Invalid VMware Identity Manager user/group error 71009 in NSX

Products

• VMware NSX

Issue/Introduction

• When attempting to save edits in NSX > User Role Assignment, the following error appears: Error: Invalid VMware Identity Manager user/group. (Error code: 71009)
• Navigating to User Role Assignment > Add Role for Providers > VIDM results in "No items found."
• In the vIDM console (vIDM manager > Identity & Access Management > Groups), the affected groups display "0 of 0" under the "Groups to sync" section.

Environment

• VMware NSX
• VMware Identity Manager (vIDM)

Cause

The Distinguished Name (DN) path configured for the user group in vIDM does not match the actual location of the group in Active Directory. This prevents vIDM from locating the group during synchronization.

Resolution

Update the group's Distinguished Name (DN) path to ensure correct synchronization.

1. Log in to the VMware Identity Manager / Workspace ONE Access admin console.
2. Navigate to Identity & Access Management > Directories.
3. Select the directory integrated with your Active Directory.
4. Click on Groups and locate the affected group.

5. Validate that the Distinguished Name attribute matches your actual Active Directory  path.

   • Incorrect Path: CN=####,OU=abc,OU=xyz,DC=####

   • Correct AD Path: CN=####,OU=xyz,OU=cde,DC=####

6. Update the DN path in the directory settings to match the exact path found in Active Directory.
7. Save and sync the configuration.
8. Verify that the group status changes from 0 of 0 to 1 of 1 (or the appropriate count).
9. Log in to NSX Manager and attempt to assign the role to the group again.

Additional Information

Resolving NSX-T and VMware Identity Manager (vIDM) Connectivity Issues due to SSL Thumbprint Mismatch