Network refresh using the VMkernel adapters interface in vSphere Client fails with an error "vapi.authz.error.no.user<No username in authn data>"

Products

• VMware vCenter Server

Issue/Introduction

Attempting to refresh networking information for an ESXi host using the vSphere Client Tab <Host> > Configure > Networking > VMKernel Adapters fails with an error message:

A general system error occurred: Error: com.vmware.vapi.std.errors.unauthorized Messages: vapi.authz.error.no.user<No username in authn data>

Environment

• VMware vCenter Server 8.0.x

Cause

This issue occurs when the vpxd solution user account (<vpxd-<machine_ID>@vsphere.local) used by the vCenter Server service (vpxd) to initiate the network refresh does not have sufficient permissions to trigger the action.

Normally the account has full administrator privileges set in the global permissions, which are propagated down to the objects in the vCenter inventory. However, if the user has any other role configured on the vCenter object or further down below in the vCenter inventory, it will overwrite the role defined in the global permissions.

Resolution

To resolve this issue, please remove any roles configured for the vpxd solution user on either the datacenter, cluster or the host itself, which have not been inherited from the global permissions. To do this, go into the permission tab for the specific object and look for any mention of the account "VSPHERE.LOCAL\vpxd-<machine_ID>" where "Defined in" is not set to "Global Permission".

Once you have identified the permission, select it using the radio button at the start of the row, then click the DELETE button to remove it, as shown in the screenshot below:

 

Note: <machine ID> will be different for each vCenter Server. To find the one one specific to your vCenter Server, you can use the following command:

# /usr/lib/vmware-vmafd/bin/vmafd-cli  get-machine-id --server-name localhost