vSphere Plugin User Guide: Configuring Authentication

Remote vSphere Client Plugin Network Requirements

Local vSphere Client Plugin Network Requirements

Create Certificate

PowerShell--Linux/MacOS

First ensure that you have at least the 1.2.0.0 release of the Pure1 PowerShell Module installed. Instructions to install PowerShell on Linux/MacOS here.

For PowerShell-based management, there is a PowerShell Gallery hosted module called PureStorage.Pure1. For more information (or to open bugs or feature requests) on the PowerShell Module, see here:

https://github.com/PureStorage-OpenConnect/PureStorage.Pure1

Create a new key pair and enter a password when prompted.

New-PureOneCertificate

Then retrieve the public key (enter the private key password):

Get-PureOnePublicKey

Now copy that key:

install-module PureStorage.Pure1

New-PureOneCertificate | Get-PureOnePublicKey

Add the Public Key to Pure1

Once you have a public key, it needs to be entered into the Pure1 web site to create an application ID. Login to pure1.purestorage.com as an admin. If you do not see the Administration section on the left-hand side, you are not logged in as an administrative user. If you are not, find your Pure1 admin and have them generate the token. If you do not know your admin, reach out to Pure Storage support.

Click on API Registrations the Register Application:

Give the application a descriptive name and paste in the public key. This must start with -----BEGIN PUBLIC KEY----- and end with  -----END PUBLIC KEY-----. You may specify either the admin role or read only. As of the 4.3.x release of the vSphere Plugin, there is no need for administrative API access.

Click Upload to finish the process. Find the application ID and copy it, or have the admin provide it to you. It will start with pure1:apikey:

Generating a JWT

Once you have an application ID you can create the JWT. A JWT can be generated in a myriad of ways below are the methods using Python or PowerShell

curl https://gist.githubusercontent.com/codyhosterman/697ebfd72c4f7f7276afc3b74e3b5e40/raw/fce3ec83467344dd4192e831cf53694e0bfc8f21/pure1_token_factory.py >> pure1_token_factory.py

sudo apt install python3-pip

pip3 install -r https://pure1-scripting.s3-us-west-1.amazonaws.com/requirements.txt

PyJWT 
paramiko>=2.7.1 
requests 
cryptography 
six 

sudo python3 ./pure1_token_factory.py pure1:apikey:iRT5OwhslZVLWNGG private.pem

New-PureOneJwt -pureAppID pure1:apikey:aebVzb4k3Gq7oQE7 

Adding a JWT to the vSphere Client

Login to the vSphere Client, click on the top menu and choose Pure Storage.

Click on the Authenticate with Pure1 button in the top right corner:

Paste in the JWT into the box that appears:

Click Authenticate. This will authenticate into Pure1. You will then be able to see Pure1 features in the plugin, like tag display and the load meter chart:

Adding a FlashArray Manually

To add a single FlashArray, login to the vSphere Client and click on the Menu drop-down and choose Pure Storage.

Click on the +Add button shown under the Pure Storage icon.

Choose Add a Single Array:

Enter in:

• Array name. This does not have to be the actual FlashArray's domain name, but it is recommended. This name is not verified--but should be descriptive either way.
• Array URL. In the form of an IP address or fully-qualified domain name representing a FlashArray virtual address. FQDN is always preferred.
• Username. A username of either a local user or a directory attached user.
• Password. The corresponding password of selected user.

The virtual address can be verified from the array on Settings > Network > Subnets & Interfaces:

FQDN can be verified with nslookup or similar tools:

Adding One or More FlashArrays through Pure1

For environments with many FlashArrays, or environments where you may not know the addresses of all FlashArray, an administrator can leverage the Pure1 Connection to register a fleet of FlashArrays at once.

Go to the Pure Storage Plugin home screen and click Add.

Click on the Import Arrays from Pure1 tab. The plugin will reach out to Pure1 and retrieve all FlashArray and Cloud Block Store arrays registered in the target Pure1 organization. The plugin will then:

1. Pull all of the FlashArray or Cloud Block Storage VIR0 (virtual IP 0) addresses and the array names from the Pure1 REST API
2. Attempt a DNS lookup for the FQDN. If there is no address found the IP will be used for the URL, if one is found it will use the FQDN
3. Test network connectivity to the discovered FQDNs or IPs. If an array is not available on the network it will not be filtered out, but will be marked as offline.
4. Filter arrays out that are already authenticated in the plugin

You then have the option to individually add credentials for each array or if they all share the same credentials, select the Use the same credentials for all arrays box. If that is selected you only have to enter in the credentials for the first array.

If you an array is marked with the following icon:

It means the array address is not reachable from vCenter.

Once you have added credentials, select the arrays that you would like to authenticate.

Note that if you choose the top "select all" box in the upper left of the table:

It will only select all of the arrays on that particular page. You must click the next arrow and repeat to authenticate all discovered arrays. This ensures that the user confirms and verifies all selected arrays before completion.

When you have selected all of the desired arrays, click Add in the lower right hand corner.

The plugin will attempt to authenticate all arrays and will report all of the arrays that succeeded and any that failed:

If there are arrays with errors, hover over the information tooltip (circle with an exclamation mark) for more information.

Click Done with finished.

Required vCenter Privileges

In order to add a FlashArray connection into the vSphere Plugin, the logged in user adding the connection must be assigned a role with the following privileges:

• Global > 'Manage Custom Attributes'
• Global > 'Set Custom Attribute'

Required Pure1 Privileges

When you authenticate with the Pure1 REST API it is not username/password-based, as described above. The JWT used to authenticate the plugin can be created from a private key that has an associated public key with either admin or read-only permissions. There are currently no features in the vSphere Plugin that requires administrative access to the Pure1 REST API. This may change in the future as more active control is added into Pure1.

Required FlashArray Privileges

In order to enable the use of a FlashArray in the VMware environment, vSphere administrators must authenticate the vSphere Plugin with the desired FlashArray(s). Users can choose to create local FlashArray users or use LDAP-connected users. It is recommended to provision a specific account for plugin access to the FlashArray (sometimes referred to as a system account) that doesn't necessarily reflect a specific person, but either a group or a use (username: vSpherePlugin for instance).

For the process to create a new local account on the FlashArray, please refer the the FlashArray user guide for your respective version of Purity:

FlashArray User Guide

The vSphere Plugin supports a few permission levels for the registered user:

• Array Admin--this will provide the logged in users with access to all of the advertised features in the plugin. This is a supported level, but not recommended. This elevated permission set is not needed by the plugin.
• Storage Admin--this is the recommended level of permissions. Storage admin level of permissions provides users of the vSphere Plugin with all required permissions.
• Read Only--if you want end-users to be able to view information about their storage environment (performance, data reduction, snapshots, capacity information, etc) you may provision a read only user account. This will block the ability to make any storage changes (change, add, remove, storage resources) with the plugin on the array(s) authenticated with this level of role.

Audit Trail

Currently, all logged in users of the vSphere Client will share the same permissions of a given FlashArray or Pure1--in other words--once you authenticate a FlashArray in the vSphere Plugin, all authenticated users in vSphere will share that authentication. All operations executed in the plugin against a FlashArray will appear as the same authenticated user account in the FlashArray audit trail.

As an example, if a FlashArray is added with the username of "vsphereplugin":

Then user cody@purecloud.com logs in:

And creates a VMFS snapshot:

1) Clicks Create Snapshot button	2) Calls the snapshot newSnapcody

We see in the audit trail on the FlashArray:

The user is vsphereplugin.

Then user janice@purecloud.com logs in:

And creates a VMFS snapshot:

1) Clicks Create Snapshot button	2) Calls the snapshot newSnapjanice

We see in the audit trail on the FlashArray:

The user is also vsphereplugin. Since all users share the same authentication it is recommended to not authenticate with an account that is assigned to a certain person, but instead a group or application account.