When logged in to VMware vRealize Automation as [email protected] you do not see administrator users listed on the Tenants administrators page

Products

• VMware Aria Suite

Issue/Introduction

Symptoms:

• When editing a non–default tenant and viewing the Administrators tab in VMware vRealize Automation, the page takes a long time to load.
• On the Administrators tab you see an error, and no administrators users are listed.
• In the VMware vRealize Automation UI you see an error similar to:
  
  Internal Error
  ============
  An Internal error has occurred. If the problem persists, please contact your system administrator.
  When contacting your system administrator, use this reference: d4eaf818
  
  
• In the Catalina logs there are timeout exceptions for CSP_TENANT_ADMIN and COM_VMWARE_IAAS_ADMINISTRATOR, similar to :
  
  17-Sep-2015 14:37:43.522 INFO [tomcat-http--3] com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher.fetch https://test.com/identity/api/tenants/dev/principals/?role=CSP_TENANT_ADMIN has timed out because of the following exception: com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher - Read timed out - 70,125 ms.
  17-Sep-2015 14:37:43.527 INFO [tomcat-http--31] com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher.fetch https://test.com/identity/api/tenants/dev/groups/?role=CSP_TENANT_ADMIN has timed out because of the following exception:com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher - Read timed out - 70,134 ms.
  17-Sep-2015 14:37:43.946 INFO [tomcat-http--20] com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher.fetch https://test.com/identity/api/tenants/dev/principals/?role=COM_VMWARE_IAAS_IAAS_ADMINISTRATOR has timed out because of the following exception: com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher - Read timed out - 70,082 ms.
  17-Sep-2015 14:37:43.985 INFO [tomcat-http--8] com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher.fetch https://test.com/identity/api/tenants/dev/groups/?role=COM_VMWARE_IAAS_IAAS_ADMINISTRATOR has timed out because of the following exception: com.vmware.vcac.shell.shindig.customizations.ForkBasicHttpFetcher - Read timed out - 70,121 ms.
  
  
• In the access logs you see the completed requested time completion is longer than 70 sec:

127.0.0.1 [17/Sep/2015:14:38:09 +0200][95657 ms] "GET /identity/api/tenants/dev/principals/?role=COM_VMWARE_IAAS_IAAS_ADMINISTRATOR HTTP/1.1" 200 1274 [tomcat-http--25]

127.0.0.1 [17/Sep/2015:14:38:14 +0200][101086 ms] "GET /identity/api/tenants/dev/principals/?role=CSP_TENANT_ADMIN HTTP/1.1" 200 1274 [tomcat-http--32]

127.0.0.1 [17/Sep/2015:14:38:29 +0200][115729 ms] "GET /identity/api/tenants/dev/groups/?role=COM_VMWARE_IAAS_IAAS_ADMINISTRATOR HTTP/1.1" 200 302 [tomcat-http--50]

127.0.0.1 [17/Sep/2015:14:38:34 +0200][121182 ms] "GET /identity/api/tenants/dev/groups/?role=CSP_TENANT_ADMIN HTTP/1.1" 200 306 [tomcat-http--43]

Note: The preceding log excerpts are only examples. Date, time, and environmental variables may vary depending on your environment.

Environment

VMware vRealize Automation 6.2.x
VMware vRealize Automation Desktop 6.2.x

Cause

The access logs report that there are successful identity requests on the list of principals/groups. These requests however took greater than 70 seconds to complete.
The Catalina logs report that the request originator servlet times out after 70 seconds.

Resolution

To work around this issue, increase the shindig timeout setting:

Note: Before making any changes, make a backup of the shindig.properties file.

1. SSH to the VMware vRealize Automation VA.
2. Using a text editor, open the file /usr/lib/vcac/server/webapps/vcac/WEB-INF/classes/shindig.properties
3. Locate shindig.http.client.read-timeout-ms in the file and set the value to your desired timeout in milliseconds.
   
   Note: Set the value to be larger than the completion time from the access logs.
   
   
4. Restart the VMware vRealize Automation service by running this command:
   
   service vcac-server restart

Note: Increasing the time-out as described is a short-term workaround in order to successfully load the admin page again. Adding more admins later, or having a slow network connection may expose the same problem again.
For best practice, if possible, VMware recommends to combine the admins in an AD group and assign the group to the corresponding roles for the long term solution.

<?xml:namespace prefix = "o" />

Additional Information

To be alerted when this document is updated, click the Subscribe to Article link in the Actions box.