Active Directory account receives a "no permissions" error when logging into vCenter

Products

• VMware vCenter Server

Issue/Introduction

Domain user is unable to log in to the vSphere Client

All other users in the group are able to log into the vCenter

On the vCenter server, /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log:

[INFO ] agw-token-####              ##### ###### ##### com.vmware.vim.sso.client.impl.SecurityTokenServiceImpl           Successfully acquired token for user: {Name: User, Domain: domain
[ERROR] linkedVcGroup-pool-7280      ##### ##### ##### com.vmware.vise.util.concurrent.ExecutorUtil                     
 A task crashed: com.vmware.vise.vim.commons.vcservice.impl.LinkedVcGroupImpl$1@5158ff0f java.util.concurrent.ExecutionException: (vim.fault.NoPermission) {
   faultCause = null,
   faultMessage = null,
   object = ManagedObjectReference: type = Folder, value = group-d1, serverGuid = #####-###-###-##-######,
   privilegeId = System.View,
   missingPrivileges = (vim.fault.EntityPrivileges) [
      (vim.fault.EntityPrivileges) {
         dynamicType = null,
         dynamicProperty = null,
         entity = ManagedObjectReference: type = Folder, value = group-d1, serverGuid = #####-##-##-###-######,
         privilegeIds = (STRING) [
            System.View
         ]
      }
   ]
}
        at java.util.concurrent.FutureTask.report(FutureTask.java:122)
        at java.util.concurrent.FutureTask.get(FutureTask.java:206)
Caused by: com.vmware.vim.binding.vim.fault.NoPermission: Permission to perform this operation was denied.

[INFO ] vim-authentication-pool-#### ##### ##### ##### com.vmware.vise.vim.commons.vcservice.impl.LinkedVcGroupImpl      VC Login results:
Failed VCs: []
[ERROR] vim-authentication-pool-#### ###### ###### ##### com.vmware.vsphere.client.security.VimAuthenticationHandler       
Connection failure to vc https://vcfqdn:443/sdk com.vmware.vim.binding.vim.fault.NoPermission: Permission to perform this operation was denied.

 

Environment

vCenter 8.x

Cause

This may be due to an issue with the AD user account.

Resolution

The customer should work with their AD team to verify the health of the user account.  Recreate the account if necessary.