Add Role to EM via API Using PowerShell Invoke

[jtfox]

Does anyone have an example of adding a user to BEM under Configuration>Roles? I would like to set the user as a restore operator and possibly even assign the restore scope of select virtual machines.

Full disclosure, I am not very familiar with using API. I would prefer to use PowerShell as I am familiar with PowerShell.

[Cragdoo]

You would want to look at security/accounts API , and using POST method

https://helpcenter.veeam.com/docs/backu ... tml?ver=95

[jtfox]

Thanks for the reply. I was looking for an example of doing this through PowerShell using the Invoke method. Sorry I wasn't more clear about that in my original post.

[veremin]

Enterprise Manager functionality is not covered with PowerShell cmdlets, so, REST seems to be the only option. Thanks.

[jtfox]

Yes, I am aware there are no PowerShell cmdlets. However, PowerShell can invoke-RestMethod. I was hoping someone on this forum had previously used the PowerShell invoke-RestMethod within PowerShell to configure EM. If I figure it out, I'll try and return here to share.

[tdewin]

Sure, it is possible.

Here is a sample for logging in and starting a job:
https://github.com/tdewin/veeampowershe ... stdemo.ps1
http://blog.dewin.me/2016/04/veeam-rest ... shell.html

I didn't use invoke-restmethod, but it should be even easier with that one

[veremin]

Here you can find example on how to interact with EM API, using Invoke-RestMethod cmdlet. Thanks.

[tsightler]

Here's a small script that I created to configure EM immediately after install (basically add the VBR server to EM).

Code: Select all

# Veeam Backup & Replication Unattended Install
# Configure Veeam Enterprise Manager
#

param
(
[ValidateNotNullorEmpty()][string]$srvuser=$(throw "SrvUser is required, provide a user account for install."),
[ValidateNotNullorEmpty()][string]$srvdomain=$(throw "SrvDomain is mandatory, provide a domain for the user."),
[ValidateNotNullorEmpty()][string]$srvpasswd=$(throw "SrvPasswd is mandatory, provide a password for the user."),
[string]$srvname="localhost"
)

$srvdomuser = $srvdomain+"\"+$srvuser
$securepassword = ConvertTo-SecureString "$srvpasswd" -AsPlainText -Force
$credentials = New-Object System.Management.Automation.PSCredential("$srvdomuser", $securepassword)
$headers = @{"X-Requested-With"="powershell"}  
$baseuri = "https://$($srvname):9398/api"

# Create XML Body for create backupServer request
$body = @"
<?xml version="1.0" encoding="utf-8"?>
<BackupServerSpec xmlns="http://www.veeam.com/ent/v1.0" xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">
    <Description>Local Veeam Backup Server</Description>
    <DnsNameOrIpAddress>$srvname</DnsNameOrIpAddress>
    <Port>9392</Port>
    <Username>$srvdomuser</Username>
    <Password>$srvpasswd</Password>
</BackupServerSpec>
"@

# Allow the use of self-signed SSL certificates.
Add-Type @"
  using System.Net;
  using System.Security.Cryptography.X509Certificates;
  public class TrustAllCertificatesPolicy : ICertificatePolicy 
  {
     public bool CheckValidationResult
     (
       ServicePoint srvPoint, X509Certificate certificate
       ,
       WebRequest request, int certificateProblem
     ) 
     {
       return true;
     }
  }
"@
[System.Net.ServicePointManager]::CertificatePolicy = New-Object TrustAllCertificatesPolicy

# Authenticate to REST API and get session cookie
$logon = Invoke-RestMethod -Headers $headers -Uri "$baseuri/sessionMngr/?v=latest" -Method Post -SessionVariable sess -Credential $credentials

# Query if backup server already exist
$resp = Invoke-RestMethod -Headers $headers -Uri "$baseuri/query?type=BackupServer&format=Entities&sortAsc=name&pageSize=15&page=1&filter=Name==`"$($srvname)`"" -Method Get -WebSession $sess
if ($resp.QueryResult.Entities.BackupServers.BackupServer) {
    Write-Host "Backup server" $srvname "already exist in Enterprise Manager, skipping"
} else {
    Write-Host "Adding backup server" $srvname "to Enterprise Manager"
    # Call REST API to create backupServer
    Invoke-RestMethod -Headers $headers -Body $body -ContentType "application/xml" -Uri "$baseuri/backupServers?action=create" -Method Post -WebSession $sess
}

# Delete REST API Session
Invoke-RestMethod -Headers $headers -Uri "$baseuri/logonSessions/$($logon.LogonSession.SessionId)" -Method Delete -WebSession $sess

[frankU32]

Hi everyone,

First of all, let me apologise if this request is a little basic, I have not done much work with API's, so this is pretty new to me and I seem to be falling at the first hurdle.

It's my understanding that the steps to access the Veeam API are first to authenticate and obtain a SessionID, then use that moving forward.

So what I have done is as follows :

Code: Select all

$headers = @{ Authorization = "Basic dmVlYW1hcGlzdmNAaHlwZXJzbGljZS5uZXQ6VHRCMkU4WnkhOSpOoe==" }

$Reply = Invoke-RestMethod -Method 'Post' -Uri "http://veeamsrv:9399/api/sessionMngr/?v=latest" -Headers $headers 

I feel like from this point I should be able to use :

Code: Select all

$Reply.LogonSession

to get the ID, however, when I look at the data I can see the session ID but its lost in something called "OuterXml". Now I could parse this data to get the ID, but I feel sure it should be easier than that, and the issue is me not doing this correctly.

Thanks in advance

Frank

[frankU32]

I worked it out, If anyone is interested.

Code: Select all

function GetVeeamToken()

{
$headers = @{ Authorization = "Basic dmVlYW1hcGlzdmNAaHlwZXJzbGljZS5uZXQ6VHRCMkU4WnkhOSpOUor=" }

$Veeamtoken = Invoke-WebRequest  -method Post -Uri "http://veeamsrv:9399/api/sessionMngr/?v=latest" -Headers $headers 

$sessionId = $Veeamtoken.Headers.'X-RestSvcSessionId'

return $sessionId

}

This will return the API session ID.

[veremin]

Your post has been merged into existing discussion where similar matter is discussed.

Above you can find an example on how to invoke RESTful API methods via PowerShell and how to add backup server to EM, using this approach.

Thanks.

[benyoung]

@frankU32 i hope that environment has been torn down or credentials changed/not re-used anywhere - not super advisable to post the base64 encoded (not encrypted) auth header as its easily decoded

[frankU32]

I obviously didn't use a real encoded password. It's just random crap.