Permissions/Rights Error When Attempting to Change Placement Policy on a VM

Products

• VMware Cloud Director

Issue/Introduction

• The purpose of this KB is to resolve permissions/rights issues associated with SAML-authenticated users

Symptoms:

• When logged in with a user using SAML, that user is not able to change the placement policy of any vm despite being an Organization Administrator
• Any attempt to change the placement policy returns the following message:

Error: [ <REQUEST_UUID> ] Either you need some or all of the following rights [VAPP_EDIT_VM_COMPUTE_POLICY] to perform operations [VAPP_VM_COMPUTE_POLICY_EDIT] for <OBJECT_UUID> or the target entity is invalid 

• This operation completes successfully when executed as an Organization Administrator authenticated using LDAP

Environment

VMware Cloud Director 10.x
VMware Cloud Director for Service Provider 10.x

Cause

• This issue occurs due to a missing right associated with pre-defined roles
• This occurs most commonly in environments that have been upgraded numerous times
• The rights continue to expand with each iterative version -- on occasion the default rights bundle needs to be re-published to ensure all rights have been captured for each user and role

Resolution

• The resolution is as follows:

1. Go to Right Bundles
2. Click edit the 'Default Rights Bundle'
3. Go to "vApp >" and select 'Edit VM Compute Policy' and save it
4. Now Publish "Default Rights Bundle" to all tenants (if needed un-publish first then re-publish it again)
5. Logout and login back to the tenant as an Organization Administrator

Workaround:

• At this time there is no other workaround

Additional Information

Impact/Risks:

• This issue prevents execution of some basic administrative tasks