Virtual Machine deployment from Content Library fails with Error "Provider method implementation threw unexpected exception: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated "
search cancel

Virtual Machine deployment from Content Library fails with Error "Provider method implementation threw unexpected exception: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated "

book

Article ID: 450691

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

The deployment of a virtual machine, from content library, fails with an error as shown in Task/Event with authentication failure. The complete error reads as, "Failed to deploy OVF package Cause: A general system error occurred: Provider method implementation threw unexpected exception: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated){messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) {id = vapi.security.authentication.invalid,  defaultMessage = Unable to authenticate user,  args = [],  params = ,  localized =  }], data = ,  errorType = UNAUTHENTICATED,  challenge = }"

Tracking the authentication, we read the expection message stated in cls logs as

/var/log/vmware/content-library/cls.log reports user authentication failure.

YYYY-MM-DDTHH:MIN:SEC.728Z DEBUG CLS 65 [vc@4413 threadName="cls-simple-activity-22" logger="VcTaskService"] [activityId=####-####] Unregistered task id ####-#### from DB
YYYY-MM-DDTHH:MIN:SEC.731Z DEBUG CLS 205 [vc@4413 threadName="vc-prop-collector-svc-####-####-executor-63" logger="AbstractVimFutureSessionMap"]  Session validation passed for VC at URL https://vCenter.FQDN:443/sdk: Session exists
YYYY-MM-DDTHH:MIN:SEC.731Z DEBUG CLS 205 [vc@4413 threadName="vc-prop-collector-svc-####-####-executor-63" logger="AbstractVimFutureSessionMap"]  Processing existing session for VC at URL https://vCenter.FQDN:443/sdk
YYYY-MM-DDTHH:MIN:SEC.736Z INFO  CLS 65 [vc@4413 threadName="cls-simple-activity-22" logger="ContentLibraryActivityCallback"] [activityId=####,####] vapi opId: ####,#### - vapi call finished successfully
YYYY-MM-DDTHH:MIN:SEC.736Z DEBUG CLS 65 [vc@4413 threadName="cls-simple-activity-22" logger="ContentLibraryActivityCallback"] [activityId=####,####] vapi opId: ####,#### - setting result with value null
YYYY-MM-DDTHH:MIN:SEC.767Z DEBUG CLS 2517 [vc@4413 threadName="proxy-vapi-config--executor-1021" logger="SessionEstablishingApiProvider"]  Successfully performed session-based login. sessionId: ####,####
YYYY-MM-DDTHH:MIN:SEC.768Z DEBUG CLS 2518 [vc@4413 threadName="proxy-vapi-config--executor-1022" logger="JsonApiProvider"]  Sending request of size: 406
YYYY-MM-DDTHH:MIN:SEC.768Z DEBUG CLS 2518 [vc@4413 threadName="proxy-vapi-config--executor-1022" logger="HttpClient"]  Executing sync request.
YYYY-MM-DDTHH:MIN:SEC.040Z DEBUG CLS 127 [vc@4413 threadName="tomcat-http-39" logger="ApiMethodSkeleton"]  Method com.vmware.transfer.transfer_service.create_session threw an exception
com.google.common.util.concurrent.UncheckedExecutionException: com.vmware.vapi.std.errors.Unauthenticated: Unauthenticated (com.vmware.vapi.std.errors.unauthenticated) => {
    messages = [LocalizableMessage (com.vmware.vapi.std.localizable_message) => {
    id = vapi.security.authentication.invalid,
    defaultMessage = Unable to authenticate user,
    args = [],
    params = <null>,
    localized = <null>
}],
    data = <null>,
    errorType = UNAUTHENTICATED,
    challenge = <null>
}
    at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2085)

Environment

VCF 9

Cause

When two certificates are stored, usally, carried from previous version, the validation hence fails with an authentication error.

The cause for authentication can be tracted in vapi endpoint.log.

/var/log/vmware/vapi/endpoint/endpoint.log

YYYY-MM-DDTHH:MIN:SEC.037Z | ####-#### | 10.10.0.0 | :port# | "POST /site/api HTTP/1.1" | 200 | 452 | "vAPI/2.100.0 Java/17.0.17 (Linux; 6.1.161-5.ph5; amd64)" | + | 268 | com.vmware.appliance.networking.proxy:get | 269 | http://localhost:####/api | content-library-user-####-####@example.local | #### | com.vmware.vapi.std.errors.unauthenticated
YYYY-MM-DDTHH:MIN:SEC.895Z INFO VapiEndpoint 31 [vc@4413 logger="SessionApiSecurityUtil"] Created child session with session manager com.vmware.cis.session on http://localhost:1080/lcm/api for session wcp-####-####@example.local (internal id ####).
YYYY-MM-DDTHH:MIN:SEC.273Z INFO VapiEndpoint 31 [vc@4413 logger="SessionApiSecurityUtil"] Created child session with session manager com.vmware.cis.tagging.sessions.session_manager on http://localhost:1080/invsvc/vapi for session [email protected] (internal id ####).
YYYY-MM-DDTHH:MIN:SEC.037Z WARNING VapiEndpoint 28 [vc@4413 logger="SessionApiSecurityUtil"] Failed to create child session with session manager com.vmware.cis.session on http://localhost:####/api for session content-library-user-####-####@example.local (internal id ####).
com.vmware.vapi.endpoint.vapi.ApiException at com.vmware.vapi.endpoint.auth.impl.SessionApiSecurityUtil.onLoginResult(SessionApiSecurityUtil.java:270)
YYYY-MM-DDTHH:MIN:SEC.020Z DEBUG applmgmt 44367 [vc@4413 tid="140352448562880" module="authentication_sso" funcName="_get_trusted_certs" lineNum="388"] Downloading trusted certs from url : http://localhost:7080/idm/tenant/example.local/certificates?scope=TENANT
YYYY-MM-DDTHH:MIN:SEC.031Z DEBUG applmgmt 44367 [vc@4413 tid="140352448562880" module="authentication_sso" funcName="_get_trusted_certs" lineNum="388"] Downloading trusted certs from url : http://localhost:7080/idm/tenant/example.local/certificates?scope=TENANT
YYYY-MM-DDTHH:MIN:SEC.034Z ERROR applmgmt 44367 [vc@4413 tid="140352448562880" module="auth" funcName="authenticate" lineNum="249"] Could not parse HOK Token
--> Traceback (most recent call last):
-->   File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 301, in validate
-->     self.validate_certificate()
-->   File "/usr/lib/applmgmt/lib/extensions/py/vmware/appliance/extensions/authentication/authentication_sso.py", line 503, in validate_certificate
-->     raise AuthenticationError(
--> vmware.appliance.extensions.authentication.authentication_sso.AuthenticationError: One or more certificates cannot be verified.

Resolution

To address the issue, the stale or old certificate needs to be removed for SSL certificate. Do so, by following using vCert tool.

Powered by Wolken Software