Error "This operation is denied" when accessing a vApp using a custom view-only role in VMware Cloud Director

Products

• VMware Cloud Director

Issue/Introduction

 

• A user assigned to a custom role designed for view-only access to vApps can view individual Virtual Machines (VMs) without issues.

• However, when the user attempts to access or view the parent vApp, the action fails with the following error message:

"This operation is denied"

• /opt/vmware/cloud-director/logs reports the following error:

pool-jetty-624507         | OperationsManagerImpl          | Operation denied, required but missing operations:
[GET_VIM_NETWORT_INFO]
Operations not in users context. | requestId=UI-########-####-####-####-############-####-##-########-####-####-####-############,request=GET https://vcloud.example.com/api/admin/org/######-####-####-####-############/associations,

 

Environment

VMware Cloud Director 10.6.1

Cause

This issue occurs when the custom role lacks specific, underlying global rights required by the VMware Cloud Director UI to properly map and display the vApp infrastructure components.

Even if the role has basic vApp viewing rights, it will fail to render the vApp view if it cannot implicitly view the associated network providers and vCenter server endpoints.

Resolution

To resolve this issue, you must append the missing infrastructure visibility rights to the custom role.

1. Log in to the VMware Cloud Director Provider Portal as an Administrator.

2. Navigate to Administration > Roles.

3. Select and edit the affected Custom Role.

4. Ensure the following permissions are explicitly enabled:

   • Provider Network > View Provider Network

   • View: vCenter Server

5. Save the changes.

6. Have the user log out and log back in for the new rights to take effect.