User with custom role is unexpectedly logged out from NSX UI
search cancel

User with custom role is unexpectedly logged out from NSX UI

book

Article ID: 323543

calendar_today

Updated On:

Products

VMware NSX

Issue/Introduction

Symptoms:
  • NSX Data Center
  • User (local/LDAP/VIDM) is setup with custom role
  • Custom role set with full access (crud) permission "Networking - Connectivity - Tier-1 Gateways".
  • The other permissions are read only (read).
  • When this user attempts to delete the Tier-1, they get logged out with:
image.png
 


Environment

VMware NSX-T Data Center

Cause

This is a known issue, impacting NSX 4.0.x and 4.1.x.
When a Tier-1 gateway is created, it's security configuration is also created, and user needs additional permission to delete it.

Resolution

This is resolved in NSX 4.2.

Workaround:
Permission required to modify security configuration is full access (crud) is policy_edge_security_settings. This policy needs to be added to the custom role to allow deletion of the Tier-1 gateway.
This is configurable in "User Management" section, in "Set Permissions": Security -> Settings -> Gateway Security Settings -> Full Access.

Additional Information

Impact/Risks:
User may be unable to delete a Tier-1 gateway. 
When deletion is attempted, user gets logged out of NSX UI.