topic Re: unable to add these Privileges to vCenter role in VMware PowerCLI Discussions

unable to add these Privileges to vCenter role

toffaha1 — Wed, 27 Jul 2022 15:12:00 GMT

Hi all,

I am trying to add vCenter privileges to a role via PowerCLI as the following but not sure why it keeps throwing errors.

System.View
System.Read
Global.LogEvent
Global.Licenses
Global.DisableMethods
Global.EnableMethods
Folder.Create
Folder.Delete
Datastore.Rename
Datastore.Move
Datastore.Delete
Datastore.Browse
Datastore.DeleteFile
Datastore.FileManagement
Datastore.AllocateSpace
Datastore.Config
Datastore.UpdateVirtualMachineFiles
Datastore.UpdateVirtualMachineMetadata
Network.Assign
DVSwitch.Create
DVSwitch.Delete
DVPortgroup.Create
DVPortgroup.Modify
Host.Config.Storage
Host.Local.DeleteVM
VirtualMachine.Inventory.Create
VirtualMachine.Inventory.Register
VirtualMachine.Inventory.Delete
VirtualMachine.Inventory.Unregister
VirtualMachine.Interact.PowerOn
VirtualMachine.Interact.PowerOff
VirtualMachine.Interact.GuestOperatingSystemManagementByVIXAPI
VirtualMachine.GuestOperations.Query
VirtualMachine.GuestOperations.Modify
VirtualMachine.GuestOperations.Execute
VirtualMachine.Config.AddExistingDisk
VirtualMachine.Config.AddNewDisk
VirtualMachine.Config.RemoveDisk
VirtualMachine.Config.RawDevice
VirtualMachine.Config.HostUSBDevice
VirtualMachine.Config.AdvancedConfig
VirtualMachine.Config.SwapPlacement
VirtualMachine.Config.ChangeTracking
VirtualMachine.State.CreateSnapshot
VirtualMachine.State.RevertToSnapshot
VirtualMachine.State.RemoveSnapshot
VirtualMachine.Provisioning.DiskRandomRead
VirtualMachine.Provisioning.GetVmFiles
Resource.AssignVMToPool
Resource.HotMigrate
Resource.ColdMigrate
VApp.AssignVM
VApp.AssignResourcePool
VApp.Unregister

errors

Get-VIPrivilege : 7/27/2022 3:10:32 PM Get-VIPrivilege VIPrivilege with id 'VApp.AssignResourcePool ' was not found using the specified filter(s).
At line:1 char:38
+ ... -Privilege (Get-VIPrivilege -Server $viserver -id $cvRoleIds) -Serve ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (:) [Get-VIPrivilege], VimException
+ FullyQualifiedErrorId : Core_OutputHelper_WriteNotFoundError,VMware.VimAutomation.ViCore.Cmdlets.Commands.PermissionManagement.GetVIPrivilege

Get-VIPrivilege : 7/27/2022 3:10:32 PM Get-VIPrivilege VIPrivilege with id 'VApp.Unregister ' was not found using the specified filter(s).
At line:1 char:38
+ ... -Privilege (Get-VIPrivilege -Server $viserver -id $cvRoleIds) -Serve ...
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : ObjectNotFound: (:) [Get-VIPrivilege], VimException
+ FullyQualifiedErrorId : Core_OutputHelper_WriteNotFoundError,VMware.VimAutomation.ViCore.Cmdlets.Commands.PermissionManagement.GetVIPrivilege

Re: unable to add these Privileges to vCenter role

LucD — Wed, 27 Jul 2022 16:20:37 GMT

Looks like you have a space (blank) after VApp.AssignResourcePool and VApp.Unregister.

Re: unable to add these Privileges to vCenter role

toffaha1 — Thu, 28 Jul 2022 11:51:07 GMT

Thanks @LucD , you're the best

can you please tell me the correct filter for =>VirtualMachine.Interact.GuestOperatingSystemManagementByVIXAPI, as I can't find it with get filter

Get-VIPrivilege : 7/28/2022 11:48:34 AM Get-VIPrivilege VIPrivilege with id 'VirtualMachine.Interact.GuestOperatingSystemManagementByVIXAPI' was not found using the specified filter(s).

Re: unable to add these Privileges to vCenter role

LucD — Thu, 28 Jul 2022 12:27:06 GMT

To be honest I have never heard of that privilege.
Where did you see it?

Re: unable to add these Privileges to vCenter role

toffaha1 — Thu, 28 Jul 2022 12:54:14 GMT

I can see it listed here but I think the filter is written in a wrong way

https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.security.doc/GUID-3D47149A-947D-4608-88B3-E5811129EFA8.html

Re: unable to add these Privileges to vCenter role

LucD — Thu, 28 Jul 2022 13:46:09 GMT

Not sure which filter you mean?
If I list the privileges via the API (not via Get-VIPrivilege) that one doesn't seem to appear.

$si = Get-View ServiceInstance $authMgr = Get-View -Id $si.Content.AuthorizationManager $authMgr.PrivilegeList | where{$_.PrivId -match 'VirtualMachine.Interact'}

Afaik, the VIX API was terminated in favor of the GuestOperations.
I'm not sure why it would still be listed in documentation for vSphere 7

Re: unable to add these Privileges to vCenter role

toffaha1 — Mon, 01 Aug 2022 22:55:34 GMT

Thanks

may be it's removed as you mentioned.