Error "Unable to Authenticate" or "The resource was not found on this server" while accessing Aria Operations Plugin in VCD Tenant UI

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• Users attempting to access the Aria Operations Plugin via the VCD Tenant UI encounter "Unable to authenticate" or "The resource was not found on this server" errors, preventing them from accessing the plugin functionality.

Environment

• VMware Aria Operations 8.x

• VMware Cloud Director 10.x

• NSX Advanced Load Balancer (ALB)

Cause

• The issue occurs because a data script configured within the NSX ALB (AVI LB) that filters cookies sent from VCD.

• This filtering prevents the necessary authentication and communication between VCD and Aria Operations, leading to the operations plugin access errors.

Resolution

• Upgrade VCD MP: Ensure the VCD Management Pack is upgraded to the latest compatible version.

• Verify Network Connectivity: Confirm that VCD cells can successfully ping and establish a curl connection to Aria Operations using both IP/FQDN (curl -v telnet://AriaOpsIPorFQDN:443).

• Validate System Access URL: In Aria Operations, verify the System Access URL is configured correctly (using the NAT FQDN/IP if NAT is configured).

• Inspect Developer Tools: Use the browser's developer tools (Network tab) to identify specific errors (e.g., 500 Internal Server Error) when accessing the plugin via the VCD Tenant portal.

• Test Direct VCD Cell Access: Attempt accessing Operations Plugin using the primary cell address (FQDN/IP) to isolate VCD load balancer issues and accessing operations plugin via a VCD cell should work as shown below.

• Review NSX ALB Configuration: Examine the NSX ALB (AVI LB) configuration for any data scripts or policies that might be filtering or modifying HTTP requests and cookies. 

• Update Correct Data Script Configuration (Resolution): Verify and compare the current Data Script configuration settings with the required configuration shown below and update the correct data script.
  
  

  -- HTTP_REQUEST
  -- get cookies
  cookies, count = avi.http.get_cookie_names()
  avi.vs.log("cookies_count_before=" .. count)
  -- if cookie(s) exists, validate cookie(s) name
  if count >= 1 then
   for cookie_num= 1, #cookies do
     -- only keep cookies: vcloud_session_id, vcloud_jwt, sso-preferred, sso_redirect_org, xxxxx.redirectTo, xxxxx.state and Operations Manager plugin cookies(JSESSIONID, rstd)
     cookie_name = cookies[cookie_num]
     if cookie_name == "vcloud_session_id" or cookie_name == "vcloud_jwt" or cookie_name == "sso-preferred" or
  cookie_name == "sso_redirect_org" or cookie_name == "JSESSIONID" or cookie_name == "rstd" then
       avi.vs.log("keep_cookie=" .. cookie_name)
     elseif string.endswith(cookie_name, ".redirectTo") or string.endswith(cookie_name, ".state") then
       avi.vs.log("keep_cookie=" .. cookie_name)
     else
       -- avi.vs.log("delete_cookie=" .. cookie_name) -- not logging this because log gets truncated
       avi.http.remove_cookie(cookie_name)
     end
   end
  end
  -- get cookies
  cookies, count = avi.http.get_cookie_names()
  avi.vs.log("cookies_count_after=" .. count)

• Disable Data Script (Workaround): Disable the data script that was found to be filtering cookies in the NSX ALB policy.

• Re-test Plugin Access: Verify that the Aria Operations Plugin loads correctly from the VCD Tenant UI (while using VCD Load Balancer) after disabling the script.

Additional Information

• Ensure that the VCD MP version is compatible with the Aria Operations and VCD versions.

• NAT configurations can introduce complexities; carefully verify all network paths.

• Load balancer configurations, especially data scripts, can significantly impact application behavior.

• It is important to test with direct VCD cell access to isolate LB issues.

• Inspect element network tabs are very useful for troubleshooting web-based issues.