Error: 403 Forbidden when integrating NSX with VCF Operations using vIDB users

Products

• VMware NSX
• VMware Cloud Foundation
• VCF Operations

Issue/Introduction

When attempting to integrate NSX into VMware Cloud Foundation (VCF) Operations (formerly Aria Operations) using a VMware Identity Broker (vIDB) service account, the integration fails.

• The error message in the UI is: Failed to establish connection to NSX manager due to an incorrect username or password.
• Local accounts (e.g., admin) work correctly for the same integration.
• vIDB users can log in to the NSX Manager UI without issues.
• In the NSX Manager /var/log/proxy/reverse-proxy.log, the following stack trace is observed:
• ERROR NSX 5119 [nsx@4413 comp="nsx-manager" errorCode="MP1" level="ERROR" logger="AuthenticationEventListener" subcomp="http"] Exception in failure Event
org.springframework.security.authentication.ProviderNotFoundException: No AuthenticationProvider found for org.springframework.security.authentication.UsernamePasswordAuthenticationToken

Environment

• VMware Cloud Foundation (VCF) 9.x
• VMware NSX 4.x / 9.x
• VMware Identity Broker (vIDB)
• VMware Cloud Foundation Operations

Cause

This issue occurs because the NSX Manager integration within VCF Operations currently does not support VMware Identity Broker (vIDB) users for authentication.

While NSX supports legacy VMware Identity Manager (vIDM) and local accounts, the current workflow for remote API calls requires a bearer token exchange that is not supported for vIDB users when configured as manual credentials in the NSX Management Pack.

Resolution

To resolve this issue, use a supported credential type for the NSX integration:

1. Use a Local Account: Configure the NSX integration using the local admin account or a custom local user with sufficient permissions (e.g., Enterprise Admin).
2. Legacy vIDM: If your environment still utilizes the legacy VMware Identity Manager (vIDM), those accounts remain supported.

Note for VCF 9.0+: In standard VCF 9.0 deployments, the VCF Adapter is designed to automatically register components like NSX and vCenter, creating internal local service accounts. Manual registration using vIDB users should be avoided.