Aria Operations and vIDM AD user/Group sync issue

Products

• VMware Aria Suite
• VMware Aria Operations (formerly vRealize Operations) 8.x

Issue/Introduction

Currently there is not synchronization of user groups in vIDM with vRops.

 

Environment

VMware Aria Operations 8.12.x
VMware Aria Operations 8.14.x

VMware Aria Operations 8.18.x

Cause

VIDM users /groups are not being synced in Aria Operations, as the functionality is not implemented. 

 

Resolution

There are three vIDM user login paths in vRops:

1) Without the vIDM user being imported into vRops and without vIDM user's user-group(s) being imported into vRops - In this case corresponding user is created in vRops upon the 1st login and is granted read-only access. This is not the recommended way of logging in, unless that user is happy with read-only access status.

2) vRops admin explicitly imports vIDM user and manually assigns vRops local access privileges to that user, as part of the import procedure. This privilege assignments is never changed unless admin alters them manually.

3) vRops admin explicitly imports vIDM user groups into vRops and assigns vRops local access privileges to that groups. Now if vIDM user (not imported one) logs in, then vRops checks for the user's user-groups defined on vIDM side and if one has been found to be imported into vRops then associates that user with the imported groups and assignes imported user-groups' privileges to the user.

Once user is logged in through either of 1) 2) or 3) paths NO FURTHER SYNCHRONIZATION is happening between vRops and vIDM. This is a missing part to keep both user-group membership and user privilege in sync with vIDM server (including group deletion and user deletion from a group).

 

 

Additional Information

Note: there are several enhancement request in the ideas portal for Aria Suite integration with vIDM, you are welcome to open a new enhancement for this issue.

Also refer to the Lifecycle matrix for End Of Life for vIDM and other products:

Broadcom Lifecycle matrix