Workspace ONE Access (vIDM) authentication is failing in Aria Operations for Logs (vRLI) with a "FORBIDDEN" error

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

When attempting to configure the Workspace ONE Access (vIDM) integration or when trying to add new Active Directory (AD) users within the Aria Operations for Logs UI, the operations fail.

• The Workspace ONE Access Test Connection may show Succeeded, but the overall integration Status may display DISCONNECTED.

• In the UI, when attempting to add new Active Directory users, the following error is displayed:

  ResourceException: Unexpected HTTP response from Workspace ONE Access instance. :: null Received unexpected response from Workspace ONE Access instance. Domain : <vidm-hostname>, Client ID : <client-id>.

Log Evidence

The following error sequence is captured at /storage/core/loginsight/var/runtime.log:

[com.vmware.loginsight.commons.security.UrlConnectionManager] [Response Code : 403]
[com.vmware.loginsight.aaa.vidm.VIDMConnector] [Could not retrieve Workspace ONE Access version information. hostname:<vidm-hostname>, tenant:. The authorization token is incorrect or the user is not tenant admin and does not have permissions to create oauth2clients. :: {"errors":[{"code":"FORBIDDEN","message":"User is not authorized to perform the task.","parameters":null}],"empty":false} Received unexpected response from Workspace ONE Access instance. Domain : <vidm-hostname>.]

 

Environment

VMware Aria Operations for Logs 8.18.x

Cause

This issue occurs because the account configured for the integration inside Aria Operations for Logs does not possess sufficient privileges within Workspace ONE Access.

During the initialization handshake or when modifying directory user mappings, Aria Operations for Logs attempts to dynamically register or manage OAuth2 clients. If the configured integration account is assigned a standard User role instead of an administrative role, Workspace ONE Access blocks the API request with a 403 FORBIDDEN response.

Resolution

From within the vIDM Identify Manager portal, use the Roles - search bar to search for the specific user or user group. Edit or add the user to a Directory Admin group. After that, reconfigure the Workspace One from the Log Insight - Workspace One UI.

Additional Information

The following steps attempted but did not resolve the issue:

• SSL certificates have been re-validated on both the vRLI and vIDM instances.
• All certificate dates are valid and indicating future dates.
• All vRLI cluster nodes have been rebooted.
• The vIDM appliance(s) have been rebooted.
• Rebuild TrustStore on all nodes.