Error: Permission to perform this operation was denied during vCenter snapshot operations

Products

• VMware vCenter Server

Issue/Introduction

• Backup jobs (e.g., Cohesity) fail with the following error: type: kVSphereError error_msg: "SOAP 1.1 fault |"|":ServerFaultCode[no subcode] |"Permission to perform this operation was denied.\\" Detail: vm-#### VirtualMachine.State.CreateSnapshot"
• The option to manually create snapshots is grayed out in the vSphere Client.
• The service account (e.g., ####\svccohesity) encounters these errors despite having explicit global permissions granted.
• Authentication is successful, but authorization for snapshot tasks is rejected.
• This issue occurs after decommissioning and replacing Active Directory (AD) domain controllers or re-adding an identity source.

Environment

VMware vCenter Server 8.x

Cause

The issue occurs because of a mismatch between the domain alias used for existing permissions in the vCenter database (VCDB) and the new identity source configuration. When an identity source is removed and re-added, the user and group permissions in the vpx_access table remain tied to the old domain identifier/alias and do not automatically map to the new configuration.

Resolution

To resolve the issue, re-map the permissions to the new identity source using the fixalias.py script .

1. Take an offline snapshot of the vCenter Server Appliance (VCSA).
2. Connect to the VCSA via SSH as the root user.
3. Stop the vpxd service:
    

   service-control --stop vmware-vpxd

4. Run the following command to confirm the current principals in the database:
    

   /opt/vmware/vpostgres/current/bin/psql -U postgres VCDB -c "select * from vpx_access;"

   Example output:

     id  |          principal           |  role_id   | entity_id | flag | surr_key |                 uuid
   ------+------------------------------+------------+-----------+------+----------+--------------------------------------
       1 | VSPHERE.LOCAL\Administrator  |         -1 |         1 |    1 |        1 | 4a93131d-####-486c-####-2681fd413755
    6665 | VSPHERE.LOCAL\Administrators | 202##12580 |     19019 |    2 |       85 | f2f7b07e-####-429f-####-9cdc536f1835
    6666 | VSPHERE.LOCAL\vCLSAdmin      | 202##12580 |     19019 |    2 |       86 | 49835e8b-####-465b-####-7691875181af
      31 | VSPHERE.LOCAL\SDDCAdmins     |         -1 |         1 |    3 |        6 | b2868696-####-41da-####-464138dc2472
      27 | VSPHERE.LOCAL\Administrators | 202##12580 |         8 |    3 |        2 | fc4a6446-####-4bb2-####-50e334158c4f
      28 | VSPHERE.LOCAL\vCLSAdmin      | 202##12580 |         8 |    3 |        3 | f0f7b8fe-####-4a8b-####-ec0f8c561c6f
    6663 | VSPHERE.LOCAL\Administrators | 202##12580 |     19016 |    2 |       83 | e82de75e-####-40ff-####-0036c14c6440
    6664 | VSPHERE.LOCAL\vCLSAdmin      | 202##12580 |     19016 |    2 |       84 | 76a8c5d1-####-486b-####-4cf65a9266d9

5. Execute the script the vCenter shell:
    

   python fixalias.py

6. Provide the correct ALIAS/DOMAIN information when prompted to normalize the permissions.
   • Example

     Do you want to proceed with normalizing the permissions? (Y/N): Y
     Enter the ALIAS (or DOMAIN) to convert: EXAMPLE
     Enter the NEW ALIAS (or DOMAIN) to convert to: example.com

      
   • Note: The Domain/Alias are case sensitive when making the change (e.g., "primary" is different than "PRIMARY"). If is listed as lowercase, it will not be found by the script if using uppercase. For example, it will allow for changing from lower case to uppercase of same principle (Domain/Alias). Logging into the vSphere client using with upper or lower case of alias works, the UI does not check what the case of text is in the VCDB table.
7. Restart the vpxd service:
    

   service-control --start vmware-vpxd

 

Additional Information

Ref KB: Fix AD Domain alias for ADFS via script