vCenter Server upgrade pre-validation fails from SDDC Manager due to Unauthorized API errors

Products

• VMware SDDC Manager / VCF Installer

Issue/Introduction

• During the upgrade of vCenter Server to version 9.0.2 initiated via the SDDC Manager, the pre-validation stage fails. The vCenter Server instance appears grayed out in the SDDC Manager UI, preventing the upgrade process from proceeding

• Reviewing the logs (/var/log/vmware/vcf/lcm/lcm-debug.log and /var/log/vmware/vcf/operationsmanager/operationsmanager.log) displays the following error:

com.vmware.vapi.std.errors.Unauthorized: Unauthorized (com.vmware.vapi.std.errors.unauthorized) => { 
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => { 
    id = vapi.security.authorization.invalid, 
    defaultMessage = Unable to authorize user
    ...

• Additionally, the /var/log/vmware/sso/vmware-identity-sts.log on the vCenter Server confirms an authentication failure for the SDDC Manager service account:

ERROR sts[68:tomcat-http--30] [CorId=...] [com.vmware.identity.sts.impl.STSImpl] Throwing InvalidRequestException! Access not authorized!

Environment

VCF 5.x 

VCF 9.x 

 

Cause

The SDDC Manager service account used to communicate with the vCenter Server lacks the required permissions. The account is set to "Read-only" in Global Permissions and is missing from the required SSO groups (CAAdmins and Administrators), which prevents the authorization of API invocations during the pre-validation process

 

Resolution

1. Log in to the vSphere Client as an SSO Administrator (e.g., [email protected]).

2. Navigate to Administration > Single Sign On > Users and Groups.

3. Select the Groups tab.

4. Edit the Administrators and CAAdmins groups, and add the affected SDDC Manager service account ([e-mail]) to both groups.

5. Navigate to Administration > Access Control > Global Permissions.

6. Select the affected service account and update the assigned role to Administrator.

7. Ensure the Propagate to children checkbox is enabled for this permission.

8. Return to the SDDC Manager UI and trigger the vCenter Server upgrade pre-validation task again to confirm the checks complete successfully.

9. Return to the SDDC Manager UI and re-run the vCenter Server upgrade pre-validation task.

Additional Information

• If the issue persists after updating permissions, verify that no external security policies or firewall rules are blocking the service account communication.
• For steps to download the latest software releases or patches, see Download Broadcom products and software.
• To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.