Access denied
You are not authorized to perform this operation. Please check your permissions.
/var/log/nsx-audit.log
, it is observed that the Granted Authorities display empty AD groups to which the AD user belongs. The AD user is a member of an AD nested group. Please refer to the example log excerpt below.<###>1 YYYY-MM-DDTHH:MM:SS.SSSZ <NSX Manager FQDN> NSX 3322 SYSTEM [nsx@6876 audit="true" comp="nsx-manager" level="INFO" subcomp="http"] UserName="LdapUserDetailsImpl [Dn=CN=#####.,CN=Users,DC=#####,DC=#####; Username=<username>@<AD Domain>; Password=[PROTECTED]; Enabled=true; AccountNonExpired=true; CredentialsNonExpired=true; AccountNonLocked=true; Granted Authorities=[]]@127.0.0.1", ModuleName="ACCESS_CONTROL", Operation="LOGOUT", Operation status="success"
VMware NSX 4.x
This issue occurred due to a defect in the upgrade logic, which disables the resolve nested groups function.
This is a known issue affecting VMware NSX 4.2.0. There is currently no resolution.
Workaround:
Option 1:
Delete the LDAP config in the System -> User Management -> Authentication Providers UI and add it again. There is no need to re-add the groups, as long as the same name for the LDAP config is used.
Option 2:
Follow the steps below to use API to set the "resolve_nested_groups" flag to true
"id"
and "resolve_nested_group"
fieldsGET https://<NSX_MGR_IP>/policy/api/v1/aaa/ldap-identity-sources/
"resolve_nested_group"
field is set to false
in the outputRun GET https://<NSX_MGR_IP>/policy/api/v1/aaa/ldap-identity-sources/<id>/
and replace <id> with the info identified in previous step
Copy the output and modified "resolve_nested_groups"
to true. This modified output will be used in the body of the PUT request in step 7
"resolve_nested_groups"
flag to true against the NSX Manager configured AD.PUT https://<NSX_MGR_IP>
/policy/api/v1/aaa/ldap-identity-sources/<id>/