Have you ever tried to automate a specific vSphere operation but were sure which vSphere API to use or if known, how to actually use it? This is something I frequently see and get asked about quite often!
Did you know about this hidden little gem that has been available since vSphere 6.7, built right into the vSphere UI that can help with these questions!?
It is called vSphere Code Capture or what I typically refer to as your ChatGPT for vSphere Automation, but without the hallucinations 😀
For some organizations, after a VM has been provisioned, it is customary to send a notification (email, slack, etc) to their end users with login credentials including the URL for the vSphere UI.
Typically, the provided URL is just the vCenter Server base URL and end users would then have to login and navigate to their specific VM(s) within the vSphere Inventory. A question was brought up on whether a better end user experience could be provided to their internal users? They were interested in providing their end users with a specific URL link that would take them directly to their VM, which they can also bookmark for future uses.
Furthermore, the customer was also interested in generating the URL programmatically, so that it can be incorporated into their existing provisioning workflows.
This was an interesting request that came up on the VMTN community forums asking whether it was possible to block users from accessing the vSphere HTML5 (H5) VM Console in vCenter Server and only allowing access to a VM console through the use of the Standalone VM Remote Console (VMRC) client? What is the use case for this you might ask, well it looks like VM screen resolution was getting change between the two clients and the administrator simply wanted to restrict access to the H5 VM Console and direct users to use only the VMRC Client.
At first, I could not see how this could be accomplished since all of their users already have the "Console interaction" privilege within vCenter Server which allows them to to interact with both VM Console interfaces. I was then reminded of an article that I wrote back in 2021 where a user wanted to restrict access to the vSphere UI interface while still allowing access to vCenter Server through the vSphere API, which used an access policy to restrict access based on a URI endpoint within the vCenter Server Tomcat application configuration.
This gave me an idea to experiment with and see if we could do the same and simply restrict the /ui/vmconsole endpoint which serves the H5 VM Console while still preserving VMRC access.