pyvmomi permission denied error

[aijazbaig1]

Hello

I am getting the following error when trying to use pyvmomi to get a list of VMs from the vcenter server appliance.

pyVmomi.VmomiSupport.vim.fault.NoPermission: (vim.fault.NoPermission) {
   dynamicType = <unset>,
   dynamicProperty = (vmodl.DynamicProperty) [],
   msg = 'Permission to perform this operation was denied.',
   faultCause = <unset>,
   faultMessage = (vmodl.LocalizableMessage) [],
   object = 'vim.Folder:group-d1',
   privilegeId = 'System.View',
   missingPrivileges = (vim.fault.NoPermission.EntityPrivileges) [
      (vim.fault.NoPermission.EntityPrivileges) {
         dynamicType = <unset>,
         dynamicProperty = (vmodl.DynamicProperty) [],
         entity = 'vim.Folder:group-d1',
         privilegeIds = (str) [
            'System.View'
         ]
      }
   ]
}

This is my python code :

import atexit
import ssl
from pyVim import connect
from pyVmomi import vim
import pdb


def vconnect(hostIP):
    if (True):
        context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
        context.check_hostname = False
        context.verify_mode = ssl.CERT_NONE  # disable our certificate checking for lab
    else:
        context = ssl.create_default_context()
        context.options |= ssl.OP_NO_TLSv1_3
    #cipher = 'DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA:ECDHE-ECDSA-AES128-GCM-SHA256'
    #context.set_ciphers(cipher)
   
    pdb.set_trace()
    service_instance = connect.SmartConnect(host=str(hostIP),  # build python connection to vSphere
                                            user="root",
                                            pwd="SillyPassword",
                                            sslContext=context)

    atexit.register(connect.Disconnect, service_instance)  # build disconnect logic

    content = service_instance.RetrieveContent()

    container = content.rootFolder  # starting point to look into
    viewType = [vim.VirtualMachine]  # object types to look for
    recursive = True  # whether we should look into it recursively
    containerView = content.viewManager.CreateContainerView(container, viewType, recursive)  # create container view
    children = containerView.view

    for child in children:  # for each statement to iterate all names of VMs in the environment
        summary = child.summary
        print(summary.config.name)

# connecting to nested ESX host
vconnect("192.168.160.160")

# connecting to vcenter server appliance
vconnect("192.168.160.170")

So I am using a nested ESX that runs on my workstation 16. I have deployed the vcsa on this ESX host via the windows CLI installer. Querying the ESX host works fine whereas querying the vcsa gives me the above error.

I looked at this discussion which talks about setting 'global permissions'; however on my vcenter server management VM, my 'administration' tab does not look anything like this

What it looks like, is this:

So apparently I have a 'vcenter server management' appliance and not what is referred to as the 'vsphere client'.

So with this context set, I have some questions:

1. Is the error above due to my trial license?
2. How is the 'vcenter server management (vcsa)' appliance different from the 'vsphere client'?
3. Is it possible to change 'global permissions' on the vcsa or do I need to get the 'vsphere client' to do that?

Keen to hear from you soon

[maksym007]

What is your vCenter version/build? 

[aijazbaig1]

Hi.

File version.txt inside the VCSA installer iso reads:
VMware-vCenter-Server-Appliance-8.0.0.10200-21216066 .

For the ESXi:

[root@ESXi6:~] vmware -vl
VMware ESXi 8.0.0 build-21203435
VMware ESXi 8.0 GA
[root@ESXi6:~]

I think I do not have what is referred to as the 'vsphere client' . Plus, I am a bit confused between these tools (as per my original question). Could you please shed some light on it too?

[StephenMoll]

The top screen shot is from the vSphere Webclient interface accessed via "https://{vcsa-address}/ui".

The bottom screen shot if from the VAMI (Virtual Appliance Management Interface) accessed via "https://{vcsa-address}:5480".

They are different UI's.

[aijazbaig1]

Thanks a bunch @StephenMoll for clearing this for me. I believe VMWare should add this information to the console. As it currently stands, this is what I see on the vcsa console. No mention about accessing the webclient interface at all.

I was utterly confused about the vSphere client and even downloaded the C# version of it only to find out it is no longer supported.

Nonetheless, I can now access the web client interface. So to get the pyvmomi script working, I believe I need to add a user to it and give it administrator privileges right? Should that solve this? I see that user `root` belongs to the domain `localos` whereas 'Administrator` belongs to the domain `vsphere.local`.  Can I use this `root` user in my pyvmomi scripts?