Powershell CIM cmdlets with a custom namespace/provider

[vromanowski]

We have a CIM provider with our own namespace, etc. I'm trying to figure out how to enumerate instance of our classes, call methods, etc... but as soon as I change the namespace I get an "Invalid Argument".

Using a WBEM client everything works fine however. It seems that our issues are only when trying to use WS-MAN.

import-module CimCmdlets

$Ipaddress = "10.102.206.99"
$HostUsername = Get-Credential root 

$CIOpt = New-CimSessionOption -SkipCACheck -SkipCNCheck -SkipRevocationCheck -Encoding Utf8 -UseSsl
$Session = New-CimSession -Authentication Basic -Credential $HostUsername -ComputerName $Ipaddress -port 443 -SessionOption $CIOpt

$Session

Get-CimInstance -CimSession $Session -Namespace "root/cimv2" -ClassName "CIM_ComputerSystem" <==== works fine, returns info
Get-CimInstance -CimSession $Session -Namespace "root/cimv2" -ClassName "CIM_Processor" <==== works fine
Get-CimInstance -CimSession $Session -Namespace "root/cimv2" -ClassName "CIM_EthernetPort" <==== works fine
Get-CimInstance -CimSession $Session -Namespace "micron/cimv2" -ClassName "MICRON_SATADevice"    <==== This one blows up

Get-CimInstance : The WS-Management service cannot process the request. The resource URI is missing or it has an

incorrect format. Check the documentation or use the following command for information on how to construct a resource

URI: "winrm help uris".

At C:\Users\kvroman\Desktop\kvroman.ps1:14 char:1

+ Get-CimInstance -CimSession $Session -Namespace "micron/cimv2" -ClassName "MICRO ...

+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    + CategoryInfo          : InvalidArgument: (micron/cimv2:MICRON_SATADevice:String) [Get-CimInstance], CimException

    + FullyQualifiedErrorId : HRESULT 0x8033803b,Microsoft.Management.Infrastructure.CimCmdlets.GetCimInstanceCommand

    + PSComputerName        : 10.102.206.99

Anyone have any ideas?

[LucD]

Is the MOF file for your WMI provider correct ?

Can you access the WMI provider with the wmic command fro the command prompt ?

[vromanowski]

Our .mof is really simple, 1 parent class and 2 sub-classes with a few methods. Enumerating instances, calling methods, etc. works great from the wbemcli command line too, the sblim java api, and python's pywbem module.

I haven't tried WMI yet, I don't see many examples on how to use it with a CIM provider but I'll keep looking. I don't think WMI is part of the issue though, from my brief search it looks like WMI is Window's implementation of WBEM, and WBEM works fine for us. It's the WS-Management (SOAP protocol) that is giving us trouble.

In the VMware docs it states that the CIMOM can be reached via WBEM or WS-MAN, but all the examples are with WBEM.

Is WS-MAN support for interacting with the CIMOM just not fully supported or something?

[LucD]

No, should work via WSMAN.

What does the Protocol property in the $Session variable say ?

[vromanowski]

It says "WSMAN"

[LucD]

So you seem to be able to connect over WSMAN with the ESXi CIM provider.

Only the WMI provider you developed doesn't seem to work (error you gave earlier).

I would suggest to test the WMI provider you developed with another tool, for example CIM Studio.

Does that work ?

[vromanowski]

Can CIM Studio be used to connect to an external ESXi host? I'm going to "Browse for Namespace"  and putting the ESXi host's ip address in the Machine Name field. Tried different values for Starting Namespace. Hit Connect. Nothing seems to be happening. I can connect with the above power shell script though.

Only the WMI provider you developed doesn't seem to work (error you gave earlier).

Everything works fine through WBEM though, so doesn't that mean our CIM provider is working fine? Only connecting through WS-MAN isn't working, so could it be a configuration issue on the ESXi host? No configuration has been changed, but I don't understand why WS-MAN is the only thing we're having issues with. We're running ESXi 5.5 if that helps.

[LucD]

Afaik CIM STudio should be able to do that.

Should be the same concept as using a web browser to connect (see Connections from Client to CIM Server).

[vromanowski]

I've seen that page. All of those methods work, except for the ones utilizing SOAP/WS-MAN.

Do you know if any changes need to be made to /etc/openwsman/openwsman.conf?

[LucD]

Not that I know of, I'm afraid.

You obviously checked all the obvious stuff ?

• wsman service is running on the ESXi node
• the firewall allows the wsman traffic
• a restart of the wsman service
• any wsman related messages in the syslog

[vromanowski]

Yes to all of those. The example script I posted above works, until you change namespaces

[ccalvetTCC]

Could it be linked to WS-Management Resource URIs ?

For WS-Management connections, the client must also specify a resource URI when accessing CIM objects

If you use instead something like

Get-CimInstance -CimSession $Session -Namespace "micron/cimv2" -ResourceUri "Replace this by what is relevant for this class/MICRON_SATADevice"

"MICRON_" is not a known ClassPrefix so i guess that the person who has developed this MICRON class has also provided a Resource URI to be used with it.

[vromanowski]

Yeah I looked into that too, I'm not sure what we would put for Resource URI.

We have a namespace, "micron/cimv2", but we never had to declare a resource uri. This isn't required for use with WBEM.

Our CIM Provider dev said he never had to create a "Resource URI" either.

Would I just use something like "micron/cimv2/CLASS_Name"?

[ccalvetTCC]

Get-CimInstance -CimSession $Session -Namespace "micron/cimv2"

The namespace seems to be at the right place.

However i will think that the -ResourceUri should use somthing similar to

"http://schemas.vmware.com/wbem/wscim/1/cim-schema/2/MICRON_SATADevice"

"http://schema.omc-project.org/wbem/wscim/1/cim-schema/2/MICRON_SATADevice"

"http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/MICRON_SATADevice"

(And the first part has to be obtained from the vendor)

[vromanowski]

Yeah I ran this by the CIM provider dev earlier this morning, he had no idea what I was talking about.

Can I just make a URI up? What does the URI have to do with our namespace? Our .mof is really simple, just a couple classes with member variables and methods.

Maybe our namespace inherits a schema? I'm not really sure where to go from here.

[ccalvetTCC]

Maybe the limitation is between Powershell and this CIM provider implementation (And not related to ESXi, actually it will be interesting if you can install the same provider on a windows machine)

Introduction to CIM Cmdlets

PowerShell 3.0 shipping with Windows server 2012 and Windows 8 brings a new set of Cmdlets to manage any server or device that complies with CIM and WS-Man standards defined by DMTF.

Seems to be that

http://www.dmtf.org/standards/wsman

Get-CimInstance

-ResourceUri<Uri>

Specifies the resource uniform resource identifier (URI) of the resource class or instance. The URI is used to identify a specific type of resource, such as disks or processes, on a computer.

A URI consists of a prefix and a path to a resource. For example:

http://schemas.microsoft.com/wbem/wsman/1/wmi/root/cimv2/Win32_LogicalDisk
http://intel.com/wbem/wscim/1/amt-schema/1/AMT_GeneralSettings

By default, if you do not specify this parameter, the DMTF standard resource URI http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/ is used and the class name is appended to it.

ResourceURI can only be used with CIM sessions created using the WSMan protocol, or when specifying the ComputerName parameter, which creates a CIM session using WSMan.

We have a namespace, "micron/cimv2", but we never had to declare a resource uri. This isn't required for use with WBEM.

So maybe you have managed to access this namespace with a "WBEM" protocol, but to have this namespace available via GET-CimInstance it must be designed for WS-MAN protocol according to WS-MAN standards.

[vromanowski]

So maybe you have managed to access this namespace with a "WBEM" protocol, but to have this namespace available via GET-CimInstance it must be designed for WS-MAN protocol according to WS-MAN standards.

Thank you so much. This makes the most sense. I'll run it by our provider dev.

[vromanowski]

Just to play devils advocate, how does a CIM provider need to be developed specifically for WS-MAN?

The CIMOM VMware uses is SFCB, which only supports WBEM.

The WS-MAN access to CIM is a VMware solution, acting as a 'proxy' sort of between the CIMOM and WS-MAN.

Do you see where I'm going? SFCB was never designed to be accessed by WS-MAN, VMware put openwsman on ESXi as an alternate solution, and requests through port 443 supposedly hit ws-man and get proxied to the cimom.

[ccalvetTCC]

This topic is challenging

The fact that you manage to access this CIM without get-ciminstance prove that it has been "published somehow" by VMware.

However my guess is that "get-ciminstance" will only work if it is "published somehow via WS-MAN according to WS-MAN standard" by VMware
It looks like a limitation of "get-ciminstance" and not necessary a limitation of ESXi.

Maybe there is a possibility to access this CIM now from powershell but with something different than "get-ciminstance".
Ideally something replicating the behavior of the other tool that you have used to connect successfully to this CIM so far.

[ccalvetTCC]

Actually you taught me something new.

Never heard about this SFCB before. But it makes sense.

The WS-MAN access to CIM is a VMware solution, acting as a 'proxy' sort of between the CIMOM and WS-MAN.

It seems that you are correct

The VMware CIM SMASH/Server Management API supports the following protocols:

CIM-XML over HTTP or HTTPS

WS-Management over HTTP or HTTPS

SLP

So in that case could you try to enable logging for SFCB in a test ESXi servers?

Enabling and configuring Tracing/Logging for the SFCB CIMOM on ESXi 5.x machines

Maybe you will get valuable information from the logs if you try multiples scenario.

Connect via wbem to a known working class, and the "MICRON_SATADevice"

Connect via get-CIM instance to a known working class

Try to connect via get-CIM instance to the "MICRON_SATADevice"

The Get-CIMInstance will probably connect to the "WS-Management over HTTP or HTTPS" and as you mention, VMware will then redirect to SFCB and finally to the CIMOM.

I am wondering, if while you are using the wbem client, you connect directly to the SFCB component and consequently bypassing this "proxy" (And working in a way not planned by VMware) (Or maybe just using the SLP)

And the resulting question is does this CIM provider has been designed according to VMware constraints?

The namespace is not in the default implementation namespace. (I do not know if this is supposed to work in this condition)

Could you please check if this CIM provider has been properly registered?

VMware recommends that CIM clients list the registered profiles before you use them for other purposes. If a profile is not present in the registration list (CIM_RegisteredProfile), the profile is not implemented or is incompletely implemented.

Listing Registered Profiles

You can use for this:

Get-CimInstance -CimSession $Session -Namespace 'root/interop' -ResourceUri "http://schemas.dmtf.org/wbem/wscim/1/cim-schema/2/CIM_RegisteredProfile"