VDI VMs deployment failing through Citrix, Error : Either the account is not granted sufficient privilege or disabled or username/password is incorrect.

Products

• VMware vCenter Server

Issue/Introduction

• VDI VM deployment failing through Citrix with error:

    Either the account is not granted sufficient privilege or disabled or username/password is incorrect.

• Same Service account successfully deploys VM through vCenter UI.
  
  
• User account is assigned custom role created as per Citrix requirement:
  
  
• Assigning "Global Permission" along with using "Custom Role" to the user allows VM deployment.
  
  
• Entries from /var/log/vmware/vpxd.log (trivia enabled):
  
  Name: 'NoPermissionFault'
Error,"VMwareRunQueue-caught exception PluginUtilities.Exceptions.NotAuthorizedForOperationException: Either the account is not granted sufficient privilege or disabled or username/password is incorrect. ---> PluginUtilities.Exceptions.WrappedPluginException: Permission to perform this operation was denied.
• Logs from citrix controller :
  
  "VmwareVmManager::CreateNetworkAdapter: Couldn't find config.distributedVirtualSwitch for DVP 'dvportgroup-#####'"
"VmwareVmManager::CreateNetworkAdapter: couldn't get the config for the switch reference, will use default Network BackingInfo"switch

Environment

vCenter Server 8.x

Cause

The user account used for the VC and Citrix hosting connection lacks privileges on the Distributed Switch. This is because permissions were assigned individually to each object, excluding the Distributed Switch, instead of being assigned at the datacenter level with "propagate to children" selected.

Resolution

Assign the appropriate permissions across all objects to ensure successful VM deployment. You can find the required permissions for the VDI deployment user account here: https://docs.citrix.com/en-us/citrix-daas/install-configure/connections/connection-vmware-virtualization-environments.html.

Note: To grant user-specific permissions, associate them with the respective role at the data center level (at minimum) with the "Propagate to children" option selected.