Error: "The user account does not have enough privilege to perform this operation" when configuring Identity and Access in VCF Operations.

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• In VCF Operations 9.x, administrators may encounter a privilege error when attempting to configure Identity and Access (LDAP/SSO) within the Fleet Management portal. This occurs when the integration adapter lacks the necessary permissions to synchronize licensing and identity metadata.

Symptoms 

• When configuring the Identity Broker (vIDB) under Fleet Management, the following error is displayed in the VCF Operations UI: 

The user account does not have enough privilege to perform this operation.

• Log entries on the VCF Operations appliance confirm the unauthorized state:
  • In /storage/log/vcops/log/vcfops-bridge.log:
    

    YYYY-MM-DDTHH:MM:SS INFO vcfops-bridge #### [ops@4413 threadId="####"] [com.vmware.vcops.bridge.server.vidb.vcf.VCFInstanceHelper.isVcSupportedVcVersion] - Normalized vc version: 9.0.2.0.########
    YYYY-MM-DDTHH:MM:SS WARN vcfops-bridge #### [ops@4413 threadId="####"] [com.vmware.vcops.bridge.server.vidb.api.impl.IdentityProviderApi.getIdpByVidbResourceId] - Failed to get VIDB for ####. IDP deleted or does not exist

  • In /storage/log/vcops/log/adapters/ManagementAdapter/ManagementAdapter.log:
    

    YYYY-MM-DDTHH:MM:SS ERROR ManagementAdapter #### [ops@4413 threadId="####"] [(####) com.vmware.adapter.management.components.licensing.vcf.E.C.A] - Unable to find the user privileges: [Global.Licenses]
    YYYY-MM-DDTHH:MM:SS ERROR ManagementAdapter #### [ops@4413 threadId="####"] [(####) com.vmware.adapter.management.components.licensing.vcf.G.A.C] - The configured User account for the VC endpoint #### is missing the required permission Global.Licenses. License collection will not be performed.

Environment

• VMware Cloud Foundation (VCF) Operations 9.0.x
• VCF Fleet Management 9.x

Cause

The service account configured for the VCF Instance Adapter in VCF Operations lacks the mandatory Global.Licenses privilege.

VCF Operations 9.x requires this privilege to synchronize identity metadata. Without it, the adapter cannot validate the licensing state, causing the Fleet Management API to reject LDAP configuration requests as USER_UNAUTHORIZED.

Resolution

To resolve the permission sync issue in existing deployments, repair the VCF Adapter integration using the steps below.

1. Update Adapter Credentials in VCF Operations:
   1. Log in to the VCF Operations UI as admin.
   2. Navigate to Administration > Integrations.
   3. Locate the VMware Cloud Foundation Adapter.
   4. Click Edit and update the credentials to use the primary SSO administrator account (e.g., [e-mail]).
   5. Click Validate Connection, accept any certificates, and click Save.
   6. Verify on the Accounts tab that the adapter status is Collecting.
      
      
2. Complete Identity and Access Configuration:
   1. Navigate to Identity & Access > VCF Instances.
   2. Select your VCF instance and choose the Identity Broker (embedded) deployment mode.
   3. Proceed through the wizard to configure your Active Directory Identity Provider details.
   4. Click Finish Setup and verify the configuration.