Cloud protection or migration in Cloud Director Availability 4.x, the task fails and you see an error similar to:

Permission Denied

• In the Settings view of the Cloud Director Availability On-Premises Portal, the Allow access from Cloud site setting is set to No.
• In the /opt/vmware/h4/replicator/log/replicator.log file on the on-premise appliance, you see messages similar to:
   
  2023-08-30 19:19:32.878 ERROR - [UI-########-####-####-####-############-######-##-##-##-##] [job-3] c.v.h.r.s.onprem.OnPremTokenManager      : Unknown token ####...###=
  2023-08-30 19:19:32.878 ERROR - [UI-########-####-####-####-############-######-##-##-##-##] [job-3] com.vmware.h4.jobengine.JobExecution     : Task ########-####-####-####-############ (WorkflowInfo{type='setupSource', resourceType='replication', resourceId='H4-########-####-####-####-############', isPrivate=false, resourceName='null'}) has failed
  
  com.vmware.h4.api.error.exceptions.PermissionDeniedException: Permission denied.
      at com.vmware.h4.replicator.services.onprem.OnPremTokenManager.validateToken(OnPremTokenManager.java:251)
  ...

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware Cloud Director Availability 4.x

Cause

When the Allow access from Cloud setting is disabled, a token is used to manage access to the On-Premises site from the paired Cloud site. This issue can occur if there are delays during the setup tasks in the Cloud site infrastructure, the timeout on the token can be exceeded and the interaction becomes invalidated.

Resolution

To resolve this issue, investigate and correct the cause of the configuration delays in the Cloud site.

Workaround:
If the cause of the delays cannot be determined or corrected, work around this issue by repairing the On-Premises site with the Cloud site to enable the Allow access from Cloud setting. For more information see the Repair with a remote site section of the Cloud Director Availability documentation.