Creating Principal Identity Users in NSX for Automated Pipelines

Products

• VMware NSX

Issue/Introduction

Symptoms

• Users or automated pipelines require programmatic access to NSX APIs without using standard interactive credentials.
• Alarms such as certificate_expiration_approaching may be active if an existing Principal Identity (PI) certificate is nearing expiry.

 

Prerequisites

•   CA-Signed Certificate: The remote entity must generate a CA-signed certificate and private key. NSX self-signed certificates are not supported for PI connections.
•   Certificate Import:The certificate (public key only) must be imported into NSX Manager under System > Certificates before creating the PI user.

Environment

VMware NSX

Resolution

 

Follow the procedure below to create a new Principal Identity user.

 Pre-requisites & Backup

• Verify NSX Manager cluster health (System > Appliances).
• Take a standard NSX configuration backup via System > Backup & Restore.
• Generate the new certificate (CSR and private key) externally, outside of NSX.

1.  Log in to the NSX Manager UI.
2.  Navigate to System > User Management > User Role Assignment
3.  Click Add > Principal Identity.
4.  Enter a  Name for the Principal Identity (e.g., ADO-Pipeline-User).
5.  Select the Node ID (typically the default Manager node).
6.  Under Certificate, select the certificate you imported in the Prerequisites step.
7.  Assign the required Role (e.g., Enterprise Admin).
8.  Click Save.

Note: If this new PI user is replacing an expiring one, ensure you delete the old PI user after confirming the new one is functional to clear persistent expiration alarms.

Additional Information

 

• Add a Role Assignment or Principal Identity