Per User Session host workflows do not work when invoked from vRealize Automation Service Broker

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:

• You are using the VMware vRealize Orchestrator Plug-in for vRealize Automation.
• You are running a vRealize Orchestrator (vRO) workflow such as Get Operation to perform a REST call to a vRA:Host object.
• You receive no content returned when called from the Service Broker catalog.
• You receive content when the workflow is run directly from vRO.
• You have not created any new host entries or modified the default host.

Empty Content Example:

INFOContent as string: {"content":[],"pageable":{"offset":0,"sort":{"sorted":true,"unsorted":false,"empty":false},"queryInfo":{"orderBy":[{"expression":{"propertyName":"createdAt"},"direction":"DESCENDING"}],"customOptions":{},"expand":[],"select":[],"rawOrderBy":"createdAt desc","properties":["createdAt"],"sort":{"sorted":true,"unsorted":false,"empty":false}},"pageNumber":0,"pageSize":20,"paged":true,"unpaged":false},"totalElements":0,"totalPages":0,"last":true,"sort":{"sorted":true,"unsorted":false,"empty":false},"size":20,"number":0,"numberOfElements":0,"first":true,"empty":true}

Environment

VMware vRealize Automation 8.4.x
VMware vRealize Orchestrator 8.4.x

Cause

The default vRA host authentication configuration for sessionMode is Per User Session.  This leverages the permissions of the account that calls the workflow for authorization in the REST call. 

When a vRO workflow is called from Service Broker, they are under the context of the vro-gateway-* user, instead of the requesting users account.  This REST call does not have the necessary permissions to collect all information from vRA.

Resolution

VMware is aware of this feature / configuration limitation and is considering a change for inclusion in a later release.

Workaround:

1. Run the Add vRA Host workflow to create a new and separate connection to the desired vRA host
2. Set the connection value for Shared Session.
3. Provide the credentials for the account that has the permissions required to view the desired content from vRA.
4. Use this new vRA:Host object that was added to inventory in your workflows that will be called from the Service Broker catalog.

Additional Information

VMware vRealize Orchestrator Plug-in for vRealize Automation 
New vRealize Orchestrator Plug-In for vRealize Automation