Password rotation for the Aria Operations for Logs admin account initiated via SDDC Manager fails with message "Failed to update Environment in VMware Aria Suite Lifecycle because of error response"

Products

• VCF Operations

Issue/Introduction

• Initiating a Rotate passwords task towards Aria Operations for Logs "admin" account the subtask fails with below error:
  
  
  
  
• Within the Aria Suite Lifecycle Manager the "Update Password" task towards the Aria Operations for Logs "admin" account fails with Error Code: LCMVRLICONFIG40031
  
  
  The "RETRY" failed even after entering a password that meets all complexity criteria.
• The "/var/log/vrlcm/vmware_vrlcm.log" reports below error:
  
  

  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.d.v.InstallConfigureVRLI]  -- Request body :: VRLIUpdateUserNew(password=KXKXKXKX, unlock=true)
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.d.v.InstallConfigureVRLI]  -- URL formed :: https://<VRLI-FQDN>:9543/api/v1/users/<USER-ID>/password
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.l.u.SettingsHelper]  -- Setting name : proxysetting , Package name : com.vmware.vrealize.lcm.lcops.common.dto.settings.ProxyConfigurationDTO
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.l.u.SettingsHelper]  -- Setting name : proxysetting , Package name : com.vmware.vrealize.lcm.lcops.common.dto.settings.ProxyConfigurationDTO
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.l.u.SettingsHelper]  -- Final Data : {
    "proxyEnabled" : false,
    "hostName" : null,
    "port" : 0,
    "userName" : null,
    "password" : null,
    "proxyEnabledInContentMgmt" : false,
    "noProxyList" : null
  }
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.d.v.r.c.VRLIRestClient]  -- Status code : 500
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.d.v.InstallConfigureVRLI]  -- Return message for VMware Aria Operations for Logs: {}{"errorMessage":"Failed to process request."}
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.d.v.InstallConfigureVRLI]  -- Return status code for VMware Aria Operations for Logs: 500
  ERROR vrlcm[1256] [pool-3-thread-19] [c.v.v.l.p.v.VrliUserUpdateTask]  -- Failed :: VMware Aria Operations for Logs config user update
  INFO vrlcm[1256] [pool-3-thread-19] [c.v.v.l.p.a.s.Task]  -- Injecting task failure event. Error Code : 'LCMVRLICONFIG40031', Retry : 'true', Causing Properties : '{ CAUSE :: vrliUserName === vrliPassword YXYXYXYX vrliEmail ===  }'
  com.vmware.vrealize.lcm.common.exception.GenericSystemException: ERROR
          at com.vmware.vrealize.lcm.plugin.vrli.VrliUserUpdateTask.execute(VrliUserUpdateTask.java:117)
          at com.vmware.vrealize.lcm.automata.core.TaskThread.run(TaskThread.java:62)
          at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(Unknown Source)
          at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(Unknown Source)
          at java.base/java.lang.Thread.run(Unknown Source)

• Also, the "/storage/core/loginsight/var/runtime.log" confirm that the PATCH request is failed
  

  ["application-akka.actor.default-dispatcher-31"/XX.XX.X.XX ERROR] [globals.GlobalErrorHandler] [Unknown error when executing request PATCH /api/v1/users/<USER-ID>/password]
  java.util.concurrent.CompletionException: com.vmware.loginsight.api.providers.ApiProvidersException: Failed to process request.
  at java.util.concurrent.CompletableFuture.encodeThrowable(Unknown Source) ~[?:?]
  at java.util.concurrent.CompletableFuture.completeThrowable(Unknown Source) ~[?:?]
  at java.util.concurrent.CompletableFuture$UniApply.tryFire(Unknown Source) ~[?:?]
  at java.util.concurrent.CompletableFuture.postComplete(Unknown Source) ~[?:?]
  Caused by: com.vmware.loginsight.api.providers.ApiProvidersException: Failed to process request.
  at com.vmware.loginsight.api.providers.rbac.RBACUsersProvider.updatePassword(RBACUsersProvider.java:249) ~[webservice-providers-lib.jar:?]

Environment

Aria Operations for Logs 8.18.x
Aria Suite Lifecycle Manager 8.18.x
VMware SDDC 5.x

Cause

• This issue occurs because Aria Suite Lifecycle utilizes "first-match" logic when querying the user list from the Aria Operations for Logs API.
• When vIDM is integrated, a mirrored admin record (type=VIDM) may appear before the local admin record (type=DEFAULT). Lifecycle mistakenly attempts the password rotation against the external vIDM record, which fails.

Resolution

This issue is addressed  in VMware Aria Suite Lifecycle 8.18 Patch 9 

Workaround:

1. Log in to the Aria Operations for Logs UI as a local administrator.
2. Navigate to Administration > Management > Access Control >> Users and Groups.
3. Temporarily remove the mirrored Workspace ONE Access (vIDM) admin account entry.
4. Return to SDDC Manager and re-run the "Rotate Password" task towards Aria Operations for Logs "admin" account.