Identity Broker Precheck fails with "VC user permission check" in VCF Operations

Products

• VCF Operations

Issue/Introduction

You observe that the Identity Broker fails on the VC user permission precheck in VCF Operations.

• Under VIDB Automation Violations, the VC user permission check has a status of Failed.
  
  
• The Result Description shows the following:
  
  Required privileges [Authorization.ModifyPermissions, Cns.Searchable, Global.ManageCustomFields, ServiceAccount.ManageAccount, ServiceAccount.Administer, Global.SetCustomField, Authorization.ModifyRoles, ServiceAccount.ManageAccount,ServiceAccount.ManagePassword]




• This failure occurs even if the service account used for the vCenter Integration in VCF Operations is in a group with the Global Administrator role in vCenter as well as the local Administrator group.

Environment

• VCF Operations 9.0.x
• VCF Identity Broker 9.0.x
• vCenter 9.x

Cause

The precheck validation fails because the service account permissions are granted at the group level instead of being assigned directly in vCenter. The validation mechanism does not properly detect privileges inherited through group membership.

Resolution

Method 1: Assign Permissions Directly

Add the user account permissions directly in vCenter with the required privileges. You can view the required privileges to deploy the Identity Broker in the Installing VCF Identity Broker documentation.

Method 2: Ignore the Precheck

If you are certain the service account has the proper permissions via its group membership, you can safely ignore the precheck failure and proceed.

Additional Information

Using vCenter Global Permissions