WilliamLam.com

Getting Rid of the Inventory Tree in the New vSphere Web Client

by // 2 Comments

I don't know about you, but I really like using the new inventory list compared to the old inventory tree when I need to find something in new vSphere Web Client. The inventory list does not rely on the static and limited hierarchical tree view to display your vSphere objects. Instead, it groups common vSphere objects together (works across multiple vCenter Servers) along with links to other related objects. This allows you to quickly navigate to a particular vSphere object and with just a click away to other related objects for further inspection. Finally, you will no longer have to worry about the "white screen of death" which was a common problem when trying to display huge inventories and sometimes even smaller ones while using the tree view.

To be honest, I was not a fan of the inventory list at first, but after spending some time with it, I quickly realized the benefits of moving away from the old hierarchical tree view. I actually like the new inventory list so much, that I personally wanted like to get rid of the inventory tree view as it is an extra mouse movement to get to the inventory list. I sometimes even accidentally click on the inventory tree when browsing too quickly through the vSphere Web Client.

I thought it might be a long shot to see if it was possible to remove the inventory tree since I assumed it might be part of the compiled code. Surprisingly, I found out from one of the developers, there was actually a pretty simple way (aka "hack") of removing the inventory tree.

Disclaimer: This is probably not officially supported by VMware, please use at your own risk.

In the example below, I am using the VCSA (vCenter Server Appliance) which has the vSphere Web Client installed by default but this should also work for a Windows vCenter Server that has the vSphere Web Client Server installed.

Step 1 - We need to make a backup of the following file /usr/lib/vmware-vsphere-client/plugin-packages/vsphere-client/plugins/inventory-viewer-war-5.1.0.war which contains the file that we need to edit. The command below will just make a backup copy called inventory-viewer-war-5.1.0.war.BAK

cp /usr/lib/vmware-vsphere-client/plugin-packages/vsphere-client/plugins/inventory-viewer-war-5.1.0.war /usr/lib/vmware-vsphere-client/plugin-packages/vsphere-client/plugins/inventory-viewer-war-5.1.0.war.BAK

Step 2 - Next, we will go ahead and extract the contents of the WAR file which is basically a zip archive in our home directory so that we can edit a file. Run the following command which will extract the contents into a directory called TEMP under /root.

unzip /usr/lib/vmware-vsphere-client/plugin-packages/vsphere-client/plugins/inventory-viewer-war-5.1.0.war -d ~/TEMP

Step 3 - Change into the ~/TEMP directory and you should see a file called plugin.xml which we will be editing. Use an editor such as vi and locate the following section and comment it all out using the notation as shown below
Step 4 - Once you have finished editing the plugin.xml file, go ahead and save the file. Now we will need to re-create the inventory-viewer-war-5.1.0.war file and to do so, inside the TEMP directory, run the following command:

zip -r inventory-viewer-war-5.1.0.war *

Step 5 - We now need to copy the modified inventory-viewer-war-5.1.0.war back into the vSphere Client Plugins directory. Run the following command to copy the WAR file into plugins directory:

cp inventory-viewer-war-5.1.0.war /usr/lib/vmware-vsphere-client/plugin-packages/vsphere-client/plugins/inventory-viewer-war-5.1.0.war

Step 6- Finally, for the changes to go into effect, we just need to restart the vSphere Web Client service by running the following command:

/etc/init.d/vsphere-client restart

If everything was successful, then you should be able to login to the vSphere Web Client and when you click on the main vCenter home on the left, you should no longer see the inventory tree view, just the inventory lists.

Even though we removed the inventory tree from the object navigator, you can still access the four tree views using the shortcuts found on the home page:

If you really want to disable those as well, you can comment out the following four sections:
OR better yet, re-link them to the main vCenter home view by adjusting the targetViewUid to point to vsphere.core.viHome.domainView

Using the New vCloud Networking and Security to Load Balance Multiple vSphere Web Client Servers

by // 1 Comment

If you followed my previous two articles Configuring Additional Windows vSphere Web Client 5.1 Servers & Configuring Additional VCSA 5.1 as vSphere Web Client Servers I demonstrated how easy it is to add additional vSphere Web Client Servers to provide additional connection load balancing as well as redundancy in accessing your vSphere 5.1 environment. The next logical step is to actually place a load balancer in front of all the vSphere Client Servers to provide a single entry point for users to connect to.

I did a quick search for some load balancer solutions for testing, but found that they were quite complex and non-intuitive to setup. Since this was for my home lab, I decided to try out the new vCloud Networking & Security 5.1 (previously known as vShield). This being my first time setting up a load balancer (usually a task given to Network Engineers), I was pleasantly surprised and shocked at how easy it was to deploy and configure a load balancer using the new vCloud Networking and Security. Instead of going through this step by step, I thought I record a quick video.

The video below shows how you can leverage the new vCloud Networking & Security 5.1 to deploy and configure a Load Balancer to load balance multiple vSphere Web Client Servers.

If you have not tried out the new vCloud Networking and Security, I highly recommend you give it a try, especially with all the new network and security features in the latest 5.1 release.

How to Add/Remove vCenter SSO Identity Sources Using the Command-Line for Windows vCenter Server & VCSA

by // 16 Comments

The new vCenter SSO (Single Sign-On) in vSphere 5.1 can support multiple Identity Sources (Active Directory, OpenLDAP and Local OS) and these configurations can all be managed by using the vSphere Web Client. Here are some additional documentation as well as a video on how to managing Identity Sources using the vSphere Web Client.


However, if you wish to manage the Identity Sources through the command-line for automated deployments, you probably do not want to use the GUI. Luckily, there is a vCenter SSO CLI that you can use on both a Windows deployment as well as on the VCSA (vCenter Server Appliance).

In the examples below, I will show you how to add an Active Directory Identity Source to both a Windows deployment as well as a VCSA deployment using the command-line.

Adding Active Directory Identity Source to Windows vCenter SSO Server

Before getting started, you will need to know the vCenter SSO Administrator password. This is the password that you had configure during the installation of vCenter SSO for the admin@System-Domain account.

Step 1: Change into the C:\Program Files\VMware\Infrastructure\SSOServer\utils directory and you will be using the rsautil command-line tool. To get a list of help options for managing Identity Sources, run the following command:

rsautil manage-identity-sources

Step 2:  Run the following command (substitute the values for your own enviornment) :

rsautil manage-identity-sources -a create -u admin -p !VMware123! -r ldap://fullerene.primp-industries.com --ldap-port 3268 -d primp-industries.com -l PRIMP-IND --principal-base-dn DC=primp-industries,DC=com --group-base-dn DC=primp-industries,DC=com -f "" -L *protected email*

Note: When you login into the vSphere Web Client, the username for the vCenter SSO account is "admin@system-domain" but for the CLI, it is just "admin". If you do not have a failover LDAP Server, specify "" for -f flag.

Here is a screenshot of adding the Active Directory Identity Source:

Step 3: You can also confirm the configurations by performing the "list" operation by running the following command:

rsautil manage-identity-sources -a list -u admin -p !VMware123!

Adding Active Directory Identity Source to VCSA

For the VCSA, there are few additional steps as the vCenter SSO Administrator account "admin" does not contain a default password as noted in this article. You can either follow the instructions in that article to set a password for the "admin" user and then jump to Step 3 OR you can perform all required steps using the command-line.

Step 1: We first need to set the vCenter SSO Master Password as it is required to change the "admin" user account. Since the vCenter SSO Master Password is auto-generated during installation, we will recover the account which will then allow us to set a password of our own choosing. Run the following two commands and in the second command, you will specify the vCenter SSO Master Password of your choice.

source /etc/vmware-sso/keys/recovery.cfg
/usr/lib/vmware-sso/utils/ssowrench manage-secrets -a change -u "$SSO_RECOVERY_USERNAME" -p "$SSO_RECOVERY_PASSWORD" -N vmware123

Note: Do not forget the vCenter SSO Master Password that you have selected, as there is no way to recover the account after this.

Step 2: Now that we have the vCenter SSO Master Password, we can now set a password for the "admin" user. Run the following command and specify the Master Password (-m flag) as well as a new password (-p flag) for the admin (-u flag) user.

/usr/lib/vmware-sso/utils/ssowrench reset-admin-password -u admin -p '!VMware123!' -m vmware123

Step 3: Once we have a password set for the "admin" user, we will be using the same vCenter SSO CLI utility as we did in the Windows vCenter Server deployment but in the VCSA it is called ssowrench and it is located under /usr/lib/vmware-sso/utils

Run the following command which accepts the same set of options as the Windows version (substitute the values for your own enviornment).

/usr/lib/vmware-sso/utils/ssowrench manage-identity-sources -a create -u admin -p '!VMware123!' -r "ldap://fullerene.primp-industries.com" --ldap-port 3268 -d primp-industries.com -l PRIMP-IND --principal-base-dn "DC=primp-industries,DC=com" --group-base-dn "DC=primp-industries,DC=com" -f "" -L *protected email*

Here is a screenshot of adding the Active Directory Identity Source:

Step 4: To view all Identity Sources, you can run the following command (as seen in the screenshot above):

/usr/lib/vmware-sso/utils/ssowrench manage-identity-sources -a list -u admin -p '!VMware123!'

Note: If you do not wish to specify any of the credentials on the command-line, the utility in both Windows and VCSA will automatically prompt for input.