Error "User session expired" when accessing Aria Operations plugin from VMware Cloud Director UI

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• When using the VMware Advanced Load Balancer address in Aria Operations System Access URL (Administration -> Global Settings -> System Settings), you see 'User session expired' error when accessing Operations Manager plugin from VMware Cloud Director. 
• If you use the Aria Operations node address under System Access URL, the plugin loads fine. 

• From /storage/log/vcops/log/web.log, we see the below entries:

  YYYY-MM-DDT12:27:12,753+0000 WARN  [ajp-nio-127.0.0.1-8009-exec-2] com.vmware.vcops.platform.gemfire.GemfireFunctionExecutor.onServersWithExecTimeout - Function call UserAuthentication.authenticateUser failed :FunctionException: com.vmware.vcops.platform.gemfire.GemfireFunction$MethodInvocationException: AuthException: The tenantId of credential is not matching with the tenantId from session validation response.
  org.apache.geode.cache.execute.FunctionException: com.vmware.vcops.platform.gemfire.GemfireFunction$MethodInvocationException: AuthException: The tenantId of credential is not matching with the tenantId from session validation response.

• "JSESSIONID" value under Browser settings Inspect → Application → Cookies changes with each request when the plugin loads. This behavior indicates the absence of session stickiness.

Environment

Aria Operations 8.18.x 

Cause

When session stickiness is not enabled on the NSX ALB or any other Load Balancer, such as F5 etc, JSESSIONID cookie value on the Operations Manager plugin on VCD is different for each request leading to this issue. 

Resolution

To resolve this issue, create a Persistence Profile with Type set to Client IP Address on the NSX ALB. 

This will help in routing all the API calls from VCD with same subnet to same backend server each time. 

See example:

If other types of Load Balancers are in use, similar configuration steps should be applied, which need to be verified with the respective product teams.