vRO client/plug-in communication to vRO - Is it SOAP or REST API?

[kunalkhairnar]

Hi,

Though it may sound a dumb question, want to get confirmed with vRO experts in this forum.

As per my understanding, the vRO client(client.jnlp)/plug-in for vCenter Web Client uses vRO REST APIs to communicate with vRO (the legacy SOAP APIs are no longer in use) - this is for vRO 7.2.

[iiliev · Accepted solution]

Hi,

The plug-in in vSphere Web Client uses vRO REST API to communicate with vRO server.

vRO Client (client.jnlp) uses an internal private API to communicate with vRO server. It is neither REST nor SOAP, but more like RMI over HTTP.

[kunalkhairnar]

Thanks for the details. This is very helpful!

For vRO plug-in I can check with the browser developer tools and see that it's REST API calls to vRO Server.

Is there a way to see what the vRO client(client.jnlp) is using as you mentioned more like RMI over HTTP, any suggestions, thoughts are welcome.

[iiliev]

There are lot of network protocol analyzers/network proxies/packet sniffer tools (like Wireshark) that should be able to capture the network traffic. Just google about this topic.

Out of curiosity, why do you need this?

[kunalkhairnar]

Thanks for the suggestion.

I wanted to get inputs from vRO experts validating what I have observed.

>>>Out of curiosity, why do you need this?

I notice that if a user "vmuser" executes a workflow (say Create a simple virtual machine) from the vRO Client and if the vCenter is added using the super admin user account in vRO then vCenter Server sees the request being initiated by the service account i.e. the super admin user account that has full privileges on the vCenter Server. The "vmuser" has fewer privileges e.g. the default "Virtual machine user (sample) role. Is there a way to figure authorize/authenticate actual vRO user - the "vmuser" in this case that initiated the vRO workflow instead of the service account user used for adding vCenter Server to vRO. What if the vCenter Operations has to be authorized in the context of the "vmsuer" instead of the service account?