Using REST API to add AD Groups to Enterprise Roles

[GPS]

Case # 02713799
I can post more information about exactly what I code I have if required.

Using the REST API from PowerShell Invoke-RestMethod I want to be able to add Active Directory Groups to Enterprise Roles as I would using the UI – refer to
https://helpcenter.veeam.com/docs/backu ... tml?ver=95


The Roles available from the UI are Portal Administrator, Portal User and Restore Operator.

So when I submitted a GET request for the Roles I was just expecting these 3 Roles – instead I got the following list:
Portal User
SQL Restore Operator
Oracle Restore Operator
File Restore Operator
Exchange Restore Operator
Portal Administrator
VM Restore Operator

So there is no general Restore Operator but there are the following: SQL Restore Operator, Oracle Restore Operator, File Restore Operator, Exchange Restore Operator, and VM Restore Operator.

I am using the REST API URI: GET http://<VeeamHost>:9399/api/security/roles

https://helpcenter.veeam.com/docs/backu ... tml?ver=95 and this page does explain what I am getting but it is not what I am expecting after using the UI.

When I try to add a Domain Account to Portal User using the POST /security/accounts/{ID}/roles (https://helpcenter.veeam.com/docs/backu ... tml?ver=95). For {ID} I use the GUID for the Domain Account.
(To get the account GUID I use $AcGuid = Get-ADGroup –Identity ‘Account name’ - then $AcGuid.Guid)

I get the following exception:

Code: Select all

Invoke-RestMethod : Group account id not found. Account id: 
55ee7c42-7a29-479e-97c1-2eba641bfdaaVeeam.Backup.Interaction.RestAPI.CRestAPICommunicationException: Group account id 
not found. Account id: 55ee7c42-7a29-479e-97c1-2eba641bfdaa ---> System.Exception: Group account id not found. 
Account id: 55ee7c42-7a29-479e-97c1-2eba641bfdaa
   at Veeam.Backup.Enterprise.RestAPIService.CSecuritySqlHelper.GetAccountGroupId(Guid accountId)
   at Veeam.Backup.Enterprise.RestAPIService.CRestApiSecurityScope.CreateAccountRole(Guid accountId, 
EnterpriseAccountInRoleCreateSpecType spec)
   at Veeam.Backup.Enterprise.RestAPIService.CEnterpriseRestServiceStub.CreateAccountRole(String accountId, 
EnterpriseAccountInRoleCreateSpecType spec)
   at SyncInvokeCreateAccountRole(Object , Object[] , Object[] )
   at System.ServiceModel.Dispatcher.SyncMethodInvoker.Invoke(Object instance, Object[] inputs, Object[]& 
outputs)
   at System.ServiceModel.Dispatcher.DispatchOperationRuntime.InvokeBegin(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage5(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.ImmutableDispatchRuntime.ProcessMessage11(MessageRpc& rpc)
   at System.ServiceModel.Dispatcher.MessageRpc.Process(Boolean isOperationContextSet)
   --- End of inner exception stack trace ---
At Z:\Documents\veeam\Veeam\VeeamEnterpriseRESTAPI.psm1:118 char:9
+         Invoke-RestMethod -ContentType "application/xml" -Method Post ...
+         ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebExce 
   ption
    + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand

[veremin]

The referenced ID is the RESTful API resource identifier, which has nothing to do with AD ID.

You need to:

* query acconts/ resource (GET /accounts/)
* identify account to which you want to assign particular role (/accounts/{ID})
* issue post request to subresource of this account (/accounts/{ID}/roles)

Thanks.

[GPS]

To add a new account with an associated Role I used POST /security/accounts.
This worked fine for a local account but failed when using a Domain Account with the following error:
The trust relationship between this workstation and the primary domain failed.

You re-establish trust by removing the Server out of the Domain and then adding it back in - refer to this link
https://support.microsoft.com/en-us/hel ... ary-domain

Refer to this link as to why the trust relationship may have failed:
http://www.itprotoday.com/virtualizatio ... here-s-why