Error: "You don't have permissions to access the HCX system or too many active sessions. Try again after sometime" when loading the HCX plugin from the vSphere Client

Products

• VMware vCenter Server
• VMware HCX

Issue/Introduction

• When attempting to access the HCX plugin from the vSphere Client (particularly after an upgrade to vCenter 8.0.x), the following error dialog is displayed:
  
  

  You don't have permissions to access the HCX system or too many active sessions. Try again after sometime.

• Inspecting /common/logs/admin/web.log on the HCX Manager appliance during requests targeting /hybridity/ap/sessions reveals authentication failures referencing SYSTEM-DOMAIN:
  
  

  Caused by: org.springframework.security.access.AccessDeniedException: Could not assign NSP role based on logged in VCenter user group memberships ["SYSTEM-DOMAIN\\ComponentManager.Administrators", "SYSTEM-DOMAIN\\LicenseService.Administrators", "SYSTEM-DOMAIN\\SystemConfiguration.ReadOnly", "SYSTEM-DOMAIN\\HCX Administrators", "SYSTEM-DOMAIN\\SystemConfiguration.SupportUsers", "SYSTEM-DOMAIN\\__Administrators__", "SYSTEM-DOMAIN\\Everyone", "SYSTEM-DOMAIN\\CAAdmins", "SYSTEM-DOMAIN\\SystemConfiguration.Administrators", "SYSTEM-DOMAIN\\SystemConfiguration.BashShellAdministrators", "SYSTEM-DOMAIN\\__Support_Assistant_Operators__", "SYSTEM-DOMAIN\\Users"].

  
  
  
  
• Reviewing the available identity sources and domains in Single Sign-On (SSO) confirms that both SYSTEM-DOMAIN and vsphere.local are present.
  
  

Environment

VMware vCenter Server: 8.x

VMware HCX 

Cause

This issue occurs due to leftover legacy SSO artifacts remaining in the vCenter Directory Service (VMDIR).

During historical vSphere upgrades (such as migrating from legacy SSO in vSphere 5.1 using SYSTEM-DOMAIN to modern SSO in vSphere 5.5 and above using vsphere.local), obsolete SYSTEM-DOMAIN entries may persist. When HCX attempts to validate user sessions via /hybridity/ap/sessions, the presence of these legacy artifacts disrupts Single Sign-On domain resolution.

Resolution

To resolve this issue, perform the following steps:

1. Verify Identity Sources:

   • Confirm that both SYSTEM-DOMAIN and vsphere.local exist in your Single Sign-On domain list within the vSphere Client.

2. Remove 'SYSTEM-DOMAIN' references from Identity Provider

   • Audit and clean up the Identity Provider configurations to eliminate all legacy references to SYSTEM-DOMAIN.
     
     
   • Reference KB : Fix legacy SYSTEM-DOMAIN artifacts in vCenter Servers upgraded from vCenter Server 5.1+

3. Validate Access:

   • Clear your web browser session cache and cookies, start a new browser session, login back into the vSphere Client, and access the HCX plugin to verify functionality.