vCenter REST API 身份验证

Question

我正在遵循 这份 VMware 文档。在使用 REST API 访问 vCenter Server 时，需要提供哪些头部信息进行身份验证？

- codec

Answer 1

对于Python：

import requests

# https://vdc-download.vmware.com/vmwb-repository/dcr-public/1cd28284-3b72-4885-9e31-d1c6d9e26686/71ef7304-a6c9-43b3-a3cd-868b2c236c81/doc/operations/com/vmware/vcenter/vm.list-operation.html

sess = requests.post("https://XXXXXXXX/rest/com/vmware/cis/session", auth=('USERNAME', 'PASSWORD'), verify=False)
session_id = sess.json()['value']

resp = requests.get("https://XXXXXXXX/rest/vcenter/vm", verify=False, headers={
    "vmware-api-session-id": session_id
})
print(u"resp.text = %s" % str(resp.text))

- arturgspb

Answer 2

让我举个例子，说明你需要做什么才能从Vcenter获取虚拟机列表。

首先，你需要向https://vcsa/rest/com/vmware/cis/session发出POST请求以获取会话ID。

然后，你可以使用GET请求来获取虚拟机列表：https://vcsa/rest/vcenter/vm，并将HTTP头vmware-api-session-id设置为之前获取的会话ID。

以下是PHP示例代码：

<?php
$ch = curl_init();

curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);

curl_setopt($ch, CURLOPT_URL, "https://vcsa/rest/com/vmware/cis/session");
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_USERPWD, '[e-mail]' . ":" . 'password');

$out = json_decode(curl_exec($ch));
// var_dump($out);
if ($out === false) {
  echo 'Curl Error: ' . curl_error($ch);
  exit;
}
$sid = $out->value;

curl_setopt($ch, CURLOPT_HTTPHEADER, array("vmware-api-session-id:$sid"));
curl_setopt($ch, CURLOPT_POST, 0);
curl_setopt($ch, CURLOPT_URL, "https://vcsa/rest/vcenter/vm");

$output = curl_exec($ch);
$vms = json_decode($output);
var_dump($vms);

curl_close($ch);

- Marki

---

会话请求返回 Null（使用命令行的 curl 从同一台机器上却可以正常工作）。 - VladoPortos

Answer 3

请注意，VMware现在已经弃用API，该API仅在vSphere 7.0 Update 2之前有效，在/rest下提供服务。从vSphere 7.0开始，有一个新的API在/api下提供服务，它使用类似于先前API的URL，但一些URL略有不同。同时返回的JSON也有所不同。

旧API的Python示例：

import requests

# Get session ID
response = requests.post("https://<VCENTER>/rest/com/vmware/cis/session", auth=(<USER>, <PASSWORD>))
if response.ok:
    sessionId = response.json()['value']
else:
    raise ValueError("Unable to retrieve a session ID.")

# Get VMs, for example
response = requests.get("https://<VCENTER>/rest/vcenter/vm", headers={"vmware-api-session-id": session_id})
if response.ok:
    print(f"VMs: {response.json()['value']}")
else:
    raise ValueError("Unable to retrieve VMs.")

Python新API示例：

import requests

# Get session ID
response = requests.post("https://<VCENTER>/api/session", auth=(<USER>, <PASSWORD>))
if response.ok:
    sessionId = response.json()
else:
    raise ValueError("Unable to retrieve a session ID.")

# Get VMs, for example
response = requests.get("https://<VCENTER>/api/vcenter/vm", headers={"vmware-api-session-id": session_id})
if response.ok:
    print(f"VMs: {response.json()}")
else:
    raise ValueError("Unable to retrieve VMs.")

关于API更改的更多信息，请查看本文。

- stackprotector

Answer 4

PowerShell:

$User="<username>"
$Pass="<password>"
$Auth=$User+":"+$Pass
$Encoded=[System.Text.Encoding]::UTF8.GetBytes($Auth)
$EncodedAuth=[System.Convert]::ToBase64String($Encoded)
$Headers = @{"Authorization"="Basic $($EncodedAuth)"}
$SecPass=ConvertTo-SecureString -String $Pass -AsPlainText -Force
$Cred=[System.Management.Automation.PSCredential]::new($User,$SecPass)

<# Uncomment this part if you don't have a valid trusted certificate
$strIDontCarePolicy=@"
using System.Net;
using System.Security.Cryptography.X509Certificates;

public class IDontCarePolicy : ICertificatePolicy {
  public IDontCarePolicy() {}
  public bool CheckValidationResult(ServicePoint sPoint, X509Certificate cert, WebRequest wRequest, int certProb) { return true; }
}
"@
Add-Type -TypeDefinition $strIDontCarePolicy -PassThru
[System.Net.ServicePointManager]::CertificatePolicy = New-Object IDontCarePolicy 
#>

$initSession=Invoke-RestMethod -Uri "https://<vCenter Server>/rest/com/vmware/cis/session" -Method Post -Headers $Headers
$SessionID=$initSession.Value

- Slogmeister Extraordinaire

Answer 5

针对.NET客户端

//只有在您没有有效证书的情况下才忽略证书

var handler = new HttpClientHandler();
        handler.ClientCertificateOptions = ClientCertificateOption.Manual;
        handler.ServerCertificateCustomValidationCallback =
            (httpRequestMessage, cert, cetChain, policyErrors) =>
            {
                return true;
            };


        using (var client = new HttpClient(handler))
        {
            var values = new Dictionary<string, string>
            {

            };

            client.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue(
    "Basic", Convert.ToBase64String(
        System.Text.ASCIIEncoding.ASCII.GetBytes(
           $"{"username"}:{"password"}")));
            var content = new FormUrlEncodedContent(values);
            //var stringContent = new StringContent(content, Encoding.UTF8, "application/x-www-form-urlencoded");

            var response = await client.PostAsync("https://vcsa/rest/com/vmware/cis/session", content);

            var responseString = await response.Content.ReadAsAsync<KeyValuePair<string, string>>();
            client.DefaultRequestHeaders.Authorization
                     = new AuthenticationHeaderValue("Bearer", responseString.Value);
            var vmRespone = await client.GetAsync("https://vcsa/rest/vcenter/vm");

        }

- Mahesh

Answer 6

在使用curl调用时，使用[e-mail]会导致身份验证错误。

我们改用VSPHERE.LOCAL\username，这样就没有问题了。

- John T.