After upgrading from vCenter 4.1 to version 5.1 or 5.5, logins via the vSphere client may fail with the following error message:
The vSphere Client could not connect to <server> You do not have permission to login to the server.
VMware has a number of KB articles regarding this problem, however after encountering this problem in two separate environments, only the following article resolved the problem in one of the environments.
Unable to log into vCenter Server after upgrading to vCenter Server 5.1 (2035758):
After working through the article in the second environment, it was identified that during the SSO installation, the Domain Admins group was removed from the permissions for vCenter. As the article above only references reading the domain (which already existed) the Admins group needed to be added back in. Below are the steps that were followed:
- If the Database for vCenter is running on Express, then install SQL Management Studio Express 2008 R2. http://www.microsoft.com/en-us/download/details.aspx?id=22985
- Log into the vCenter Database
- Select (vCenter Database) à Tables à dbo.VPX_ACCESS
- Right click dbo.VPX_ACCESS then select “Open Table”
- This will return a list of the allowed users and groups. If possible please log in to the vSphere client as one of these accounts and correct the permissions:
- Log into vCenter using the vSphere client as an account listed above.
- Select the root vCenter server in the left pane
- Click the Permissions tab
- Right click in the blank area in the right pane and select Add Permission
- Click Add…
- Select the domain in the drop down list then select the desired users or groups and click OK
- Select the desired permission level (Administrator) then click OK
- If you were unable to log into the vSphere client, then the account may need to be added to vCenter by modifying the database directly using the SQL Management Studio Express:
- Enter a unique ID Number in the ID Field
- Enter the user or group name preceded by the domain name\ in the Principal field
- Enter -1 for Administrator access in the ROLE_ID field
- Enter 1 in ENTITY_ID
- Enter 1 for user accounts and 3 for groups in the FLAG field
- Press Enter to save the changes
- Restart the vCenter Service and log in as the account or group added.