vCenter 6 web client lost permissions

[MatteoMarchetti]

Using the web client some users with restricted access regularly lose their permissions on specific folders:

All looks fine from the standalone client.

I have opened TWO SR to VMware and they provided just two different workarounds (restarting all vCenter services and re-adding the permissions).

These solved the issue but later on it re-appeared.

Is anyone having the same problem?

[TCG2]

I am seeing similar issues. Removing and re-adding permissions seem to clear it up, at least temporarily. I've just recently discovered this issue and I'm not sure if it reoccurs after the permission recreation or not...

[vmEck]

What build of vCenter? 6.0 GA, U1/a/b?

[vtyurin]

Have the same problem. VCSA 6.0.0.10200 Build Number 3343022

[Petter_Lindgren]

We've had this problem for at least a year since we upgraded to ESXi 6.0 and vCenter Server 6.0.

do not recall having this earlier on 5.5.

We're currently on ESXi 6.0.0, 3620759 and vCenter 6.0.0, 3634793 and are still having the permission issue.

It only affects users who are assigned to a Group with lower permission.

[Arogarth]

Hi,

we have the same issue. look at the KB Inventory objects fail to display in vSphere Web Client 6.0 (2144934) | VMware KB and restart the content inventory service.

Hope this will help you

[Petter_Lindgren]

We've also a SR open with vmware but nothing happens.

I understand that bugs happen but for a bug to exist this long without fixing it is clearly unacceptable!

If vmware doesn't get their act together and start improving their support; customers will have a hard time understanding why they pay so much more for vSphere than e.g Hyper-V.

[Orcunus]

This is reported as a known issue and expected to be fixed with the next release of vCenter Server (probably vCenter Server 6.0 U3). So far, there are a few workarounds (without re-adding permissions every time);

1. Restart the inventory services: Not the best option as it is a critical production service
2. Define global read only permissions to the related users: You can define readonly globally and then reassign roles at the folder level. I have seen that it works for some scenarios but it also brings governance and/or multi tenancy issues as all users can see all resources. So again not the best option.
3. Use vSphere client not the web client: As vSphere client directly communicates with the vpxd service, you will not see this problem. This is the solution I had to apply in my environment.

Please consider awarding points for "Correct" or "Helpful" replies. Many thanks....:)

Ozan Orcunus | vExpert