Troubleshooting drConfig.fault.NotAuthorized during Protection and Recovery Appliance Reconfiguration

Products

• VMware Live Recovery

Issue/Introduction

After performing a vCenter Server upgrade, attempting to reconfigure the Protection and Recovery Appliance Management may fail with a drConfig.fault.NotAuthorized error. This issue occurs when the vCenter administrator account loses its required membership in the SSO Administrators group.

• Reconfiguration task fails with the following error: A general system error occurred: N7Vmacore9ExceptionE Fault cause: drConfig.fault.NotAuthorized
• The vCenter Server Appliance (VCSA) services may appear healthy, but appliance reconfiguration fails to validate connectivity.
• Logs in va-config.log report a SOAP fault during connection validation.

Log Evidence: The issue is confirmed by the following error sequence found in the VLR Appliance:

YYYY-MM-DDTHH:MM:SS.MS+HH:MM INFO va-config 3170 [VaConfig@4413 sub="vmomi.soapStub[12]" opID="#######################################################"] SOAP request returned HTTP failure; <SSL(<io_obj t:N7Vmacore6System19TCPSocketObjectAsioE, h:36, <TCP '##.##.#.## : 38592'>, <TCP '##.##.#.## : 443'>>), /sso-adminserver/sdk/[FQDN]>, method: hasAdministratorRole; code: 500(Internal Server Error); fault: (sso.fault.NoPermission) {
-->    faultCause = (vmodl.MethodFault) null,
-->    faultMessage = <unset>
-->    msg = "Received SOAP response fault from [<SSL(<io_obj t:N7Vmacore6System19TCPSocketObjectAsioE, h:36, <TCP '##.##.#.## : 38592'>, <TCP '##.##.#.## : 443'>>), /sso-adminserver/sdk/[FQDN]>]: hasAdministratorRole
--> "
--> }
YYYY-MM-DDTHH:MM:SS.MS+HH:MM ERROR va-config 3170 [VaConfig@4413 sub="Default" opID="#######################################################"] Validate SSO admin role failed:
--> (drConfig.fault.NotAuthorized) {
-->    faultCause = (vmodl.MethodFault) null,
-->    faultMessage = <unset>
-->    msg = ""
--> }

Environment

• Product: VMware Live Recovery
• Versions: Upgrade from 9.1.0.0100 to 9.1.0.0200
• Platform: vCenter Server Appliance (VCSA)

Cause

The [email protected] account (or the service account used for registration) has lost its membership in the Administrators group within the vCenter SSO domain following a vCenter upgrade.

Resolution

1. Log in to the vSphere Client using an account with SSO Administrator privileges.
2. Navigate to Administration > Single Sign-On > Users and Groups.
3. Select the vsphere.local domain.
4. Locate the Administrators group and ensure [email protected] is listed as a member.
5. If the user is missing, add [email protected] back to the Administrators group.
6. Reboot the vCenter Server Appliance (VCSA) to ensure the updated group memberships are fully propagated across all authentication services.
7. Once the vCenter service is back online, retry the reconfiguration task in the Protection and Recovery Appliance Management interface.

Additional Information

• If the issue persists after restoring permissions and rebooting, verify that no conflicting solution users (e.g., related to SRM, VR, or VSAN) exist that could cause authorization errors.
• To speak with a customer representative or a Support Engineer, see Contact Support. Scroll to the bottom of the page and click on your respective region.
• For defects and enhancements, subscribe to this article to receive updates on fix status (Reference: Subscribe to a Broadcom knowledge article).