CloudClient Scripting


Automatic login can also be achieved using follwing three ways :-

  • System Environment Variables
  • CloudClient.properties File
  • CloudClient Persistent Sessions
  • This allows external scripts (bash/powershell etc) to interact and run commands.

    We can use environment variables and properties file together to provide values of login variables selectively i.e. properties file can provide some values while other values will be taken from environment variables. Environment variables have higher precedence than properties file. Note that you have flexibility to define a variable in properties file and then override its value in environment variable. Highest precedence is given to CloudClient sessions if available, followed by Environment variables , followed by CloudClient.properties file. Following sequence explains precedence order in detail:-

    1. Use persistent session if available (named using CLOUDCLIENT_SESSION_KEY) for login, report failure if login is not successful or session is expired (sessions expire after 30 days)
    2. If session is not available then look for default session for login, report failure if login is not successful
    3. If no sessions are available then read login credentials from the CloudClient.properties file.
    4. Read login credentials defined in environment variables and override values of available variables. Note that some values read in previous step using properties file will be overriden here.
    5. Try to login using the login credentials read from properties file and environment variables, if login is successful create a session file using the CLOUDCLIENT_SESSION_KEY. If login fails, report the failure.

    There are different commands to know if the login was successful and to know general information about the current login. This is explained in the Validate Login section at the end.

    Using a password Keyfile, CloudClient provides a way to encrypt your passwords. It is explained in section Encrypt Password to keyfile


    Encrypt Password to keyfile

    Passwords can be provided in clear text or simply encrypted to a file using the following command:

    # login keyfile --file mypass.txt [--password mypassword]

    If you don't provide a --password parameter, you will be prompted to securely enter the password to encrypt to a file


    System Environment Variables

    Alternatively, to the CloudClient.properties file, system environment variables can be set instead. For example:

    vra_server=vraServer.mydomain.com

    Variable Description
    vra_servervRA Server Name or IP Address
    vra_tenantTenant to connect to, defaults to vsphere.local if left empty
    vra_usernamevRA Username - to login to Top level system administrator the username is ""administrator@vsphere.local
    vra_passwordvRA Password
    vra_keyfileLocation to encrypted keyfile
    vra_iaas_servervRA Infrastructure Server Name, if left blank it is automatically discovered
    vra_iaas_usernamevRA NTLM Username, ie: Administrator
    vra_iaas_passwordvRA NTLM Password
    vra_iaas_keyfileLocation to encrypted keyfile

    CloudClient.properties file

    Generate CloudClient.properties file with the command:

    login autologinfile

    Edit CloudClient.Properties file

    #vra_server : vRealize Automation Virtual Appliance

    vra_server=vraServer@mydomain.com

    #vra_tenant : Tenant Name, defaults to vsphere.local

    vra_tenant=Development

    #vra_username : SSO username in the form user@domain.com

    vra_username=User1@mydomain.com

    #vra_password : SSO password

    vra_password=mypassword

    #vra_keyfile : Encrypted file location of SSO password

    vra_keyfile=


    #Some Administrator level API calls require Windows Authentication to communicate to the vRA Infrastructure Service Components

    #vra_iaas_server : Infrastructure Server (Windows Authentication) where IaaS Web Server node (Model Manager Web) is running, defaults to finding the name dynamically from vCAC

    vra_iaas_server=

    #vra_iaas_username : Windows username in the form user@domain

    vra_iaas_username=Administrator

    #vra_iaas_password : Windows password

    vra_iaas_password=mypassword

    #vra_iaas_keyfile : Encrypted file location of Windows password

    vra_iaas_keyfile=


    CloudClient Persistent sessions

    Cloudclient allows re-using the authentication sessions by persisting them to encrypted files. The sessions are stored under directory 'USER_HOME/.cloudclient' and files are named 'vra.session.session-key' & 'iaas.session.session-key'. The value for 'session-key' is provided through environment variable CLOUDCLIENT_SESSION_KEY. Sessions can be created using the credentials specified in CloudClient.properties file or through environmental varaiable. Following is an example of creating sessions and re-using them. Sessions are created using credentials provided using environment variables.
    
    # create session for administrator@vsphere.local user #
    export CLOUDCLIENT_SESSION_KEY=admin;
    export vra_server=vcac148-085-048.eng.vmware.com
    export vra_username=administrator@vsphere.local;
    export vra_password=vmware;
    sh cloudclient.sh vra tenant list;
    
    # create session for fritz@coke.vmware.com user #
    export CLOUDCLIENT_SESSION_KEY=fritz;
    export vra_username=fritz@coke.vmware.com;
    export vra_password=password;
    export vra_tenant=qe;
    sh cloudclient.sh vra credential list;
    
    # create session for tony@coke.vmware.com user #
    export CLOUDCLIENT_SESSION_KEY=tony;
    export vra_username=tony@coke.com;
    export vra_password=password;
    export vra_tenant=qe;
    sh cloudclient.sh vra credential list;
    
    # re-use the session created for fritz@coke.vmware.com user #
    export CLOUDCLIENT_SESSION_KEY=fritz;
    sh cloudclient.sh vra credential list;
    

    To create sessions using the properties file, you can specify value for environment variable CLOUDCLIENT_SESSION_KEY and then specify the credentials in the CloudClient.properties file. For creating a new session again, change the value of CLOUDCLIENT_SESSION_KEY and specify new set of credentials in the CloudClient.properties, the session will be saved to a new file named using the value of CLOUDCLIENT_SESSION_KEY.

    Validate Login

    Once the CloudClient session is available or Environment vars are set or CloudClient.properties is in place (Sessions take highest precedence, followed by Environment variables followed by CloudClient.properties file); you can test to see of this was successful. Also the autologin will display the login information right away before presenting the cloudclient CLI as seen below.


    vRA SSO login indicates the SSO authentication with vRA.

    IaaS Model Manager login indicates the NTLM authentication with IaaS server.


    Suppress Status Messages

    Once you use scripted login either using sessions, CloudClient.properties or environmental variables; by default you will see login status messages displayed on the command line. The output also has current Java runtime version. In some cases this output is not desired. For example when one command creates a business group and you want to use the ID of this business group in subsequent command, you want only the ID of the businessgroup as part of command output. To make this easier cloudclient supports a configuration option named "suppress.status.messages" which will hide all status messages (including JRE version) from the command output in auto-login mode. So the cloudclient user doesn't have to remove un-necessary messages from the command output, he only gets the useful content.

    To suppress the status messages, edit your cloudclient.config file (default path is USER_HOME_DIRECTORY/.cloudclient/cloudclient.config) and put following option in it and save it.

    suppress.status.messages = true

    All cloudclient commands now will only display the useful output and hide status messages from the output in auto-login mode. By default this option is not enabled.


    Copyright 2017 VMware, Inc. All rights reserved.