AD/LDAP Users Unable to View Namespaces in vCenter Inventory (VCF 9 / vSphere 9)

Products

• VMware vCenter Server

Issue/Introduction

In VMware Cloud Foundation (VCF) 9 or vSphere 9, users authenticated via external identity sources (Active Directory or LDAP) may experience the following:

• The Namespaces folder or individual Namespaces are not visible in the vCenter Inventory tree.
• Membership in the ServiceProviderUsers SSO group does not grant the expected visibility for these external accounts.
• Assigning Global Read-only permissions does not resolve the visibility issue.

Environment

vSphere 9.x
VCF 9.x

Cause

In vSphere 9, architectural changes to inventory visibility logic require users to reside in the local vCenter SSO domain to utilize group-based visibility shortcuts. Users from external identity sources are currently not processed by the legacy visibility bypass method.

Note: For environments running versions earlier than 9.x, the workflow described in KB 417756 remains valid. However, that specific workflow is no longer sufficient for external accounts in VCF 9/vSphere 9.

Resolution

There is currently no resolution. A fix is planned for a future update.

Workaround:

To provide Namespace visibility for external AD/LDAP users, you must grant explicit permissions on the Namespaces folder using a local SSO group proxy.

1. Create a Local SSO Group:

   • Log in to the vSphere Client as an SSO Administrator.
   • Navigate to Administration > Single Sign On > Users and Groups.
   • Create a new group in the local domain (e.g., [email protected]).
   • Add the affected AD/LDAP users or groups as members of this new local group.

2. Assign Folder Permissions:

   • Navigate to the VMs and Templates inventory view.
   • Right-click the Namespaces folder.
   • Select Add Permission.
   • Add the [email protected] group.
   • Assign the built-in Read-only role.
   • Ensure the Propagate to children checkbox is selected.

3. Validation:

   • Have the external user log out and log back into the vSphere Client.
   • Verify that the Namespaces folder and its contents are now visible in the inventory.

Additional Information

Required privileges to allow users to see Namespaces on vCenter