Error Assigning License to vCenter After Upgrading to VCF 9.1: "This License Could Not Be Assigned to the Selected vCenter System"

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• After upgrading to VMware Cloud Foundation (VCF) 9.1, assigning a license to the vCenter Server system fails with error : "Licenses could not be assigned to vCenters."
• The VCF Operations UI displays the following error: This License Could Not Be Assigned to the Selected vCenter System 
• This license could not be assigned to the selected vCenter System. Check the network connection from the selected vCenter system to the license server and try again. Please refer to KB article 424533 for more information.

• /var/log/vmware/certificatemanagement/certificatemanagement-svcs.log reports below errors

  YYYY-MM-DDTHH:MM:SS.520Z ERROR CertificateManagement 32 [vc@4413 threadName="tomcat-exec-7" logger="com.vmware.certificatemanagement.vapi. impl. setup. AuthzPermiss ionValidator"] User VSPHERE.LOCAL\group_name who belongs to groups [vsphere. local\Everyone, vsphere. local\ReadOnlyUserGroup, vsphere. local\MGMT_NoAccess, vsphere. local\LicenseService. Administrators, vsphere. local \SuperUserGroup] has no required privileges [CertificateManagement.Manage, CertificateManagement. Administer] to invoke API com.vmware.vcenter.certificate_management. vcenter. trusted_root_chains.create

• From VCF OPS logs/adapters/ManagementAdapter/ManagementAdapter.log:

  YYYY-MM-DDTHH:MM:SS.000Z ERROR ManagementAdapter [ops@4413 threadId="00000" threadName="TasksManager-TaskHandler-0000" instanceId="000"] [(233) com.vmware.adapter.management.components.licensing.vcf.task.LicenseServerCertificateTaskHandler.updateLicenseServerCertificate] - Failure to propagate LS Cert to VC.
com.vmware.vapi.std.errors.Unauthorized: Unauthorized (com.vmware.vapi.std.errors.unauthorized) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = com.vmware.vapi.authorization.permission.denied,
    defaultMessage = Insufficient privileges. Contact the Administrator to get the required privileges.,
    args = [],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = UNAUTHORIZED,
    challenge = <null>
}

Environment

VMware Cloud Foundation 9.1

Cause

The user or group (such as LicenseService.Administrators) attempting to assign the license lacks the required CertificateManagement.Manage or CertificateManagement.Administer global permissions. These privileges are necessary to invoke the trusted_root_chains.create API, which is required during the vCenter licensing workflow.

Resolution

To resolve this issue, assign the missing certificate management privileges to the affected user or group under Global Permissions.

• Log in to the vSphere Client using a predefined administrator account (e.g., [e-mail]).

• Navigate to Administration > Access Control > Global Permissions.

• Locate the user or group encountering the error (e.g., VCFOpsLicensingGroups(custom group)).

• Select the user or group and click the Edit (pencil) icon to modify the assigned role(i.e LicenseAdministratorsRole), or create a custom role that explicitly  includes the CertificateManagement.Manage and CertificateManagement.Administer privileges and assign it to the group. Make sure Global.Licenses is also selected

• Ensure the Propagate to children checkbox is selected.

• Created this Global Permission - LicenseServerAdministrators with role LicenseAdministratorsRole

• Click OK to save the changes.

• Log out and log back in with the affected user account, then re-attempt the license assignment.

 

Additional Information

If license assignment issues persist when authenticating with the [e-mail] account configured in the VCF Operations vCenter adapter integration, further diagnostic investigation is required. Please open a support request by following the instructions in Creating and Managing Broadcom Support Cases and reference KB 443480.