Users with administrator role are unable to manage SSO 'Users and Groups' tab - "You have no privileges to view this object"

Products

• VMware vCenter Server

Issue/Introduction

• Administrators attempting to interact with vCenter Single Sign-On (SSO) user accounts, even when assigned the "Administrator" role at the global permissions level, cannot view or manage the "Users and Groups" tab within the Single Sign-On (SSO) configuration domain (typically found under Administration -> Single Sign On -> Users and Groups).
• Affected users receive a "You have no privileges to view this object" error when attempting to access these specific sections, despite being able to perform other administrative tasks across vCenter Server.
• This capability is usually only seen with the default [e-mail] account, leading to confusion about the required permissions.
• This can be seen in several places including Users and Groups and System Configuration.
• The affected user is not listed in the administrators group when running the below command: 
  
  /usr/lib/vmware-vmafd/bin/dir-cli group list --name Administrators

Cause

The SSO group was missing in the Administrators group. While an SSO user or group might have the "Administrator" role assigned in vCenter's global permissions which grants them broad control over vCenter objects (VMs, hosts, clusters), this role does not inherently grant permissions to manage the SSO domain itself.

Resolution

The SSO user account or, more commonly, the SSO group to which the user belongs, must be explicitly added as a member of the built-in "Administrators" group within the relevant vCenter Single Sign-On domain (e.g., vsphere.local).

1. Log in to the vSphere Client using the [e-mail] account or another account that is already a member of the SSO domain's "Administrators" group.
2. Navigate to Menu > Administration.
3. Under Single Sign On, click on Users and Groups.
4. Select the Groups tab.
5. Ensure the correct domain (e.g., vsphere.local) is selected.
6. Find and select the Administrators group.
7. Click Edit (or an equivalent option like "Add Members," depending on the UI version).
8. Add the desired SSO user or SSO group (that already has the vCenter Administrator role) to this "Administrators" group.
9. Save the changes.

Affected users will likely need to log out and log back into the vSphere Client for the new group membership and associated permissions to take effect.

If there is no other administrator account, add the [e-mail] account as follows:

1. Take a backup or virtual machine snapshot of the vCenter Server
2. SSH to the vCenter via root
3. Execute the following ldapmodify command to inject the missing member record back into the directory. Press Enter after typing EOF:
   
   ldapmodify -H ldap://localhost/ -D "cn=Administrator,cn=Users,dc=vsphere,dc=local" -W << EOF
dn: cn=Administrators,cn=Builtin,dc=vsphere,dc=local
changetype: modify
add: member
member: cn=Administrator,cn=Users,dc=vsphere,dc=local
EOF


4. When prompted to enter the LDAP password, type the SSO Administrator([e-mail]) account password. 
   
   Example output:
   modifying entry "cn=Administrators,cn=Builtin,dc=vsphere,dc=local"
   
   
5. Navigate to the affected vCenter UI SSO sections to confirm the user can now access the page.