Error 403 when accessing VCF Operations Orchestrator from Provider Consumption Org in VCF Automation 9.x

Products

• VCF Automation

Issue/Introduction

• When attempting to access the embedded Orchestrator via VCF Automation 9.x GUI Infrastructure > Organizations > Provider Consumption Org > LAUNCH ORGANIZATION PORTAL > Orchestrate , the interface fails to load and displays a generic "403, OK" error without additional details.

• vco-server-app log files has the below error message :

  INFO vco [host='vco-app-0' thread='vcoSystemTaskScheduler-#' user='service-account-vro-gateway-serviceaccount' org=
  'System' trace=''] {} org.bouncycastle.jsse.provider.ProvTlsClient - [client #### @###] disconnected from <VCFA_FQDN>:443
  ERROR vco [host='vco-app-0' thread='https-jsse-nio-8280-exec-589' user='-' org='-' trace='-'] {} com.vmware.o11n.security.csp.web.FilterChainExceptionHandler - Spring Security Filter Chain Exception.
  com.vmware.o11n.security.csp.OrgIdMismatchException: Logins are restricted to the default for this VCF Operations Orchestrator organization.

Environment

VCF Automation 9.0.x

Resolution

 To resolve this issue, reinitialize the Orchestrator service by restarting the vco-app pods :

1.  Log in to the VCF Automation 9.0.x appliance via SSH as vmware-system-user.
2. Switch user to root : 
   sudo su -
3. Identify the vco-app pods running in the prelude namespace :
   kubectl get pods -n prelude | grep vco-app
4. Delete the pods to force a restart :
   kubectl delete pod -n prelude vco-app-####-####
   (Note: Kubernetes will automatically recreate the pods. In a clustered environment, ensure all replicas are restarted.)
5. Wait for the pods to return to a 2/2 Running status :
   kubectl get pods -n prelude | grep vco-app
6. Clear the browser cache and attempt to launch the Orchestrate portal again.