According to VMware staff:
Access denied , is expected behavior. VIDM is expecting to be reached via the URL that it is configured for, i.e., the global LB URL when using auth methods such as password auth. If you come in via another URL, then this won't work. The auth fails because the vip is configured in the vIDM config settings so on login the load balancer sends to the vip.