Creating Global Roles With PowerCLI in vCenter 6

Creating Global Roles With PowerCLI in vCenter 6

While middle in the migration from a vCenter 5.1 environment to a vCenter 6.x environment I wanted to use the Global Roles so I don’t have to set them per vCenter anymore.

So how do I create those global roles?

Well the important thing is to connect to your vCenter (Connect-VIServer) using the administrator@vsphere.local user (or your SSO user if you configured a different one)

Because you login with the SSO user you can create the global roles by just using the New-VIRole command.

Example:
So in with the function below I tried to create a simple function with parameters -From and -To to simply recreate the roles from vCenter1 to vCenter2.
I make use of the logwrite function I posted earlier to spam some messages on screen and to a text file

Before:
– I expect you to be connected to both vCenters using the Connect-VIServer cmdlet.

01 function Migrate-VIrole{
02     <#
03         .SYNOPSIS
04             Migrates the VCenter roles from one vCenter to another
05         .DESCRIPTION
06             A detailed description of the function.
07         .PARAMETER  $From
08             This is the vCenter to read from
09         .PARAMETER  $To
10             This is the vCenter to build the datacenter on
11         .EXAMPLE
12             PSC:\> Migrate-VIRole-FromvCenter1 -TovCenter2
13         .INPUTS
14             System.String
15         .OUTPUTS
16             System.String
17     #>
18     [CmdletBinding()]
19     [OutputType([System.String])]
20     param(
21         [Parameter(Position=1, Mandatory=$true)]
22         [ValidateNotNull()]
23         [System.String]
24         $From,
25         [Parameter(Position=2, Mandatory=$true)]
26         [ValidateNotNull()]
27         [System.String]
28         $To
29     )
30     try{
31     #Grabbing roles from an to in array
32     $ArrRolesFrom= Get-VIRole-Server$From|?{$_.IsSystem -eq$False}
33     $ArrRolesTo= Get-VIRole-Server$To|?{$_.IsSystem -eq$False}
34     
35     #Checking for existing roles
36     foreach($Rolein $ArrRolesFrom){
37         if($ArrRolesTo|where{$_.Name -like$role})
38             {
39         Logwrite -Error"$Role already exists on $To"
40         logwrite -Info"Checking permissions for $role"
41             [string[]]$PrivsRoleFrom= Get-VIPrivilege-Role(Get-VIRole-Name$Role-Server$From) |%{$_.id}
42             [string[]]$PrivsRoleTo= Get-VIPrivilege-Role(Get-VIRole-Name$Role-Server$To) |%{$_.id}
43                 foreach($Privilegein $PrivsRoleFrom){
44                     if ($PrivsRoleTo| where{$_ -Like$Privilege})
45                     {
46                     Logwrite -Error"$Privilege already exists on $role"
47                     }
48                     else
49                     {
50                         #Setting privileges
51                         Set-VIRole-Role(Get-VIRole-Name$Role-Server$To) -AddPrivilege(Get-VIPrivilege-Id$PrivsRoleFrom-Server$To)|Out-Null
52                         Logwrite -Success"Setting $privilege on $role"
53                     }
54                 }
55             }
56             else
57             {
58                 #Creating new empty role
59                 New-VIrole-Name$Role-Server$To|Out-Null
60                 Logwrite -Success"Creating $Role on $To"
61                 Logwrite -Info"Checking permissions for $role"
62                 [string[]]$PrivsRoleFrom= Get-VIPrivilege-Role(Get-VIRole-Name$Role-Server$From) |%{$_.id}
63                 [string[]]$PrivsRoleTo= Get-VIPrivilege-Role(Get-VIRole-Name$Role-Server$To) |%{$_.id}
64                 foreach($Privilegein $PrivsRoleFrom)
65                 {
66                     if ($PrivsRoleTo|where{$_ -Like$Privilege})
67                     {
68                         Logwrite -Error"$Privilege already exists on $role"
69                     }
70                     else
71                     {
72                     #Setting privileges
73                     Set-VIRole-role(get-virole-Name$Role-Server$To) -AddPrivilege(get-viprivilege-id$PrivsRoleFrom-server$To)|Out-Null
74                     logwrite -success"Setting $privilege on $role"
75                     }
76                 }
77             }
78         }
79     }
80     catch
81     {
82         throw
83     }
84 }