Enabling Authentication proxy on vCenter UI fails with the error "The entity param cannot be null in the MutationService methods" for AD users

Products

• VMware vCenter Server

Issue/Introduction

• Authentication proxy is enabled when logging into vCenter UI as <[email protected]>

• When logging into vCenter UI as AD user assigned with administrator privilege, Authentication Proxy shows as disabled. When attempting to enable fails with error "The entity param cannot be null in the MutationService methods" as below,

  

• Authentication Proxy functionality wise working fine. 

• /var/log/vmware/vpxd/vpxd.log on vCenter throws below error,

  [YYYY-MM-DDTHH:MM:SS] [ERROR] nio-127.0.0.1-5090-exec-1256 ######## ###### ###### com.vmware.vise.data.mutation.impl.MutationServiceImpl MutationServiceImpl.apply failed: java.lang.IllegalArgumentException: The entity param cannot be null in the MutationService methods        at com.vmware.vise.data.mutation.impl.MutationServiceImpl.checkValidEntity(MutationServiceImpl.java:720)

• /var/log/vmware/vsphere-ui/logs/vsphere_client_virgo.log on vCenter shows below error,

  [YYYY-MM-DDTHH:MM:SS] [ERROR] data-service-pool-773 ######## ###### ###### com.vmware.vsphere.client.common.data.DataProviderAdapterBase Unchecked exception processing query urn:vri:cm:Service:vmcam/########################.properties com.vmware.vapi.std.errors.Unauthorized: Unauthorized (com.vmware.vapi.std.errors.unauthorized) => {
      messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
      id = vapi.security.authorization.invalid,
      defaultMessage = Unable to authorize user,
      args = [],
      params = <null>,
      localized = <null>
  }],
      data = <null>,
      errorType = UNAUTHORIZED

• On AD server open PowerShell and run below command for affected user. Output shows with "PrimaryGroupID: ###" while expected ID is 513 which is Default Domain Users

  Get-ADUser <username>-Properties primaryGroupID, memberOf

  • Example of wrong Primary Group set with 512 instead of 513:

    

Environment

vCenter 8.x

Cause

It is caused by Active Directory configuration issue specific to the AD user account, where his primary group was set to some group (like, 'Domain Admins') instead of the standard 'Domain Users'. That single AD attribute is what caused vCenter to inconsistently see AD user account.

Resolution

Correct the Active Directory account attributes for the impacted user <username> from AD server using PowerShell:

1. Add explicit membership to the Domain Admins group:

   Add-ADGroupMember -Identity "Domain Admins" -Members <username>

2. Revert the primary group ID back to the standard default value for Domain Users (RID 513):

   Set-ADUser -Identity <username> -Replace @{primaryGroupID=513}