Error "A fatal error has occurred. Unable to continue" during OVA deployment from vCenter due to session exhaustion

Products

• VMware vCenter Server

Issue/Introduction

• When attempting to deploy an OVF or OVA template in vCenter Server, the deployment process encounters below error at the Select a compute resource stage:
  
  A fatal error has occurred. Unable to continue
  
  
• The /var/log/vmware/vsphere-ui/vsphere_client_virgo.log shows INVALID_ARGUMENT response received when attempting to retrieve permissions for the deployment target:
  
  YYYY-MM-DDThh:mm:ss nio-127.0.0.1-5090-exec-8546 ######## #### #### c.v.v.c.p.impl.ProvisioningResourcePoolMutationProvider  Initiate deployment of template on resource pool. template = <OVA_name>
YYYY-MM-DDThh:mm:ss [ERROR] nio-127.0.0.1-5090-exec-8546 ####### #### #### c.v.v.c.p.impl.ProvisioningResourcePoolMutationProvider  Failed to fetch file info for PUSH import session with spec
...
} com.vmware.vapi.std.errors.InvalidArgument: InvalidArgument (com.vmware.vapi.std.errors.invalid_argument) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = com.vmware.vdcs.vsphere-auth-lib.permission.error,
    defaultMessage = Could not retrieve permission information for ID urn:vmomi:Folder:group-v4:########-####-####-######## for operation com.vmware.vcenter.ovf.import_session.create_for_resource_pool.,
    args = [urn:vmomi:Folder:group-v4:########-####-####-########, com.vmware.vcenter.ovf.import_session.create_for_resource_pool],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = INVALID_ARGUMENT
}
  
  
• The /var/log/vmware/content-library/cls.log shows that the permission retrieval operation initiated by vsphere-ui service encountered validation failure from the CIS Authz service that resides in vpxd-svcs:
  
  YYYY-MM-DDThh:mm:ss | ERROR    | ########-########-auto-####-h5:######## | tomcat-http-45            | AuthorizationFilter            | Could not retrieve permission information for ID urn:vmomi:Folder:group-v#:########-####-####-####-######## for operation com.vmware.vcenter.ovf.import_session.create_for_resource_pool.
com.vmware.vsphere.common.authz.AuthorizationException: Could not validate with CIS Authz service
        at com.vmware.vsphere.common.authz.impl.PermissionValidatorImpl.validate(PermissionValidatorImpl.java:44) ~[vsphere-auth-lib-1.0.0.jar:?]
        at com.vmware.vcde.common.services.authorization.impl.PermissionValidatorWrapperImpl.validate(PermissionValidatorWrapperImpl.java:98) ~[vsphere-cs-lib-1.0.0.jar:?]
  
  
• The /var/log/vmware/vpxd-svcs/vpxd-svcs.log shows session creation failure due to "Too many authenticated sessions":
  
  YYYY-MM-DDThh:mm:ss [correlation-dispatcher-4 [] WARN  com.vmware.vim.vmomi.server.session.impl.SessionManagerImpl  opId=] Too many authenticated sessions (1000), cannot create new session
YYYY-MM-DDThh:mm:ss [correlation-dispatcher-4 [] ERROR com.vmware.vim.vmomi.server.impl.DispatcherImpl  opId=] Internal server error during dispatch
com.vmware.vim.vmomi.server.exception.ServiceUnavailableException: Failed to create session
        at com.vmware.vim.vmomi.server.impl.DispatcherImpl$SingleRequestDispatcher.resolveSessionFromRequest(DispatcherImpl.java:315)

Cause

The vpxd-svcs service has reached its hard limit of 1,000 concurrent authenticated sessions. This prevents the Content Library Service (CLS) from creating the internal sessions needed to validate user permissions via the CIS Authorization service, causing the OVF import to fail even if the user has appropriate privileges.

Resolution

To resolve this issue, restart the vpxd-svcs service to clear the sessions.

1. Log in to the vCenter Server Appliance via SSH using root credentials.
   
   
2. Restart the vpxd-svcs service:
   
service-control --restart vpxd-svcs
   
   
3. Retry the OVF/OVA deployment.

Additional Information

In case the issue is being encountered frequently, to identify the source of the sessions, refer to How to find details of vCenter login through [email protected] or domain user

In case the sessions are being initiated due to vSphere Replication, refer to vCenter Server service unavailability due to VMware Live Recovery session leak