"401 Unauthorized Error" due to insufficient permissions when accessing Aria Operations Plugin in vCenter

Products

• VCF Operations/Automation (formerly VMware Aria Suite)
• VMware vCenter Server 8.0

Issue/Introduction

After registering Aria Operations with vCenter you may see the following message when you access VMware Aria Operations remote plugin from vCenter:

401 Unauthorized Error : Unable to authorize VMware Aria Operations/vCenter Server API with the provided credentials

Please refer the below mentioned steps to resolve

• Ensure that the logged-in user account has enough privilege - i.e permissions to access MOB
• Ensure that the vCenter Adapter Instance in VMware Aria Operations is configured for the current vCenter and in collecting state.
• Ensure that all the vCenter Adapter Instances in VMware Aria Operations is in collecting state.

 

You may see the following error in /storage/log/vcops/log/unicorn.log:

NFO 3723 --- [ajp-nio-127.0.0.1-8010-exec-4] c.v.v.u.p.s.api.SuiteApiRestClient       : Resolving the hostname
INFO 3723 --- [ajp-nio-127.0.0.1-8010-exec-4] c.v.v.u.p.s.api.SuiteApiRestClient       : Authorisation Exception :The provided token for auth scheme "VCToken" is either invalid or has expired.
ERROR 3723 --- [ajp-nio-127.0.0.1-8010-exec-4] c.v.v.u.p.s.api.SuiteApiRestClient       : com.vmware.ops.api.client.exceptions.AuthException: The provided token for auth scheme "VCToken" is either invalid or has expired.
        at com.vmware.ops.api.client.internal.ResponseHandlerImpl.handleResponse(ResponseHandlerImpl.java:101)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:223)
        at org.apache.http.impl.client.CloseableHttpClient.execute(CloseableHttpClient.java:165)

Environment

VMware Aria Operations 8.x
VMware vCenter 8.0.x

Cause

The plugin requires permission to log in to Aria Operations via vCenter user.

The issue occurred because the vCenter Adapter Instance in VMware Aria Operations was not in a collection (collecting) state, due to authentication failure for the integration account being used. 

Other causes:

• "401 Unauthorized Error" due to DNS resolution failure when accessing Aria Operations Plugin in vCenter

Resolution

1. Ensure that the vCenter Adapter Instances in VMware Aria Operations is in collecting state following the below:
   

   Administration -> Integrations -> Accounts -> vCenter -> Select the vCenter Instance and click edit -> Validate Connection

   If the Validate Connection fails pointing towards Authentication, make sure to validate the credentials and update if needed

2. Ensure that Allow vCenter users to log in from vCenter clients is enabled in global settings in Aria Operations:
   
   Administration -> Global Settings -> User Access -> Enable 'Allow vCenter users to log in from vCenter clients'


Additional Information

This may affect the Aria Operations Remote Plugin that is used in vCenter 8.0.0.10000 or later. 

For more information on the Remote Plugin, see Integrating the Aria Operations plugin with vCenter Server