Cases and Tech Support pages fail to load for custom role users due to missing PERMISSION_ALBSERVICESSTATUS

Products

• VMware Avi Load Balancer

Issue/Introduction

• A non-Super User account was created on the VMware Avi Load Balancer Controller.
  
• The user was assigned a custom role with Write permissions for all available GUI objects.
  
• The user was able to log in successfully and access other sections of the Avi UI.
• However, selecting Administration > Support > Cases or Tech Support caused the GUI to remain in a continuous loading state.
  
  

Environment

VMware Avi Load Balancer:
22.1.x
30.1.x
30.2.x
31.1.x
31.2.1, 31.2.2
32.1.1, 32.1.2

Cause

• The Cases and Tech Support pages invoke the /api/albservices/status API before loading.
• The PERMISSION_ALBSERVICESSTATUS permission is not exposed in the Role UI and therefore cannot be assigned to custom roles.
• As a result, the API returns HTTP 403 Forbidden for non-Super User accounts, preventing the Cases and Tech Support pages from loading
  

Resolution

Workaround:

1. Log in to the Avi Controller CLI using an admin account.
2. Grant the PERMISSION_ALBSERVICESSTATUS privilege with write_access to the affected custom role by running the following commands:
   

   > configure role Test_Role
   role> privileges 
   role:privileges> resource permission_albservicesstatus type write_access 
   role:privileges> save 
   role> save 

3. Log in using the affected custom role account and verify that Administration > Support > Cases or Tech Support load successfully.
   

Fix Version:

31.2.3, Refer to the Release Notes for more details.
Future Release: 32.1.3