NSX Login Fails with MP403 Error via Embedded UI Plugin Due to Compute Manager Registration Privilege Issues

Products

• VMware NSX

Issue/Introduction

When attempting to access or authenticate through the embedded NSX UI plugin inside the vSphere Client, logins fail with an MP403 error.

Review of the NSX Manager cm-inventory.log displays log traces indicating insufficient privileges for the service account handling extension lifecycle operations:

_vrni_p@<SECRETS> user has no permission to perform unregister extension operation for cm <HOSTNAME>. Please change permissions and try again or try with another user.

• Authentication failure when interacting with the Compute Manager within NSX.

• Inability to utilize or log into the embedded NSX plugin directly from the vSphere Client interface.

var/log/syslog
[nsx@6876 comp="nsx-manager" errorCode="MP403" level="ERROR" subcomp="http"] Not authenticated Full authentication is required to access this resource

[nsx@6876 comp="nsx-manager" errorCode="MP403" level="ERROR" subcomp="http"] Not authenticated Full authentication is required to access this resource

 

Environment

VMware Cloud Foundation (VCF) / vSphere Foundation (VVF) / NSX Manager

Cause

The Compute Manager registration in NSX Manager was configured using a specialized service account (such as _vrni_p@<REDACTED_SECRETS>), which is intended for Aria Operations for Networks/vRNI telemetry integrations. This service account lacks the administrative Single Sign-On (SSO) permissions required by vCenter Server to manage, unregister, or execute lifecycle extension operations.

Resolution

To resolve the authentication failure, update the Compute Manager registration credentials to an identity possessing full administrative privileges within the vSphere SSO domain:

1. Log into the NSX Manager UI using an administrator account.

2. Navigate to System > Fabric > Compute Managers.

3. Select the affected Compute Manager (e.g., <REDACTED_HOSTNAME>) and click Edit.

4. Locate the Credentials section.

5. Modify the configuration to replace the restricted service account with a fully privileged user account (e.g., [e-mail]).

6. Save the settings and monitor the status until the Compute Manager connection displays as Registered / Up.

7. Log out of the vSphere Client, clear browser caches/cookies if required, and log back in to re-initialize the embedded NSX plugin token context.

Additional Information

For further administrative permissions specifications and Compute Manager operational guidelines, refer to the Broadcom TechDocs Portal.