VAMI logins failing after breaking ELM mode using domain repoint

Products

• VMware vCenter Server

Issue/Introduction

vCenter was recently removed from ELM using domain repoint as described in KB https://knowledge.broadcom.com/external/article/370062

VAMI login with domain users is possible but no functionality works and metrics don't display

Domain users are configured as members of the SSO Administrators group

SSO administrator user and vCenter root user are able to use the VAMI as normal

Environment

vCenter 8.0x

Cause

On 8.0 onwards the VAMI allows login from any user associated with the vCenter but limits functionality based on the default SSO group membership.

Default SSO groups with the preface SystemConfiguration manage the permission set for users as described in Groups in vCenter Single Sign On Domain doc 

By default, the Administrators group is a member of SystemConfiguration.Administrators giving administration rights to users in the Administrators group on the VAMI - however after a domain repoint, the Administrators group may not be a member

Resolution

  Re-add the Administrators group to the SystemConfiguration.Administrators SSO group in the vSphere UI:

>Login to vSphere UI as SSO administrator

>Navigate to Administration -> Single Sign On -> Users and Groups -> Groups and click into SystemConfiguration.Administrators

>Select Add and add the Administrators group from the SSO domain

>Save the changes and then attempt login with the desired user that's added as a member of the Administrators group