Cloud Consumption Interface (CCI) resource tiles fail with error "401 UNAUTHORIZED" after install

Products

• VMware Aria Suite

Issue/Introduction

Symptoms: 

• You are attempting to enable CCI in Aria Automation
• The CCI supervisor service is running
• The Local Consumption Interface (LCI) in vCenter is working as intended
• You have configured supervisor regions and all the necessary configuration for the Aria Automation project
• You are able to create a supervisor namespace on each configured region, however - when you click on the created supervisor namespace the following services give a 401 error:
  
  
• Virtual Machine
• Tanzu Kubernetes Grid
• Volume
• Network
• VM Image
• DSM Database
• Moneta Database

Environment

Aria Automation 8.18.1

Cause

The Cloud Consumption Interface (CCI) does not support sAMAccountName (short AD username)

When adding a new directory in vIDM, the admin user has the choice of two directory-search attributes. This choice impacts the format of usernames in the associated on-prem Aria Automation deployment. The possible values are:

• sAMAccountName - usually the user name without a domain, resulting in a short name in VMware Aria Automation, which does not include the domain. This is the default when setting up a new directory.
• userPrincipalName - usually the user name with a domain, resulting in a long or full username in VMware Aria Automation, which includes the domain.

CCI uses the usernames available in the project data to construct the vCenter access lists for the supervisor namespaces it manages. In systems configured with short user names, these project user names are domain-less and vCenter appears to discard them without error during project-sync, leaving users without the ability to access the supervisor namespace that they created from CCI.

The documentation is here: VMware Aria Automation 8.18 Release Notes

Resolution

To resolve this re-create the directory in vIDM using userPrincipalName as the directory-search attribute. 

Then recreate the namespace with the correct account name.