Unable to rotate vCenter [email protected] password via CyberArk or Command Line Utility using an Active Directory service account

Products

• VMware vCenter Server

Issue/Introduction

• Automated rotation of the internal vCenter Single Sign-On (SSO) account [email protected] using a CyberArk-managed Active Directory (AD) service account fails. When the service account attempts to access the command-line interface, the following error is encountered:

"Unable to authorize. User 'user@domain' is not authorized to run this command"

• This occurs when executing shell or shell.set --enable=true from the vCenter Server Appliance (VCSA) appliance shell.

Environment

• VMware vCenter Server 8.x
  
  
• VMware vCenter Server 9.x

Cause

The Active Directory service account lacks the specific SSO privileges required to access the vCenter Server Appliance BASH shell. By default, domain accounts are restricted from launching the shell unless they are explicit members of the SystemConfiguration.BashShellAdministrators group.

Resolution

Grant the AD service account the necessary SSO permissions and utilize the dir-cli utility for password management.

1. Grant Authorization:

   1. Log in to the vSphere Client as a member of the Administrators group.
      
      
   2. Navigate to Administration > Single Sign On > Users and Groups.
      
      
   3. Select the Groups tab and locate the SystemConfiguration.BashShellAdministrators group.
      
      
   4. Add the Active Directory service account to this group.

2. Enable and Access the Shell:

   1. Connect to the vCenter Server via SSH using the AD service account.
      
      
   2. At the appliance shell prompt, run: shell.set --enable=true


   3. Access the BASH prompt by running: shell

3. Execute Password Rotation:

   1. Use the dir-cli utility to change the SSO password:
      
      /usr/lib/vmware-vmafd/bin/dir-cli password change --account [email protected]


   2. Provide the current password and the new password when prompted.