Pages: [1]
Print
Author Topic: powershell script to list permissions set up within your vmware environment  (Read 7128 times)
esarakaitis
Administrator
Sr. Member
*****
Posts: 256


8223109 sack57@hotmail.com littleking57 rootinfortwayne
View Profile WWW Email
« on: February 26, 2009, 02:46:27 PM »

vmwarescripting.com guru ewannama and i put this together today

Code:
    $si = Get-View ServiceInstance
    $am = Get-View $si.Content.AuthorizationManager

    $roleList = $am.RoleList

    # Create the role map
    $roleMap = @{}
    # Add the roles to the map
    foreach ($role in $roleList)
    {
        $roleMap[$role.RoleId] = $role
    }

    $permissions = $am.RetrieveAllPermissions()
    # Foreach permission
    foreach ($permission in $permissions)
    {
        $roleName = $roleMap[$permission.RoleId].Name
        $entityView = Get-View $permission.Entity
        $permission | Select-Object @{Name="Principal"; Expression={$permission.Principal}},
                                    @{Name="RoleName"; Expression={$roleName}},
                                    @{Name="Object"; Expression={Get-Path $entityView}}
    }

Function Get-Path($entity){
$path = $entity.Name
while($entity.Parent -ne $null){
$entity = Get-View -Id $entity.Parent
if($entity.Name -ne "vm" -and $entity.Name -ne "host"){
$path = $entity.Name + "\" + $path
}
}
$path
}
Logged
stevemurfy
Newbie
*
Posts: 5


View Profile
« Reply #1 on: March 24, 2009, 11:09:47 AM »

Hello,

I am a total noob, so be gentle.  Smiley

When running the script, I get the following error..

Select-Object : The term 'Get-Path' is not recognized as a cmdlet, function, operable program, or script file. Verify the term and try again.

What have I missed?

Thanks for any help,

-Murf
Logged
esarakaitis
Administrator
Sr. Member
*****
Posts: 256


8223109 sack57@hotmail.com littleking57 rootinfortwayne
View Profile WWW Email
« Reply #2 on: March 24, 2009, 12:08:41 PM »

are you copying and pasting correctly? because get-path is being defined as a function here:
Code:
Function Get-Path($entity){
$path = $entity.Name
while($entity.Parent -ne $null){
$entity = Get-View -Id $entity.Parent
if($entity.Name -ne "vm" -and $entity.Name -ne "host"){
$path = $entity.Name + "\" + $path
}
}
$path
}

Logged
stevemurfy
Newbie
*
Posts: 5


View Profile
« Reply #3 on: March 24, 2009, 01:42:03 PM »

I did try copying it again, but no luck.

I should have posted the full error.

Select-Object : The term 'Get-Path' is not recognized as a cmdlet, function, op
erable program, or script file. Verify the term and try again.
At C:\users\user\documents\PowerShellScripts\VcenterPermissions.ps1:20 cha
r:36
+         $permission | Select-Object <<<<  @{Name="Principal"; Expression={$pe
rmission.Principal}},
    + CategoryInfo          : InvalidResult: (VMware.Vim.Permission:PSObject)
   [Select-Object], CommandNotFoundException
    + FullyQualifiedErrorId : PropertyEvaluationNoExpand,Microsoft.PowerShell.
   Commands.SelectObjectCommand
Logged
esarakaitis
Administrator
Sr. Member
*****
Posts: 256


8223109 sack57@hotmail.com littleking57 rootinfortwayne
View Profile WWW Email
« Reply #4 on: March 24, 2009, 02:27:12 PM »

i cannot duplicate the error, i attached the PS1 file

what version of powershell, what version of toolkit?

* list_permissions.ps1 (1.02 KB - downloaded 566 times.)
Logged
ewannema
Administrator
Newbie
*****
Posts: 33


View Profile WWW
« Reply #5 on: March 24, 2009, 04:06:18 PM »

Hello Steve,

This is just a difference in the way we are running things.  To run this as a self contained script you have to put the function definition first.  You are currently getting the error because Powershell does not know about Get-Path until after it tries to use it in the Select-Object.

If you find the Get-Path function useful in general practice you can add it to your Powershell profile script and it will always be there.  That is probably why esarakaitis is not having any issues.

Code:
Function Get-Path($entity){
$path = $entity.Name
while($entity.Parent -ne $null){
$entity = Get-View -Id $entity.Parent
if($entity.Name -ne "vm" -and $entity.Name -ne "host"){
$path = $entity.Name + "\" + $path
}
}
$path
}

$si = Get-View ServiceInstance
$am = Get-View $si.Content.AuthorizationManager

$roleList = $am.RoleList

# Create the role map
$roleMap = @{}
# Add the roles to the map
foreach ($role in $roleList)
{
    $roleMap[$role.RoleId] = $role
}

$permissions = $am.RetrieveAllPermissions()
# Foreach permission
foreach ($permission in $permissions)
{
    $roleName = $roleMap[$permission.RoleId].Name
    $entityView = Get-View $permission.Entity
    $permission | Select-Object @{Name="Principal"; Expression={$permission.Principal}},
                                @{Name="RoleName"; Expression={$roleName}},
                                @{Name="Object"; Expression={Get-Path $entityView}}
}
Logged
stevemurfy
Newbie
*
Posts: 5


View Profile
« Reply #6 on: March 25, 2009, 08:45:03 AM »

That was it!!!
I knew it had to be something simple that I was missing.

Thanks to both of you for taking the time to help me on this.

-Steve
Logged
stevemurfy
Newbie
*
Posts: 5


View Profile
« Reply #7 on: March 25, 2009, 10:00:37 AM »

Sorry to be a pain, but could you tell me the most efficient way to send the output to a txt file or csv?

Thanks again
Logged
esarakaitis
Administrator
Sr. Member
*****
Posts: 256


8223109 sack57@hotmail.com littleking57 rootinfortwayne
View Profile WWW Email
« Reply #8 on: March 25, 2009, 12:44:12 PM »

export-csv
Code:
get-help export-csv

Logged
ewannema
Administrator
Newbie
*****
Posts: 33


View Profile WWW
« Reply #9 on: March 25, 2009, 03:29:08 PM »

.\ScriptName.ps1 | Export-Csv exportFile.csv

The Export-Csv function takes multiple input objects and writes them to the output file.  This highlights the difference between a script that outputs objects, as this one does, vs. a script that writes text to the screen.  Objects are much more flexible and fit with the PowerShell paradigm. 

As esarakaitis mentioned Get-Help will be beneficial to fine tune your output.

You did not ask for it, but ConvertTo-Html can be handy for a quick, slightly prettier, output.
Logged
stevemurfy
Newbie
*
Posts: 5


View Profile
« Reply #10 on: March 25, 2009, 03:31:29 PM »

Perfect!  Thanks again guys.
Logged
beav01
Newbie
*
Posts: 1


View Profile
« Reply #11 on: November 04, 2010, 07:56:23 PM »


This script is very helpful and is a good way of exporting the permissions.  I think that Stevemurfy had a good idea as well of exporting the results as a CSV file.

What I was wondering was if anyone had a good method of taking the CSV file and then importing them to apply the permissions?  This would be a good way of creating new datacenters with the appropriate permissions or doing testing in an offline lab.

Thanks!

Logged
Pages: [1]
Print
Jump to: