ERROR "The provided username/password or token is not valid. Please try again." when attempting to generate a token via API call

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

You are experiencing API connectivity issues when attempting to retrieve an access token for Aria Operations.

• This results in the following error message:
  Exception error calling <FQDN_of_Operations_VIP> The provided username/password or token is not valid. Please try again.
• This issue persists even though the authentication source is configured in Aria Operations.
• Verification attempts to generate an access token using the /suite-api with the same username and authSource fail with the same error.
• The logs confirm an authentication failure, which can be seen in the analytics.audit-<id>.log:
  
  UserId : n/a, UserName : <username>, AuthSource : <authsource>, Session : n/a, ClientIP : ###.###.###.###, Category : AUTHENTICATION_LOGIN - Log in failed. Origin: "REST_API". Due to the following error: "Invalid credentials".

Environment

Aria Operations 8.18.x

Cause

The cause of the authentication failure is a mismatch between the authSource provided in the API call and the Source Display Name configured for the corresponding authentication source in Aria Operations.

This typically occurs when multiple teams access the API using different names for the authentication source. The authSource parameter used in the API request must match the Source Display Name of an authentication source configured in Aria Operations and the user account being used must be imported for this authentication source. 

Resolution

To resolve this issue, you must ensure that the authentication sources are configured to include all required Source Display Names that match what users are providing for the authSource in their API calls, and that the required users are imported under those sources.

1. Navigate to Administration > Control Panel > Authentication Sources in VMware Aria Operations.

2. Verify that an authentication source exists for every unique Source Display Name that is being used as the authSource in the API calls.

3. Navigate to Administration > Control Panel > Access Control > User Accounts.

4. Import the required user(s) from Import from Source using each applicable authentication source to ensure they are available under all necessary Source Display Names.

Additional Information

Getting Started with the API

Authentication Sources

Import User Accounts From Source