Application Integration
1748163 Members
3799 Online
108758 Solutions
New Discussion юеВ

Re: vCenter permissions when using the plugin

 
SOLVED
Go to solution
rvvliet78110
Valued Contributor

vCenter permissions when using the plugin

In our company we have lots of Engineers that are responsible for customer VM's and this involves creating and growing datastores in which the Nimble plugin comes in great.

We did have an issue when limiting permissions in vCenter, after setting the correct permissions in vCenter I was able to manually create and expand datastores but when trying this with the Nimble plugin it just returned an error saying "No Permission()" without any kind of error code.

image.png

The lack of a proper error code was a bit frustrating as it gives you no lead into a direction into which to search.

As a user with Administrative permissions there was no problem and as said before I could manually to all the steps needed to grow or create datastores. So it seemed that the Nimble plugin does something extra.

After talking to Support about this we came to the conclusion that the best way to troubleshoot was to give all permissions an remove them until it breaks, which would be very time consuming but if it would solve the problem it's the best option.

I eventually found the "holy checkbox", the Tasks permission, it appears that when a datastore operation is initiated from the Nimble plugin this is done via a task, as I started my initial role within vCenter as a copy of the power user role this permission was not set. After setting the "create tasks permission it all came to life:

Screen Shot 2017-01-02 at 12.57.35.png

After setting only this permission and trying to grow a datastore I was getting some nice error messages from vCenter which helps to set the rest of the permissions needed for engineers.

image (1).png

As the need for the "Tasks" permissions is not really documented in the Nimble Documentation I can imaging others out there are searching for this, and I would post it here hoping it will help someone along the way.

5 REPLIES 5
mblumberg16
Respected Contributor
Solution

Re: vCenter permissions when using the plugin

Hi Rick, thank you very much for outlining this requirement, I'm sure it will help for any future considerations and plugin usage.

As a side note, when reviewing the VMware integration guide the plugin page, first not outline the permissions needed:

Nimble Storage InfoSight

The following privileges are required for using the vCenter plugin.

  • Datastore.AllocateSpace
  • Datastore.Config
  • Datastore.Delete
  • Datastore.Move
  • Datastore.Rename
  • Extension.Register
  • Extension.Unregister
  • Extension.Update
  • Global.CancelTask
  • Host.Config.AdvancedConfig
  • Host.Config.NetService
  • Host.Config.Settings
  • Host.Config.Storage
  • StoragePod.Config
  • System.Anonymous
  • System.Read
  • System.View
  • Task.Create
  • Task.Update

As for the error code, I've created a bug to detail the permission failure in the error code.

Thanks,

Moshe.

rvvliet78110
Valued Contributor

Re: vCenter permissions when using the plugin

Hi Moshe,

Thanks for you reply, this was actually the information I was looking for when opening the support ticket (which actually stated "Is there a guide for setting permissions within vCenter to give some users permission to grow volumes/datastores?", but I didn't get a reference back to this document after which I started my journey of finding the correct permissions myself.

Thanks,

Rick

elkhornps
Occasional Contributor

Re: vCenter permissions when using the plugin

Edit: I was able to create the custom role using powerCLI based on a script from vHersey (see other reply) that I tweaked using the permissions listed here and in the linked documentation. If you wish to register the VASA Provider, you must add the following to the list above.

- StorageViews.ConfigureService
- StorageViews.View


If you need to create the role through the GUI, here is the list of permissions that are configured as the wording does not match.  This is for vCenter 6.7U1. The Storage views section is needed for VASA Provider.


Datastore
- Allocate space
- Configure datastore
- Move datastore
- Remove datastore
- Rename datastore

Extension
- Register extension
- Unregister extension
- Update extension

Global
- Cancel task

Host
- Configuration
- - Advanced settings
- - Change settings
- - Security profile and firewall
- - Storage partition configuration

Datastore cluster
- Configure a datastore cluster

Storage views
- Configure service
- View service

Tasks
- Create task
- Update task

elkhornps
Occasional Contributor

Re: vCenter permissions when using the plugin

Edit: Add additional privileges for VASA provider (StorageViews)

I can't attach the script file, so we'll see how the copy/paste does.

 

#
# PowerCLI script to create Custom Role which includes required permissions
# and assign Custom Service Account to Role
# Usage Create_Custom_Role.ps1 -vCenter vCenterFQDNorIP -Username ServiceAccountName -Domain AuthenticationDomain -RoleName CustomRoleName
# The user account must already exist, this script will not create the user account.
# Original Script Author vHersey
# Link to original script: http://www.vhersey.com/2015/06/17/powercli-create-vcenter-role-and-assign-user-permissions/

# Get Commandline Parameters - All are required
param(
[string]$vCenter,
[string]$Username,
[string]$Domain,
[string]$RoleName
)

clear-host

$usage = "Create_Custom_Role.ps1 -vCenter vCenterFQDNorIP -Username CustomServiceAccountName -Domain AuthenticationDomain -RoleName CustomRoleName"
$example = 'Create_Custom_Role.ps1 -vCenter "vcenter.acme.local" -Username svtuser -Domain acme -RoleName CustomRoleName'

Write-Host "PowerCLI script to create Custom Role which includes required privileges and assigns the Custom Service Account to Role" -ForeGroundColor Cyan

if ( !$vCenter -or !$Username -or !$Domain -or !$RoleName ) {
write-host `n `n"Missing Required Parameter - vCenter, Username, Domain, and RoleName are required." `n -ForeGroundColor Red
write-host "Usage: $usage" `n
write-host "Example: $example" `n
exit
}

write-host "vCenter: $vCenter"
write-host "User: $Username"
write-host "Domain: $Domain"
write-host "RoleName: $RoleName"

$vCenterFQDN = $vCenter

# Custom Service Account User
#The Custom User account is a non-login, privileged, vCenter Server account that you specify during deployment. OmniCube uses this account to execute privileged tasks.
$Custom_User = "$Domain\$Username"

# Custom Role Name
#Edit - No a paramater
#$Custom_Role = "Custom"

# Privileges to assign to role
# See the product Administrators Guide for Required Permissions
# Nimble vCenter Privileges
$Custom_Privileges = @(
'Datastore.AllocateSpace',
'Datastore.Config',
'Datastore.Delete',
'Datastore.Move',
'Datastore.Rename',
'Extension.Register',
'Extension.Unregister',
'Extension.Update',
'Global.CancelTask',
'Host.Config.AdvancedConfig',
'Host.Config.NetService',
'Host.Config.Settings',
'Host.Config.Storage',
'StoragePod.Config',
'StorageViews.ConfigureService',
'StorageViews.View',
'System.Anonymous',
'System.Read',
'System.View',
'Task.Create',
'Task.Update')
# Original Script Simplivity Privileges
# 'Alarm.Create',
# 'Alarm.DisableActions',
# 'Alarm.Edit',
# 'Alarm.SetStatus',
# 'Alarm.Delete',
# 'Extension.Register',
# 'Extension.Update',
# 'Extension.Unregister',
# 'Global.Health',
# 'Global.LogEvent',
# 'Global.ManageCustomFields',
# 'Global.SetCustomField',
# 'Global.Diagnostics',
# 'Host.Cim.CimInteraction',
# 'Task.Create',
# 'Task.Update',
# 'VApp.AssignVApp',
# 'VApp.Unregister',
# 'VApp.ApplicationConfig',
# 'VirtualMachine.Config.ManagedBy',
# 'VirtualMachine.Config.Settings',
# 'VirtualMachine.State.RemoveSnapshot',
# 'VirtualMachine.State.CreateSnapshot'

Write-Host "Connecting to vCenter at $vCenterFQDN"`n -ForeGroundColor Cyan
Connect-VIServer $vCenterFQDN | Out-Null

Write-Host "Create New $RoleName Role"`n -ForeGroundColor Cyan
New-VIRole -Name $RoleName -Privilege (Get-VIPrivilege -id $Custom_Privileges) | Out-Null

Write-Host "Set Permissions for $Custom_User using the new $RoleName Role"`n -ForeGroundColor Cyan
#Get the Root Folder
$rootFolder = Get-Folder -NoRecursion
#Create the Permission
New-VIPermission -Entity $rootFolder -Principal $Custom_User -Role $RoleName -Propagate:$true | Out-Null

#Disconnect from the vCenter Server
Write-Host "Disconnecting from vCenter at $vCenterFQDN"`n -ForeGroundColor Cyan
Disconnect-VIServer $vCenterFQDN -Confirm:$false

#End

mamatadesaiNim
HPE Blogger

Re: vCenter permissions when using the plugin

Thank you for letting us know, and for the neat script!

Our docs will be updated with the upcoming version of our vcplugin :)

--m

HPE Nimble Storage