PowerCLI Export and Import Roles and Permissions Question

[VirtuallyFat]

Hey everyone.

I am working on deploying a new trio of vCenter servers in our environment.  We are consolidating down from about a dozen different vCenters since, as you can imagine, managing those is a pain.  What I am working on right now is porting over the users and permissions.  I have found a good script for moving the actual roles, but not the users.  I found LucD's scripts for exporting and importing roles and permissions, but I can't seem to get it to work correctly.  The export part works fine, it is the import part that doesn't want to play nice.  Here is a link to the scripts I am using:

Export:   http://blog.vmote.net/documents/Export-vCenter-Permissions.ps1

Import:  http://blog.vmote.net/documents/Import-vCenter-Permissions.ps1

When I run the import script, I get the following error:

Name Port  User

---- ----  ----

Exception calling "SetEntityPermissions" with "2" argument(s): "

Required parameter entity is missing

while parsing call information for method SetEntityPermissions

at line 1, column 218

while parsing SOAP body

at line 1, column 207

while parsing SOAP envelope

at line 1, column 38

while parsing HTTP request for method setEntityPermissions

on object of type vim.AuthorizationManager

at line 1, column 0"

At C:\vCenter-import-rolesandpermissions.ps1:32 char:60

+ ...  $perms = $authMgr.SetEntityPermissions($object.MoRef,@($permission))

+ ~~~~~~~~~~~

    + CategoryInfo : NotSpecified: (:) [], MethodInvocationException

    + FullyQualifiedErrorId : VimException

So it ends up looking like the SetEntityPermissions is trying to pull a parameter from a line and character that does not exist.  There is literally nothing in line 1, column 218, etc.  I am assuming that is just a weird error that is being thrown and is basically useless.  I am also assuming that this problem is related to vCenter 6.0, which is what I am trying to import into. 

Has anyone run into this issue and found a fix?  I REALLY don't want to import this junk manually.

Thanks!

[LucD]

This error can have many causes.

One of them is that the target object ($object) doesn't exist yet in the target vSphere server.

Another one is that the account under which you run the import script doesn't have the Administrator role on the target vSphere server.

Do you get the error already on the first entry in the XML file ?

Can you locate the entry in the XML file that causes the error ?

[DDHB]

I see the script preserves existing roles; we'd need to overwrite whatever we have in a given VC with previously exported "standard" roles and permissions. Would deleting lines 61-63 remove preservation of existing roles?

$authMgr.RoleList | % {

    $roleHash[$_.Name] = $_.RoleId

}

What about existing permissions? Is the script simply adding permissions from exported XML and is not removing existing permissions? The same requirement as above exists for us, we'd need to remove anything that's not in XML.

Basically our challenge is that we have dozens of VCs with messed up roles and permissions. We'd build a new reference VC, set it up correctly, export roles and permissions and then overwrite all other VCs regardless of what they currently have.

Thanks