Alarms for Dedicated user xxx@#####.com with login failures randomly in VMware Aria operations.

Products

• VMware NSX

Issue/Introduction

User not able to create a session based authentication to access the NSX details and we have alarms on the VMware Aria operations. 

 

NSX manager log suggesting a failure with code "403"

less /var/log/proxy/envoy_access_log.txt.1

[2024-05-01T19:24:08.689Z] <nsx-manager-ip><source_ip> "POST" "/api/session/create" "HTTP/1.1" 403 UAEX 64 109 810 - "<nsx-manager-ip>" "Apache-HttpClient/4.5.13 (Java/11.0.14)" "xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "####.com" "-"
[2024-05-01T19:24:08.621Z] <nsx-manager-ip><source_ip> "POST" "/api/session/create" "HTTP/1.1" 403 UAEX 64 109 828 - "nsx-manager-ip" "Apache-HttpClient/4.5.13 (Java/11.0.14)" ""xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "#####.com" "-"
[2024-05-01T19:24:08.588Z] <nsx-manager-ip><source_ip> "POST" "/api/session/create" "HTTP/1.1" 403 UAEX 64 109 786 - "nsx-manager-ip" "Apache-HttpClient/4.5.13 (Java/11.0.14)" ""xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "#####.com" "-"
[2024-05-01T19:24:08.497Z] <nsx-manager-ip><source_ip> "POST" "/api/session/create" "HTTP/1.1" 403 UAEX 64 109 743 - "nsx-manager-ip" "Apache-HttpClient/4.5.13 (Java/11.0.14)" ""xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx" "#####.com" "-"

Environment

VMware NSX 

VMware Aria Operations

Cause

403: The client does not have sufficient privileges to execute the request.

Reference doc https://developer.broadcom.com/xapis/nsx-t-data-center-rest-api/4.2.3/all_errors.html 

Resolution

If the user has Auditor role, remove the Auditor and use Security Admin role to create the session.