LDAP/AD Users Unable to Log Into Aria Operations

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Some or all AD users are unable to log in to VCF Operations due to a permissions-related error message. 

Environment

VCF Operations 

Cause

LDAP group import is not detecting the affected users in the group to which their role is assigned. The group and users appear separately, but the group membership is not correctly listed. This is due to an LDAP-side configuration that prevents the affected user's or users' group membership from being imported when the user is queried. 

The LDAP group can be queried using the following command; 

• ldapsearch -x -H ldap://<AD_Domain> -b "OU=<Example_OU> ,DC=<Example_DC>" 'CN=<Group_Name>' -D <LDAP_Service_Account_For_Aria_Link> -w "${PASSWORD}"  '*' '+' | tee ldapsearch_<Group_Name>_group

 

Verification Steps: SSH into the primary node and run the following command against an affected user. If this issue is present in the environment, there will be no "Member Of" section listed: 

• ldapsearch -x -H ldap://<ad_domain> -b "OU=<ExampleOU>, DC=<Example_DC>" 'CN=<User>' -D <LDAP_Service_Account_For_Aria_Link> -w "${PASSWORD}" memberOf | tee ldapsearch_<User>_user_memberOf

Resolution

Assign roles directly to the affected users as a workaround while the LDAP configuration is reviewed: Roles and Privileges in VMware Aria Operations

Resolution:

1. Log in to the VMware Aria Operations UI as an administrator.
2. Navigate to Administration > Access Control > User Accounts.
3. Manually assign the required group role directly to the affected users.
4. Contact the LDAP or Active Directory administrator to ensure the service account has permission to search the specific Organizational Units (OUs) where the users reside.