"Error loading data" in DRS configuration wizard in vCenter 7.0 Update 3c or later when logged in with an AD account

Products

• VMware vCenter Server

Issue/Introduction

Symptoms:

• An Active Directory user is logged in in vSphere Client
• The user is attempting to edit the DRS configuration for a cluster (<Cluster> → Configure → vSphere DRS → Edit...)
• While trying this, an error message is displayed, stating:

  Error Loading Data
  An error occurred while trying to load data. This could be due to temporary outage. You can retry the operation by
  clicking retry button.
  
  Error Details
  Failed to log into [uri=http://localhost:1080/wcp, sessionmgr=VapiSessionManagerInfo
  [_sessionMgrSvcId=com.vmware.cis.session, _loginOpId=create, _logoutOpId=delete],
  ssoDomain=vsphere.local(########-####-####-####-############)]:...

  Example:
  
• At the same time, /var/log/vmware/vpxd-svcs/vpxd-svcs.log contains an error stack similar to this:

  <timestamp> [tomcat-exec-46  ERROR com.vmware.cis.core.authz.accesscontrol.impl.AuthzServiceBaseImpl  opId=########-####-####-####-############] Store Exception
  java.lang.IllegalArgumentException: Invalid principal name my_user_group@[email protected]
   at com.google.common.base.Preconditions.checkArgument(Preconditions.java:217)
   at com.vmware.cis.core.util.NormalizedPrincipalHelper.getNormalizedPrincipal(NormalizedPrincipalHelper.java:30)
   at com.vmware.cis.authorization.impl.PrincipalImpl.<init>(PrincipalImpl.java:19)
   at com.vmware.cis.authorization.impl.AclPrivilegeValidator.getPrincipal(AclPrivilegeValidator.java:232)
   at com.vmware.cis.authorization.impl.AclPrivilegeValidator.isAllowed(AclPrivilegeValidator.java:146)
   at com.vmware.cis.authorization.impl.AclPrivilegeValidator.isAllowed(AclPrivilegeValidator.java:135)

Environment

VMware vCenter Server 7.0.3

Cause

This issue occurs when the Active Directory account of the logged in user is a member of an Active Directory Group whose name contains a special character vCenter cannot handle, such as commercial at (@).

Resolution

This issue is resolved in VMware vCenter Server 7.0 Update 3f. Refer to VMware vCenter Server versions and build numbers for the specific build number for this release.
As a workaround, do not use Active Directory groups with @ characters in their name.
Should this not be an option, remove affected users from such groups.