Aria Automation deployment fails with HTTP 400 rrror in getCMPAuthToken custom workflow

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

Aria Automation deployments fail during the pre-allocation phase when utilizing custom extensibility workflows. The deployment process halts, and the Extensibility / Event Broker service reports a failure.
The following error is observed in the logs: Extensibility triggered task failed. Event ID: <event_id>. Failure: Extensibility error received for topic compute.allocation.pre, eventId = '<event_id>': [10040] ... completed with error [HTTPError: status code: 400 (Workflow:getCMPAuthToken / Decision (item3)#2)]

Review of the workflow logs indicates that while the authentication request to the identity service returns a valid refresh token, the subsequent request to the deployment API fails with an HTTP 400 status code, often accompanied by an Internal Server Error (500) within the custom workflow logic.

Extensibility triggered task failed. Event ID: <Event ID_UUID>. Failure: Extensibility error received for topic compute.allocation.pre, eventId = '<Event ID_UUID>': [10040] SubscriberID: vro-gateway-aA6qQCQe5FjN4HDB, RunnableID: <RunnableID_UUID> 2 and SubscriptionID: sub_ID failed with the following error: Workflow run [Workflow ID] completed with error [HTTPError: status code: 400 (Workflow:getCMPAuthToken / Decision (item3)#2)] "

Environment

VMware Aria Automation 8.18.x

Cause

The service account used by the custom extensibility workflow lacks the necessary privileges to perform the API operations required by the workflow.

When inspecting the JSON Web Token (JWT) generated for the service account, the perms attribute is empty ("perms": []). This indicates that although the service account can authenticate (obtaining a token), it does not carry the fine-grained permissions required to interact with specific Assembler or Orchestrator API endpoints, causing the authorization check on those endpoints to fail.

Resolution

To resolve this issue, assign the appropriate roles to the service account used by the workflows.

Prerequisites:

• Ensure you have Administrative access to the Aria Automation console.
• Identify the service account used by the workflow (e.g., <service_account_name>).

Steps:

1. Log in to the VMware Aria Automation console as an administrator.
2. Navigate to the Identity and Access Management section or the relevant user management area where service accounts are configured.
3. Search for the service account used by the workflow (e.g., <service_account_name>).
4. Navigate to the roles/permissions section for that service account.
5. Assign the following roles to the service account:
   • Assembler Administrator
   • Orchestrator Administrator
6. Save the changes.
7. Attempt a new deployment. The custom workflow should now have the necessary permissions to successfully authenticate and execute API requests.

Additional Information

If you are debugging custom extensibility workflows, inspect the JWT generated during the workflow execution. If the perms array is empty, the service account lacks authorized roles.

Refer to the Aria Automation Documentation for detailed information on role-based access control (RBAC) and service account management.