topic Re: vCenter permissions when using the plugin in Application Integration

vCenter permissions when using the plugin

rvvliet78110 — Mon, 02 Jan 2017 12:00:46 GMT

In our company we have lots of Engineers that are responsible for customer VM's and this involves creating and growing datastores in which the Nimble plugin comes in great.

We did have an issue when limiting permissions in vCenter, after setting the correct permissions in vCenter I was able to manually create and expand datastores but when trying this with the Nimble plugin it just returned an error saying "No Permission()" without any kind of error code.

The lack of a proper error code was a bit frustrating as it gives you no lead into a direction into which to search.

As a user with Administrative permissions there was no problem and as said before I could manually to all the steps needed to grow or create datastores. So it seemed that the Nimble plugin does something extra.

After talking to Support about this we came to the conclusion that the best way to troubleshoot was to give all permissions an remove them until it breaks, which would be very time consuming but if it would solve the problem it's the best option.

I eventually found the "holy checkbox", the Tasks permission, it appears that when a datastore operation is initiated from the Nimble plugin this is done via a task, as I started my initial role within vCenter as a copy of the power user role this permission was not set. After setting the "create tasks permission it all came to life:

After setting only this permission and trying to grow a datastore I was getting some nice error messages from vCenter which helps to set the rest of the permissions needed for engineers.

As the need for the "Tasks" permissions is not really documented in the Nimble Documentation I can imaging others out there are searching for this, and I would post it here hoping it will help someone along the way.

Re: vCenter permissions when using the plugin

mblumberg16 — Tue, 03 Jan 2017 09:48:16 GMT

Hi Rick, thank you very much for outlining this requirement, I'm sure it will help for any future considerations and plugin usage.

As a side note, when reviewing the VMware integration guide the plugin page, first not outline the permissions needed:

Nimble Storage InfoSight

The following privileges are required for using the vCenter plugin.

Datastore.AllocateSpace
Datastore.Config
Datastore.Delete
Datastore.Move
Datastore.Rename
Extension.Register
Extension.Unregister
Extension.Update
Global.CancelTask
Host.Config.AdvancedConfig
Host.Config.NetService
Host.Config.Settings
Host.Config.Storage
StoragePod.Config
System.Anonymous
System.Read
System.View
Task.Create
Task.Update

As for the error code, I've created a bug to detail the permission failure in the error code.

Thanks,

Moshe.

Re: vCenter permissions when using the plugin

rvvliet78110 — Tue, 03 Jan 2017 10:05:19 GMT

Hi Moshe,

Thanks for you reply, this was actually the information I was looking for when opening the support ticket (which actually stated "Is there a guide for setting permissions within vCenter to give some users permission to grow volumes/datastores?", but I didn't get a reference back to this document after which I started my journey of finding the correct permissions myself.

Thanks,

Rick

Re: vCenter permissions when using the plugin

elkhornps — Thu, 28 Mar 2019 03:09:01 GMT

Edit: I was able to create the custom role using powerCLI based on a script from vHersey (see other reply) that I tweaked using the permissions listed here and in the linked documentation. If you wish to register the VASA Provider, you must add the following to the list above.

- StorageViews.ConfigureService
- StorageViews.View

If you need to create the role through the GUI, here is the list of permissions that are configured as the wording does not match. This is for vCenter 6.7U1. The Storage views section is needed for VASA Provider.

Datastore
- Allocate space
- Configure datastore
- Move datastore
- Remove datastore
- Rename datastore

Extension
- Register extension
- Unregister extension
- Update extension

Global
- Cancel task

Host
- Configuration
- - Advanced settings
- - Change settings
- - Security profile and firewall
- - Storage partition configuration

Datastore cluster
- Configure a datastore cluster

Storage views
- Configure service
- View service

Tasks
- Create task
- Update task

Re: vCenter permissions when using the plugin

elkhornps — Thu, 28 Mar 2019 03:10:57 GMT

Edit: Add additional privileges for VASA provider (StorageViews)

I can't attach the script file, so we'll see how the copy/paste does.

#
# PowerCLI script to create Custom Role which includes required permissions
# and assign Custom Service Account to Role
# Usage Create_Custom_Role.ps1 -vCenter vCenterFQDNorIP -Username ServiceAccountName -Domain AuthenticationDomain -RoleName CustomRoleName
# The user account must already exist, this script will not create the user account.
# Original Script Author vHersey
# Link to original script: http://www.vhersey.com/2015/06/17/powercli-create-vcenter-role-and-assign-user-permissions/

# Get Commandline Parameters - All are required
param(
[string]$vCenter,
[string]$Username,
[string]$Domain,
[string]$RoleName
)

clear-host

$usage = "Create_Custom_Role.ps1 -vCenter vCenterFQDNorIP -Username CustomServiceAccountName -Domain AuthenticationDomain -RoleName CustomRoleName"
$example = 'Create_Custom_Role.ps1 -vCenter "vcenter.acme.local" -Username svtuser -Domain acme -RoleName CustomRoleName'

Write-Host "PowerCLI script to create Custom Role which includes required privileges and assigns the Custom Service Account to Role" -ForeGroundColor Cyan

if ( !$vCenter -or !$Username -or !$Domain -or !$RoleName ) {
write-host `n `n"Missing Required Parameter - vCenter, Username, Domain, and RoleName are required." `n -ForeGroundColor Red
write-host "Usage: $usage" `n
write-host "Example: $example" `n
exit
}

write-host "vCenter: $vCenter"
write-host "User: $Username"
write-host "Domain: $Domain"
write-host "RoleName: $RoleName"

$vCenterFQDN = $vCenter

# Custom Service Account User
#The Custom User account is a non-login, privileged, vCenter Server account that you specify during deployment. OmniCube uses this account to execute privileged tasks.
$Custom_User = "$Domain\$Username"

# Custom Role Name
#Edit - No a paramater
#$Custom_Role = "Custom"

# Privileges to assign to role
# See the product Administrators Guide for Required Permissions
# Nimble vCenter Privileges
$Custom_Privileges = @(
'Datastore.AllocateSpace',
'Datastore.Config',
'Datastore.Delete',
'Datastore.Move',
'Datastore.Rename',
'Extension.Register',
'Extension.Unregister',
'Extension.Update',
'Global.CancelTask',
'Host.Config.AdvancedConfig',
'Host.Config.NetService',
'Host.Config.Settings',
'Host.Config.Storage',
'StoragePod.Config',
'StorageViews.ConfigureService',
'StorageViews.View',
'System.Anonymous',
'System.Read',
'System.View',
'Task.Create',
'Task.Update')
# Original Script Simplivity Privileges
# 'Alarm.Create',
# 'Alarm.DisableActions',
# 'Alarm.Edit',
# 'Alarm.SetStatus',
# 'Alarm.Delete',
# 'Extension.Register',
# 'Extension.Update',
# 'Extension.Unregister',
# 'Global.Health',
# 'Global.LogEvent',
# 'Global.ManageCustomFields',
# 'Global.SetCustomField',
# 'Global.Diagnostics',
# 'Host.Cim.CimInteraction',
# 'Task.Create',
# 'Task.Update',
# 'VApp.AssignVApp',
# 'VApp.Unregister',
# 'VApp.ApplicationConfig',
# 'VirtualMachine.Config.ManagedBy',
# 'VirtualMachine.Config.Settings',
# 'VirtualMachine.State.RemoveSnapshot',
# 'VirtualMachine.State.CreateSnapshot'

Write-Host "Connecting to vCenter at $vCenterFQDN"`n -ForeGroundColor Cyan
Connect-VIServer $vCenterFQDN | Out-Null

Write-Host "Create New $RoleName Role"`n -ForeGroundColor Cyan
New-VIRole -Name $RoleName -Privilege (Get-VIPrivilege -id $Custom_Privileges) | Out-Null

Write-Host "Set Permissions for $Custom_User using the new $RoleName Role"`n -ForeGroundColor Cyan
#Get the Root Folder
$rootFolder = Get-Folder -NoRecursion
#Create the Permission
New-VIPermission -Entity $rootFolder -Principal $Custom_User -Role $RoleName -Propagate:$true | Out-Null

#Disconnect from the vCenter Server
Write-Host "Disconnecting from vCenter at $vCenterFQDN"`n -ForeGroundColor Cyan
Disconnect-VIServer $vCenterFQDN -Confirm:$false

#End

Re: vCenter permissions when using the plugin

mamatadesaiNim — Thu, 28 Mar 2019 15:22:04 GMT

Thank you for letting us know, and for the neat script!

Our docs will be updated with the upcoming version of our vcplugin :)

--m