Error Code: LCMVRAVACONFIG590008 when re-trusting Aria Automation with VMware Identity Manager
search cancel

Error Code: LCMVRAVACONFIG590008 when re-trusting Aria Automation with VMware Identity Manager

book

Article ID: 451152

calendar_today

Updated On:

Products

VMware vRealize Suite Lifecycle Manager 8.x VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

  • When attempting to re-trust VMware Aria Automation with VMware Identity Manager via Aria Lifecycle Manager, the task fails abruptly.

  • Aria Lifecycle Manager UI displays the following error:

    Error Code: LCMVRAVACONFIG590008
    Failed to Set VMware Identity Manager HostName on VMware Aria Automation.
    Failed to set vIDM Host on VMware Aria Automation VA : <hostname>

  • Logs on Aria Suite Lifecycle Manager located at /var/log/vrlcm/vmware_vrlcm.log shows errors similar to:

    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.d.v.h.VraPreludeInstallHelper]  -- PRELUDE ENDPOINT HOST :: <vRA Endpoint>
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.d.v.h.VraPreludeInstallHelper]  -- COMMAND :: vracli vidm set <vIDM FQDN> admin /tmp/adminpassword.txt YXYXYXYX -r /tmp/vidmrootcert.pem
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- Executing command on the host: <vRA Endpoint> , as user: root
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- ------------------------------------------------------
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- Command: vracli vidm set <vIDM FQDN> admin /tmp/adminpassword.txt YXYXYXYX -r /tmp/vidmrootcert.pem
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- ------------------------------------------------------
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- exit-status: 1
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- Command executed sucessfully
    YYYY-MM-DDThh:mm:ss INFO vrlcm[1084] [pool-3-thread-13] [c.v.v.l.u.SshUtils]  -- Command execution response: {
      "exitStatus" : 1,
      "outputData" : "YYYY-MM-DDThh:mm:ss [INFO] Setting vIDM certificate from /tmp/vidmrootcert.pem\n2YYYY-MM-DDThh:mm:ss [ERROR] Exception while setting vidm.\nTraceback (most recent call last):\n  File \"/opt/python-modules/vracli/commands/vidm.py\", line 97, in set_handler\n    if
     not vidm_obj.get_user(args.user):\n  File \"/opt/python-modules/vracli/vidm.py\", line 101, in get_user\n    token = self._login()\n  File \"/opt/python-modules/vracli/vidm.py\", line 72, in _login\n    r = self.vidm_request(method='POST', vidmUrl=url, headers=headers, data=data)\n  Fil
    e \"/opt/python-modules/vracli/vidm.py\", line 447, in vidm_request\n    self._raise_for_status(r)\n  File \"/opt/python-modules/vracli/vidm.py\", line 61, in _raise_for_status\n    response.raise_for_status()\n  File \"/opt/python-modules/requests/models.py\", line 953, in raise_for_sta
    tus\n    raise HTTPError(http_error_msg, response=self)\nrequests.exceptions.HTTPError: 429 Client Error:  for url: <vIDM FQDN>/SAAS/API/1.0/REST/auth/system/login\n",
      "errorData" : "Exception while setting vidm.\n",
      "commandTimedOut" : false

Environment

Aria Automation 8.18.x

VMware Identity Manager 3.3.7

Aria Suite Lifecycle Manager 8.18.x

Cause

This issue occurs due to restrictive API rate limiting configured on the VMware Identity Manager appliance.

When reviewing the LCM logs located at /var/log/vrlcm/vmware_vrlcm.log, you will observe an HTTP 429 status code explicitly throwing a requests.exceptions.HTTPError: 429 Client Error during the REST API authentication call (/SAAS/API/1.0/REST/auth/system/login).

This indicates that the vIDM rate limits are actively blocking the authentication exchange needed by vracli to re-establish the trust relationship. In failing instances, the rate limit is often restricted to an abnormally low value.

Resolution

To resolve this issue, you must increase the API rate limits on VMware Identity Manager to prevent vIDM from throttling the REST API requests. Restoring the limits to the default of 100 requests per minute is recommended.

Steps to update the rate limits:

  1. Log into the VMware Identity Manager UI in a web browser using a local admin account.

  2. Retrieve the HZN cookie for authentication:

    • Open Developer Tools in your browser.

    • Navigate to Application → Cookies and copy the HZN cookie value.

  3. (Optional) Verify current rate limit settings by running the following curl command (replace <VIDM_FQDN> and <TENANT_NAME> with your specific values):

    curl -k -X GET "https://<VIDM_FQDN>/SAAS/jersey/manager/api/system/tuning/resiliency/tenant/orgResiliencyConfiguration?tenantId=<TENANT_NAME>" -H "Authorization: HZN <HZN_cookie_from_step_2>" -H "Content-Type: application/json"

  4. Use the following curl command to set the rate limits back to the default of 100 (or your desired higher limit):

    curl -k -X PUT "https://<VIDM_FQDN>/SAAS/jersey/manager/api/system/tuning/resiliency/tenant/orgResiliencyConfiguration?tenantId=<TENANT_NAME>" \
    -H "Authorization: HZN <HZN_cookie_obtained_in_Step_2>" \
    -d '{ 
         "config": { 
            "rateLimitingDisabled": false, 
            "rateLimits": { 
              "login": { 
                "requestsPerMinute": 100 
              }, 
              "launch": { 
                "requestsPerMinute": 100 
              }, 
              "ws-fed": { 
                "requestsPerMinute": 100 
              } 
            } 
          } 
        }' \
    -H "Content-Type: application/vnd.vmware.horizon.manager.system.tuning.resiliency.config+json;charset=UTF-8" \
    -H "Accept: application/vnd.vmware.horizon.manager.system.tuning.resiliency.

Additional Information

Setting Rate Limits on the VMware Identity Manager Service

Powered by Wolken Software