"403 FORBIDDEN" Error Cannot delete as there are resources associated with the project in VMware Aria Automation

Products

VMware Aria Suite

Issue/Introduction

Symptoms:

After Moving deployments associated with Active Directory to a new project using "Change Project" feature or after deleting a project associated to an Active Directory Integration, you receive a 403 FORBIDDEN Exception on the Active Directory Integration page under "Projects" tab.
Situation Change Project:
Given a project with an Active Directory integration attached to it, and there are deployments with machines created in the Active Directory, When we move the deployments to a new project, and remove the old project from the Active Directory Integration and try to delete the integration
we receive a 403 FORBIDDEN Exception.
Situation Delete Project:
Given a project with an Active Directory integration attached to it and there are deployments with machines created in the Active Directory when we delete the project while there are Active Directory resources attached, we receive a 403 FORBIDDEN Exception when we to view the projects tab for the Active Directory Integration

Cause

The reason this happens while changing project is because Active Directory Integration currently does not support "Change Project" feature.
The reason this happens while deleting project is because Active Directory Integration currently does not support deletion of a project before deletion of the resources attached with the Active Directory integration.

Note: If you are on a VRA version >= 8.12.0 then we do prevent the deletion of a project if there is an Active Directory Integration assigned to that project.

Resolution

VMware is aware of this issue and it is being considered for inclusion in a later release. See workaround section below for additional details.

Workaround:
Below are the steps to workaround:

NOTE: Before proceeding make sure to backup of the environment prior to making any changes to DB.

Situation Change Project:

Retrieve and note down the project IDs from the old and new projects by going to `Infrastructure` --> `Projects` and click the project and look at the ID after the `%2F` characters like below:

ssh into VRA instance
run `vracli dev psql` and type `yes` when asked to continue
connect to provisioning-db by executing: `\c provisioning-db`
Run the SQL update below and make sure to replace the `NEW_PROJECT_ID` and `OLD_PROJECT_ID` fields with information retrieved from first point.

SQL UPDATE:

UPDATE ad_integration_project_association set project_id='NEW_PROJECT_ID' WHERE project_id='OLD_PROJECT_ID';

Situation Delete Project:

Retrieve and note down the project IDs from the old and new projects by going to `Infrastructure` --> `Projects` and click the project and look at the ID after the `%2F` characters like below:

ssh into VRA instance
run `vracli dev psql` and type `yes` when asked to continue
connect to provisioning-db by executing: `\c provisioning-db`
Run the SQL update below and make sure to replace the `NEW_PROJECT_ID` and `OLD_PROJECT_NAME` fields with information retrieved from first point.

SQL UPDATE:

UPDATE ad_integration_project_association set project_id='NEW_PROJECT_ID' WHERE project_name='OLD_PROJECT_NAME';

3. Situation Purge All Records and Delete Entire AD Integration
Note: This should only be done in the use case where the Customer wants to disassociate the AD Integration in VRA with the AD Server and the machines in it. It's used when customers have their own solution of managing the AD Machines and no longer rely on the AD Integration and want to delete the integration. Typically customers have moved to other solutions such as using VRO Workflows

ssh into VRA Instance
Run vracli dev psql and type yes when asked to continue
Connect to provisioning-db by executing \c provisioning-db
Run the following SQL to delete records associated with AD Integration:
- DELETE FROM ad_integration_project_association;
- DELETE FROM ad_resource_status;
Go to the UI of the AD Integration and delete the integration.