RESTful knowledge exchange
Post Reply
jtfox
Service Provider
Posts: 23
Liked: 7 times
Joined: Jan 07, 2016 9:32 pm
Contact:

Add Role to EM via API Using PowerShell Invoke

Post by jtfox »

Does anyone have an example of adding a user to BEM under Configuration>Roles? I would like to set the user as a restore operator and possibly even assign the restore scope of select virtual machines.

Full disclosure, I am not very familiar with using API. I would prefer to use PowerShell as I am familiar with PowerShell.
Cragdoo
Veeam Vanguard
Posts: 628
Liked: 251 times
Joined: Sep 27, 2011 12:17 pm
Full Name: Craig Dalrymple
Location: Scotland
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by Cragdoo »

You would want to look at security/accounts API , and using POST method

https://helpcenter.veeam.com/docs/backu ... tml?ver=95
jtfox
Service Provider
Posts: 23
Liked: 7 times
Joined: Jan 07, 2016 9:32 pm
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by jtfox »

Thanks for the reply. I was looking for an example of doing this through PowerShell using the Invoke method. Sorry I wasn't more clear about that in my original post.
veremin
Product Manager
Posts: 20261
Liked: 2249 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by veremin »

Enterprise Manager functionality is not covered with PowerShell cmdlets, so, REST seems to be the only option. Thanks.
jtfox
Service Provider
Posts: 23
Liked: 7 times
Joined: Jan 07, 2016 9:32 pm
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by jtfox »

Yes, I am aware there are no PowerShell cmdlets. However, PowerShell can invoke-RestMethod. I was hoping someone on this forum had previously used the PowerShell invoke-RestMethod within PowerShell to configure EM. If I figure it out, I'll try and return here to share.
tdewin
Veeam Software
Posts: 1775
Liked: 646 times
Joined: Mar 02, 2012 1:40 pm
Full Name: Timothy Dewin
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by tdewin »

Sure, it is possible.

Here is a sample for logging in and starting a job:
https://github.com/tdewin/veeampowershe ... stdemo.ps1
http://blog.dewin.me/2016/04/veeam-rest ... shell.html

I didn't use invoke-restmethod, but it should be even easier with that one
veremin
Product Manager
Posts: 20261
Liked: 2249 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by veremin »

Here you can find example on how to interact with EM API, using Invoke-RestMethod cmdlet. Thanks.
tsightler
VP, Product Management
Posts: 6003
Liked: 2840 times
Joined: Jun 05, 2009 12:57 pm
Full Name: Tom Sightler
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by tsightler » 1 person likes this post

Here's a small script that I created to configure EM immediately after install (basically add the VBR server to EM).

Code: Select all

# Veeam Backup & Replication Unattended Install
# Configure Veeam Enterprise Manager
#

param
(
[ValidateNotNullorEmpty()][string]$srvuser=$(throw "SrvUser is required, provide a user account for install."),
[ValidateNotNullorEmpty()][string]$srvdomain=$(throw "SrvDomain is mandatory, provide a domain for the user."),
[ValidateNotNullorEmpty()][string]$srvpasswd=$(throw "SrvPasswd is mandatory, provide a password for the user."),
[string]$srvname="localhost"
)

$srvdomuser = $srvdomain+"\"+$srvuser
$securepassword = ConvertTo-SecureString "$srvpasswd" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential("$srvdomuser", $securepassword)
$headers = @{"X-Requested-With"="powershell"}  
$baseuri = "https://$($srvname):9398/api"

# Create XML Body for create backupServer request
$body = @"
<?xml version="1.0" encoding="utf-8"?>
<BackupServerSpec xmlns="http://www.veeam.com/ent/v1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <Description>Local Veeam Backup Server</Description>
    <DnsNameOrIpAddress>$srvname</DnsNameOrIpAddress>
    <Port>9392</Port>
    <Username>$srvdomuser</Username>
    <Password>$srvpasswd</Password>
</BackupServerSpec>
"@

# Allow the use of self-signed SSL certificates.
Add-Type @"
  using System.Net;
  using System.Security.Cryptography.X509Certificates;
  public class TrustAllCertificatesPolicy : ICertificatePolicy 
  {
     public bool CheckValidationResult
     (
       ServicePoint srvPoint, X509Certificate certificate
       ,
       WebRequest request, int certificateProblem
     ) 
     {
       return true;
     }
  }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertificatesPolicy

# Authenticate to REST API and get session cookie
$logon = Invoke-RestMethod -Headers $headers -Uri "$baseuri/sessionMngr/?v=latest" -Method Post -SessionVariable sess -Credential $credentials

# Query if backup server already exist
$resp = Invoke-RestMethod -Headers $headers -Uri "$baseuri/query?type=BackupServer&format=Entities&sortAsc=name&pageSize=15&page=1&filter=Name==`"$($srvname)`"" -Method Get -WebSession $sess
if ($resp.QueryResult.Entities.BackupServers.BackupServer) {
    Write-Host "Backup server" $srvname "already exist in Enterprise Manager, skipping"
} else {
    Write-Host "Adding backup server" $srvname "to Enterprise Manager"
    # Call REST API to create backupServer
    Invoke-RestMethod -Headers $headers -Body $body -ContentType "application/xml" -Uri "$baseuri/backupServers?action=create" -Method Post -WebSession $sess
}

# Delete REST API Session
Invoke-RestMethod -Headers $headers -Uri "$baseuri/logonSessions/$($logon.LogonSession.SessionId)" -Method Delete -WebSession $sess
frankU32
Enthusiast
Posts: 36
Liked: 2 times
Joined: May 02, 2018 11:56 am
Full Name: Frank Tighe
Contact:

[MERGED] Accessing the API from PowerShell

Post by frankU32 »

Hi everyone,

First of all, let me apologise if this request is a little basic, I have not done much work with API's, so this is pretty new to me and I seem to be falling at the first hurdle.

It's my understanding that the steps to access the Veeam API are first to authenticate and obtain a SessionID, then use that moving forward.

So what I have done is as follows :

Code: Select all

$headers = @{ Authorization = "Basic dmVlYW1hcGlzdmNAaHlwZXJzbGljZS5uZXQ6VHRCMkU4WnkhOSpOoe==" }

$Reply = Invoke-RestMethod -Method 'Post' -Uri "http://veeamsrv:9399/api/sessionMngr/?v=latest" -Headers $headers 
I feel like from this point I should be able to use :

Code: Select all

$Reply.LogonSession
to get the ID, however, when I look at the data I can see the session ID but its lost in something called "OuterXml". Now I could parse this data to get the ID, but I feel sure it should be easier than that, and the issue is me not doing this correctly.

Thanks in advance

Frank
frankU32
Enthusiast
Posts: 36
Liked: 2 times
Joined: May 02, 2018 11:56 am
Full Name: Frank Tighe
Contact:

Re: Accessing the API from PowerShell

Post by frankU32 »

I worked it out, If anyone is interested.

Code: Select all

function GetVeeamToken()

{
$headers = @{ Authorization = "Basic dmVlYW1hcGlzdmNAaHlwZXJzbGljZS5uZXQ6VHRCMkU4WnkhOSpOUor=" }

$Veeamtoken = Invoke-WebRequest  -method Post -Uri "http://veeamsrv:9399/api/sessionMngr/?v=latest" -Headers $headers 

$sessionId = $Veeamtoken.Headers.'X-RestSvcSessionId'

return $sessionId

}
This will return the API session ID.
veremin
Product Manager
Posts: 20261
Liked: 2249 times
Joined: Oct 26, 2012 3:28 pm
Full Name: Vladimir Eremin
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by veremin »

Your post has been merged into existing discussion where similar matter is discussed.

Above you can find an example on how to invoke RESTful API methods via PowerShell and how to add backup server to EM, using this approach.

Thanks.
benyoung
Veeam Vanguard
Posts: 148
Liked: 47 times
Joined: May 25, 2016 3:29 am
Full Name: Ben Young
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by benyoung »

@frankU32 i hope that environment has been torn down or credentials changed/not re-used anywhere - not super advisable to post the base64 encoded (not encrypted) auth header as its easily decoded
frankU32
Enthusiast
Posts: 36
Liked: 2 times
Joined: May 02, 2018 11:56 am
Full Name: Frank Tighe
Contact:

Re: Add Role to EM via API Using PowerShell Invoke

Post by frankU32 »

I obviously didn't use a real encoded password. It's just random crap.
Post Reply

Who is online

Users browsing this forum: No registered users and 2 guests