Verify object permissions with the vss-cli

In the ITS Private Cloud, we’ve implemented VMware vCenter authorization management and our internal directory for authentication and authorization. This setup allows for fine-grained permission management on objects like virtual machines, networks, domains, and folders.

The latest ITS Private Cloud API version enables end-users to verify who has access to what in their environment. Permissions are set to groups, but we’ve also exposed a resource to list permissions on networks, folders, and virtual machines. This includes listing group members to ensure everyone in the group has access.

To list permissions on folder objects (also applicable to networks and virtual machines), follow the steps outlined in this document. If you suspect a user has unauthorized access, contact us at vss(at)eis.utoronto.ca as soon as possible.

Object

First of all, we should get either the moref or UUID of the object to list permissions. In this case, the folder moref can be queried by vss compute folder ls as follows:

Moref group-v1234 is now our target to list permissions. Validate if the folder is correct by getting its info with vss compute folder get <moref> as shown below:

Permission

Permissions in the folder command can be listed by the vss compute folder get <moref-or-name> perm command:

For instance, querying folder group-v1234 permissions would look like:

The output shows that vc51-VSSTest and vc51-VSSPriv group has been granted to access the folder and should propagate to any children contained, however members are not listed. On the other hand, user jm1 has been granted to the folder and its children.

Group members

There are a couple of restrictions in order to get group info and members:

• you should be a member of the group

• group should be prefixed by vc5

To get group basic info, use vss-cli account get group <group_name> as follows:

If you do are not member of a given group, expect the following output: