vRA Plugin for vRO Shared Session Authentication Failure in VCFA 9.0.2

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

After upgrading a migrated Aria Automation (vRA) environment to VMware Cloud Foundation Automation (VCFA) v9.x, the vRA plugin for Orchestrator (vRO) fails to create an authenticated vRA Host with a shared session.

Users encounter "wrong credentials" errors during the workflow, even when providing valid credentials.

The failure stems from several plugin and environmental limitations:

• The plugin cannot authenticate using local tenant users (e.g., provider admin), LDAP, or SAML users; it exclusively supports Workspace ONE Access (vIDM)-synced users over OIDC.
• The plugin operates in a tenant-unaware environment and can only authenticate users imported into the designated "default login organization."
• Only one organization can utilize vRA hosts with a shared session in VCF Operations Orchestrator at a time.

Environment

VCF Automation 9.0.2

Resolution

To resolve this, you must manually configure the default login organization and perform a full service restart.

Configure the Default Login Organization: Run the following API commands from a terminal with access to the VCFA FQDN (ensure jq is installed):

 

# Authenticate and get Token
export TOKEN=$(curl -kL -s -w '%header{x-vmware-vcloud-access-token}' -X POST 'https://<vcfa fqdn>/cloudapi/1.0.0/sessions/provider' \
--header 'Accept: application/json;version=40.0' \
--user '<provider admin user>@System:<provider admin password>' \
-o /dev/null)

# Get current default login org
curl -kL 'https://<vcfa fqdn>/cloudapi/1.0.0/site/settings' \
--header 'Accept: application/json;version=40.0' \
--header "Authorization: Bearer $TOKEN" | jq

# Get available orgs
curl -kL 'https://<vcfa fqdn>/cloudapi/1.0.0/orgs' \
--header 'Accept: application/json;version=40.0' \
--header "Authorization: Bearer $TOKEN" | jq

# Set default login org
curl -kL -X PUT 'https://<vcfa fqdn>/cloudapi/1.0.0/site/settings' \
--header 'Accept: application/json;version=40.0' \
--header 'Content-Type: application/json' \
--header "Authorization: Bearer $TOKEN" \
-d '{ "defaultLoginOrg": { "name": "<name>", "id": "urn:vcloud:org:<uuid>" } }' | jq

Restart Services: Perform a full service restart to apply the settings:

 

# Elevate privileges
sudo su

# Configure kubectl
export KUBECONFIG=/etc/kubernetes/admin.conf

# Delete the prelude deployer helm release
kubectl delete hr -n prelude vmsp-prelude-deployer

# Watch the progress
kubectl -n prelude get pods -w