Modify VAMI Access Settings for Newly Created SSO Accounts

Products

• VMware vCenter Server

Issue/Introduction

When logging into the vCenter Server Appliance Management Interface (VAMI) using a newly created Single Sign-On (SSO) account or an Active Directory (AD) user account, users experience permission-related errors.

Symptoms: 

• Unable to modify VAMI access settings (e.g., SSH Login, Bash Shell).
• "Unable to authorize user" error message under access settings:

• "Unknown" health status or missing historical data import status in VAMI summary:

Environment

vCenter Server 7.x
vCenter Server 8.x

Cause

The VAMI authorization module relies on its own authentication based on local privileges. Adding a user to vCenter SSO with Global Permissions and the Administrator role does not grant the necessary privileges for VAMI operations, resulting in insufficient permissions to access or modify the local appliance configuration.

Resolution

Follow the below steps to add the newly created account into the built-in groups "SystemConfiguration.Administrators" & "SystemConfiguration.BashShellAdministrators" : 

1. Log in to the vSphere Client as an administrator.
2. Navigate to Administration > Single Sign On > Users and Groups.
3. Select the Groups tab.
4. To grant privileges to view stats and perform general VAMI operations, edit the SystemConfiguration.Administrators group and add your AD user, service account, or group.
5. To grant complete privileges to access and modify the local configuration (such as Bash Shell), locate the SystemConfiguration.BashShellAdministrators group, edit the group membership, and add the account. This group has the appropriate privileges to access and modify the appliance configuration  (but not for vCenter-managed objects).

Additionally, the AD user or group could also be added to the vsphere.local/Administrators group, which, by default is a member of the SystemConfiguration.Administrators group, however, this is not considered a best practice from a security perspective.

Additional Information

To audit or list existing local accounts with access to VAMI, run this shell command via SSH to vCenter: localaccounts.user.list

For more information about groups within vCenter SSO domain, refer: Groups in the vCenter Single Sign-On Domain