Re: Vmware Vcenter Server Keygen Generator
Donnell Simon
Since vSphere 6.0, vSphere has been providing more and more REST based APIs.In vSphere 6.5, we introduced a new API Explorer and a number of new REST APIs, these also received significant updates in the vSphere 6.7 release. The vCenter API infrastructure provides json based metadata which describes APIs available in vCenter. This format is conceptually similar to the OpenAPI specification.
The VMware OpenAPI Generator is a python-based utility which, when pointed at a vCenter server, can read all of the available API metadata and convert them into OpenAPI specifications. This allows you and 3rd party vendors to take advantage of all the available OpenAPI tooling to create additional artifacts such as documentation, code generators, and more.
The other requirements are having Python and the vSphere Automation SDK for Python. Additional information about the installation process of both can be found at the following blog: Getting Started with the vSphere Automation SDK for Python
OpenAPI specifications offers the ability to create any number of additional resources. One example of which is documentation. We can now take the newly generated specs for each of the vSphere API services and use a tool, like ReDoc, to then create a set of documentation. We can then combine it with other REST services to give us a consistent feel across all of our API documentation!
The vSphere REST APIs continue to get better with every release. We are also creating tools, such as the brand-new VMware OpenAPI Generator, which allows customers, partners and integrators to take advantage of all the tooling available in the OpenAPI ecosystem or custom projects which work with the OpenAPI format.
Is HA really needed though, if oyu have complete power outages and no UPS or generator to take the load, HA is useless and if only one host failed/PSOD/Crashes etc, would it be drastic and costly to the business if those servers were not up?
The server rack has 2 SPDUs connected to 2 Eaton 9130 UPS units. Total battery time is about 45 minutes.
We have a generator that is supposed to take over in the event of a power outage.
Just because we have 2 SPDUs connected to 2 Eaton 9130 UPS units and protected by a generator does not mean problems will not occur. (They have)
Sorry if I came across sounding kurt. I had an overflowing plate of work and then we had a power outage on Oct 25 in which the generator did not come one, one of our 2 UPS units came within 5 minutes of triggering a shutdown (before the warehouse manager finally got the generator on-line and taking load) and a VM shutdown unexpectedly.
Yes, the UPS software takes care of the orderly shutdown of all servers. (I still need to work on the integration so that it will also gracefully shutdown the vCenter server as well as the ESXi hosts.)
One of the coolest feature that I have been personally looking forward to is the ability to access a virtual machine's remote console on a Mac OS X system which is now available as part of the vSphere 5.5 release. When you launch the VM's remote console using the vSphere Web Client on a Mac OS X system, instead of using the regular VMRC, it launches an HTML5 based console for your VM.
One thing that you might have noticed when performing this same action on a Windows desktop using the vSphere Web Client is that VMRC is used instead of the HTML5 console (notice the generated URLs are different). My understanding is that the VMRC is currently more performant than the HTML5 console and hence it is preferred when possible. I have been using the HTML5 based console for quite sometime now and I have not had any issues with it. I really hope to see us use the HTML5 console as the default console in the future!
Having said all this, there is a way for all users can benefit from this new HTML5 based VM console which is to automatically generate the URL which can then be loaded into any HTML5 supported web browser on either a Mac OS X, Windows or even Linux system. I used a similar method in generating the VM Remote Console for the vSphere Web Client which is VMRC specific.
UPDATE (07/26/17): I have just published a PowerCLI script called GenerateVMConsoleURL.ps1 which runs against a vSphere 6.5 environment and supports generating the HTML5 VM Console, Standalone VMRC and WebMKS URLs. As noted by several folks in the comments below, the pre-auth mechanism no longer works post-6.0, so you will need to have logged already for the console to automatically load OR you will be prompted to login before being re-directed. For those that wish to generate VM Console URLs for older vSphere versions, you can modify the script to handle those other scenarios.
The really cool part about this solution is that you can provide a one time pre-authenticated HTML5 based VM console URL that can then be given to your end users to access their VM. This of course can be automatically generated through a custom portal without needing to provide direct access to the vSphere Web Client.
In vSphere 5.5 Update 2, the HTML5 VM Console now defaults to a secure connection and the two components of the URL that needs to be modified is from HTTP to HTTPS and from port 7331 to port 7343. The script has been updated to support a new command-line option called isvSphere55u2 which by default is set to false but can be set to true to generate an updated URL if you are running vSphere 5.5 Update 2
Disclaimer: The HTML5 VM console URL format/behavior is not guaranteed and may change in the future. The only officially supported method of accessing the console is by launching it through the vSphere Web Client.
Here is a vSphere SDK for Perl script called generateHTML5VMConsole.pl that given a VM name as input, will automatically generate a one-time pre-authetnicated HTML5 VM console URL that can be loaded into any supported web browser.
Note: To ensure the URL is valid, you will need to make sure your application is setup to run like a daemon or agent. To simulate this in my sample script, I just sleep for 60 seconds before disconnecting the session. I also used the openssl utility to extract the SHA1 thumbprint, so you will need a system that has that installed along with the vSphere SDK for Perl if you wish to use the script. The quickest way is to leverage vMA.
Thanks for the great blog article and the nice script - it is working perfectly!!
The only disadvantage is, that a user can modify "MoRef ID" and have access to all other VMs if they find out the right ID.
The MoRef ID is not something a user can easily guess and even if you were to figure it out, simply replacing it with another will not make it work. There is a unique session ticket that must be requested from a given VM so this would prevent someone from just changing one of the parameters. Also you wouldn't create a user for every single user, but a generic service account that can provide this URL through some type of custom portal
You say that "There is a unique session ticket that must be requested from a given VM", but the perl scripta above retrieves the script from the general session manager, independent of any specific VM.
I'm trying to set up a HML5-based console to a VCenter 5.5 using the VMware HTML Console SDK ( -console/index.html) and so far your article was very helpful but I haven't been able to provide a connection valid only for one specific VM so far. I've seen that there are several Ticket Types I can get from the vSphere5.5-API (I've tried VirtualMachineMKSTicket and VirtualMachineTicket) but the string-output looks quite different from the Clone-Ticket and I haven't been able to convince VCenter to accept one of them. I wanted to give the GenericServiceTicket a try but this doesn't seem to accept any restriction on a single VM neither. Do you have any idea of how to use another ticket type in the request or how to restrict the clone ticket to a single resource?
If you're using the HTML5 Console SDK, you'll need to to request the "webmks" VirtualMachineTicketType type ( -60/index.jsp?topic=/com.vmware.wssdk.apiref.doc/index.html&single=true) given this is using the HTML5 VM Console. I've not personally used the SDK, so I can't comment on what you're seeing but webmks ticket should do it. If you have any other questions/feedback, feel free to post on the VMware Developer Center community
Many thanks for the swift reply. From what I see in the documentation, the "webkms" VirtualMachineTicketType is only available in VCenter 6.0 and the VCenter 5.5 API rejects the new ticket type (not really a surprise). Does that mean that with VCenter 5.5 only clone-ticket works, unless I connect to the single hosts returned by the MKS-Ticket (which should as well work with with sockets but would make the proxy configation a bit more difficult I guess)?
Currently whenever I try to use the url--the spinner starts but then it dies with "The console has been disconnected. Close this window and re-launch the console to reconnect." That is using a freshly generated url (no chance of reusing a one time connection).
Assuming you're doing the right thing, the only thing I can say is make sure your PowerCLI session does not close, meaning you don't exit else the login is invalidated before you launch VM Console. I hit this problem initially and hence I have a "sleep" in my code
Hi,
thank you a lot for this script, it works like a charm.
As I do not speak pearl, is there a way to pass the password as a parameter or is it possible, to "hardcode" it right in the script?
Would be a great help, as the user does not have shell access and I want to generate the URL by a website.
thanks a lot,
Jrg (from Germany)
Perhaps if you use it immediately, but I've found that it's no longer valid. The 60secs was just an example, ideally if you were to turn this into a service this would be running as a process handing out these URLs
7fc3f7cf58