Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

vCenter user privileges doesn't handle groups #102

Open
nathcoad opened this issue Sep 29, 2022 · 0 comments
Open

vCenter user privileges doesn't handle groups #102

nathcoad opened this issue Sep 29, 2022 · 0 comments
Assignees
Labels
bug Something isn't working
Milestone

Comments

@nathcoad
Copy link

Describe the bug
The As Built Report for vSphere is unable to determine privileges of user running the report if they receive privileges via a group (eg Active Directory group) rather than directly assigned.

To Reproduce
Steps to reproduce the behavior:

  1. Run the As Built Report against a vCenter
  2. Output includes messages such as "Insufficient user privileges to report vCenter Server licensing"

Expected behavior
As built report should be aware of privileges allocated via AD group.

Screenshots
If applicable, add screenshots to help explain your problem.

System (please provide the following information about the system from which you are trying to generate a report):

  • OS: Windows 2012R2
  • Windows PowerShell version 5.1
  • 3rd party PowerShell module name and version PowerCLI 12.4.1
  • AsBuiltReport Core module version 1.2.0
  • AsBuiltReport Report module name and version AsBuiltReport.VMware.vSphere 1.3.3.1

Additional context
Code in Invoke-AsBuiltReport.VMware.vSphere.ps1 beginning line 50 can be changed to instead check the effective user privileges rather than looking for directly assigned role.
For example, to get a list of the effective privileges at the top level in vCenter, you could use code like this. Then you can compare that list against the expected required privilege for a given piece of information (eg Global.Licenses for the ESXi licenses"

$AuthMgr = Get-View $($vCenter.ExtensionData.Content.AuthorizationManager)
$Privileges = $authMgr.FetchUserPrivilegeOnEntities("Folder-group-d1", $vCenter.User)
@tpcarman tpcarman added the bug Something isn't working label Sep 29, 2022
@tpcarman tpcarman added this to the v1.4.0 milestone Oct 12, 2022
@tpcarman tpcarman self-assigned this Oct 12, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants