WilliamLam.com

Search Results for: vsphere events

vSphere Tag Attach/Detach events now in VMware Cloud on AWS

by // 4 Comments

The underlying products (vSphere, vSAN & NSX) that run within VMware Cloud on AWS (VMC) are constantly being improved with new capabilities and enhancements. As a service, VMC is updated more frequently than a traditional on-premise environment and one huge benefit for our customers is that they get to access all the latest and greatest features of the platform!

Yesterday, I came to learn about some improvements that we had made to our vSphere Tagging infrastructure to start publishing vCenter Server Events for when a vSphere Tag is attached or detached from an inventory object such as a Virtual Machine. This has been a frequently requested feature by our customers, especially for auditing purposes and this also enables the ability to perform additional actions through the use of a vCenter Alarm.

UPDATE (10/13/20) - vSphere 7.0 Update 1 now includes vCenter Events for both vSphere Tag Attach/Detach operations. For complete list of out of the box vCenter Server Events, you can refer to this Github repo.

In the vSphere UI for a VMC vCenter Server, you can now see these new tagging events by selecting the vCenter Server inventory object and then go to Monitor->Events and filter by "attached tag" or "detached tag".


[Read more...]

vSphere 6.5b prevents vSphere Web Client logins for users w/o VC permissions

by // 8 Comments

A patch update was just released for vCenter Server 6.5, dubbed vSphere 6.5b. While glancing through the release notes, I caught one interesting "resolved issue" which I thought was worth sharing.

Users with no vCenter Server permissions can log in to the vSphere Web Client

Users without permissions can log in to the vSphere Web Client. Users can click the menu options, but no inventory is displayed.

Users with no permissions can no longer log in to the vSphere Web Client.

To enable the login, set the allow.user.without.permissions.login = true property in the webclient.properties file.

This particular behavior has been something that has confused a few customers and has been asked about since the introduction of vCenter Single Sign-On (SSO) service. The issue or rather the confusion is that prior to the SSO service, vCenter Server handled both authentication as well as authorization.

With SSO, authentication was no longer being handled by vCenter Server and this meant that even if you had no permissions in vCenter Server but you could authenticate to SSO (especially common when Active Directory is configured), you would still be allowed to login to the vSphere Web/H5 Client.


Although vCenter Server would does the right thing and does not display any inventory if you do not have any permissions, it was still not a desired behavior in addition to the confusion it caused. I was pleasantly surprised to see that we have changed this default behavior by disallowing logins to the vSphere Web/H5 Client if a user has no VC permissions. Below is the message you will receive if you try to login without VC permissions.


If you wish to revert to the original behavior, you can do so by simply adding the allow.user.without.permissions.login = true setting into the vSphere Web/H5 Client configuration file (webclient.properties) and restart the vSphere Web/H5 Client service. I think many of our customers will appreciate this fix as well as the new default behavior!

Quick Tip - Listing all vSphere Privilege Definitions

by // Leave a Comment

By design, the vSphere platform (includes vCenter Server and ESXi) is highly extensible and additional vSphere Events and Privileges can added by 2nd and 3rd party solutions. Similiar to vSphere Events, where you can query your specific vCenter Server (or ESXI hosts) to list all vSphere Event definitions, you can also do the same for vSphere Privileges.

Using PowerCLI, we can use the Get-VIPrivilege cmdlet to help list out the vSphere Privilege Groups and the specific granular vSphere Privileges that exists within deployment.

Here is an example of listing all the different vSphere Privilege Groups that have been defined, either out of the box and/or by 2nd or 3rd party solution:

Get-VIPrivilege -PrivilegeGroup | select id,Description | Sort-Object -Property Id


As of vCenter Server 8.0 Update 3c, there are currently 111 out of the box vSphere Privilege Groups, you may have more or less depending on your version and the number of 2nd/3rd party integrations.

Here is an example of listing all the vSphere Privilege definitions that have been defined, either out of the box and/or by 2nd or 3rd party solution:

Get-VIPrivilege -PrivilegeItem | select id,Description | Sort-Object -Property Id


As of vCenter Server 8.0 Update 3c, there are currently 473 out of the box vSphere Privileges, you may have more or less depending on your version and the number of 2nd/3rd party integrations.

Additionally, you may also find these other vSphere Authorization blog posts useful: