Skip to main content
Pure Technical Services

vRealize Orchestrator 7 User Guide: Authentication

The Pure Storage Plugin for vRealize Orchestrator provides a few things:

  1. Default workflows for running common tasks
  2. Discrete actions for assembling common functions together to create workflows
  3. JavaScript libraries to create very customized workflows 
  4. REST API libraries to make specific REST calls that are not included in the JavaScript libraries
  5. Integrated authentication
  6. Integrated and synchronized inventory of Pure Storage environments

To perform most tasks in the plugin, authentication needs to be configured first. The Pure Storage Plugin supports authentication via the following targets:

  • Pure1
  • FlashArray (or Cloud Block Store--authentication is the same)
  • FlashBlade

If you have many FlashArrays, FlashBlades, or Cloud Block Store instances, they can be be registered in an automated fashion via a Pure1 connection. For details on that process refer to the section on Fleet Registration towards the bottom of this page.

Network Requirements 

To authenticate a Pure1 connection the following is required:

  • TCP Port 443 access to pure1.purestorage.com from vRealize Orchestrator

To authenticate a FlashArray or Cloud Block Store connection the following is required:

  • TCP Port 443 access to the virtual IP address (this can be virtual IP address 0 or 1) of the target FlashArray from vRealize Orchestrator

To authenticate a FlashBlade connection the following is required:

  • TCP Port 443 access to the virtual IP address (this can be virtual IP address 0 or 1) of the target FlashBladey from vRealize Orchestrator
  • If you plan to generate a FlashBlade API token directly from vRO you will need TCP port 22 opened as well.

Authenticating with Pure1

Adding a Pure1 Connection

The 3.5.0 release of the Pure Storage Plugin for vRealize Orchestrator adds support for connectivity to the Pure1 REST API. The Pure1 REST API provides additional information about your fleet of storage as well as metrics and metadata not available directly from the arrays themselves. Pure1 authentication is not required, but recommended to fully take advantage of the plugin.

Generating a Key Pair

The Pure1 REST API uses RSA256 private/public key-based authentication. In order to authenticate an application with Pure1, a public key must be configured within Pure1 that corresponds to the private key configured within that application. There are a variety of mechanisms to do this, but the Pure Storage Plugin for vRealize Orchestrator (from now on will be shortened to "vRO Plugin") provides the ability to do this. You do not have to use this procedure, but this is the simplest in context to vRO.

Login to the vRealize Orchestrator interface and navigate to the workflow named Generate RSA Key under Library > Pure Storage > Pure1 Meta > Pure Organization Management:

clipboard_ed2144ca08766660dada08a23577a355d.png

Right-click on the workflow and click Start Workflow

clipboard_e497674028faf1caa96d57068ce0498e3.png

The only option in the workflow is to choose if the workflow outputs the private key as a secure string or as a regular string. If you plan on copying the key and storing it externally, choose No (most common). If you have included this workflow in a larger one, it is recommended to keep this as Yes (default) so that vRO passes the private key in a secure fashion.

Choose your option and click Submit.

clipboard_ec74bf2773b9cdd26db29b38ba893ba9d.png

Under the Variables tab of the workflow run, click on the value of the publicKeyOutput.

clipboard_ea087bb1d9b219cdb16f66d8330b5a687.png

Triple-click on the value so that the full public key is highlighted in dark blue and type Ctrl-C (or the relative command for your OS) on your keyboard to copy the contents.

clipboard_ef7c1e49b4b3bdcec1bc95c2822080402.png

Do the same thing with the private key (privateKeyOutput) and store the key for later.

Adding a Public Key to Pure1

Login to Pure1 as an administrator. If you are not an administrator, provide the key to your admin and have them follow this section.

https://pure1.purestorage.com

On the left-hand side, click on API Registration under the Administration section. If you do not see this, you are not a Pure1 administrator.

clipboard_e1b5f807a902dbc9b3b38250c2234b7b4.png

Click on Register Application

clipboard_e30237aa20c52e031a3ca2f58319fde97.png

Give the application a name (something descriptive) and paste in the public key. Currently when you copy the key it removes the new lines between -----BEGIN PUBLIC KEY-----  and the key itself and the key and -----END PUBLIC KEY-----. You need to replace the space with a new line.

When you paste it in:

clipboard_e44f8331e93b7300449dd6ae3d478e4b5.png

 

So select the space after -----BEGIN PUBLIC KEY-----:

clipboard_e7db7a167627e184a62933b23d719a79e.png

And hit enter while it is still selected.

clipboard_e315e79277ac6c63036211732bf8e9ae3.png

Then do the same for before the -----END PUBLIC KEY-----:

clipboard_e33ebd35b8747eff532297ed49de34225.png

While selected, hit enter. This will move it to a new line.

clipboard_e336f98a3f863239466359b4eb3fa0f2b.png

Note the requirement to edit the key formatting is something we plan to fix in a future release.

Now choose either Admin or Read Only. It is recommended to make the application admin (this will allow you to create tags from vRO) but not required. 

clipboard_e5216051346fd1d19758e6718d4d0e726.png

Click Upload.

Now identify the key in the table and find the application ID. Copy it and return to vRealize Orchestrator.

clipboard_e68d4007612e56f5bf3b9aba93fe09990.png

 

Authenticating a Pure1 Connection

Run the workflow called Add Pure1 Organization under Library > Pure Storage > Pure1 Meta > Pure1 Organization Management.

clipboard_e439713594c7f4fef5b5e2bf648a0c0ca.png

Add a name for the organization (no spaces).

There are two ways to authenticate Pure1. Either enter in a private key and the Pure1 application ID generated from its public key (from the process above) or you can paste in a JSON Web Token. A JSON Web Token (JWT) is generated from the application ID and the private key (instructions on creating a JWT can be found here).

The benefit of using a private key directly is that the connection is valid as long as the public key is still configured in Pure1. There is no set expiration. This is the simplest option as you also do not need to generate (or have someone generate) a JWT. The JWT option is better for organizations with stricter access control. A JWT can have an expiration and therefore an admin provisioning authentication to vRO can provide a JWT that is good for 3 months (for instance). Once it expires they will need request a new JWT. The benefit to that is stricter control. The downside is that you must monitor your expiration and replace it as needed.

To enter in a private key keep the option as No. To enter a JWT, choose Yes. Click Next.

clipboard_e36d7caf7fc29d1667766f98b62d0aeb1.png

Paste in your private key and you application ID, or a JWT, depending on the previously selected method.

clipboard_ec99c09d20770147c03cfdf24e4d6008d.png

Click Submit.

This will add the organization.

clipboard_ed59d1d4ef714eb98b063e2bca5ebec75.png

If you click on the Inventory tab, and expand Pure Storage, you will see the new Pure1 organization. You may add more than one organization, but a given organization can only be added once.

clipboard_e25ce38e0477239c9d862d52a53c196d0.png

Note that existing FlashArray, FlashBlade, or Cloud Block Store connections will not be moved into a Pure1 organization if it was registered before Pure1 was. Also if an array is moved to a new organization by Pure Storage support, vRO will not automatically respond and move the connection. To move a connection into the correct Pure1 organization once the Pure1 has been authenticated, run the Update FlashArray Connection or Update FlashBlade Connection and it will automatically be placed in the correct organization.

Permission Requirements of a Pure1 Connection

There are two levels of permissions needed for Pure1 authentication. First, there needs to be a user with Pure1 login credentials who is an administrator in your Pure1 organization. If you are unsure who your administrator is, contact Pure Storage Support. Once the administrator logs in, they should see the Administration section on the lower-left of the Pure1 screen. If they do not, they are not an admin.

clipboard_e3d1cf896c91358cf77e338090b4a484b.png

Having an admin level REST application ID does not provide this ability--this is separate from a Pure1 login administrator and has less privileges. Once logged in, an administrator creates an application ID with a certain level of permissions--as of the writing of this document it is either Admin or Read Only.

clipboard_ee5f25c6e0f48b3566a60a91376f2aa3d.png

Today there is not a significant difference between the two levels. An admin application ID can create, delete or edit tags plus everything else in the REST API. A read only user cannot create, edit, or delete tags, only read them. In short, a read only application ID cannot do anything besides authenticate and run GET-type REST operations as described in the Pure1 REST API Swagger:

https://static.pure1.purestorage.com/api-swagger/index.html

The vRO Plugin has workflows to tag arrays in Pure1, so to use that functionality it is recommended to generate application IDs with administrative permissions--but it is only needed if you plan to orchestrate tagging through vRO.

Updating a Pure1 Connection

To update a Pure1 Connection navigate to the Inventory within vRO, select the desired Pure1 organization, and click Run workflow.

clipboard_ea5ba6feb1150fb85279b73c688a2999a.png

From here, choose Update Pure1 Organization and click Select.

clipboard_ef0947fb7d165f73e41ef5a35b40b3fcf.png

From here, enter in the changes you would like to make (rename, changing private key/application ID, update JWT, or switch from one authentication option to the other).

clipboard_e09833795f99091a57bc77912ef371b25.png

Click Submit when you have entered in your desired changes.

 

Removing a Pure1 Connection

To remove a Pure1 Connection navigate to the Inventory within vRO, select the desired Pure1 organization, and click Run workflow.

clipboard_ea5ba6feb1150fb85279b73c688a2999a.png

From here, choose Remove Pure1 Organization and click Select.

clipboard_eeb69c7792a7f16ebec505cf3b7cc9cc9.png

Confirm the selected Pure1 organization and click Submit.

clipboard_ecde45142fe766e9ce5783b078ad2456c.png

If the workflow finds any remaining FlashArray, Cloud Block Store, or FlashBlade connections it will ask for additional input after the workflow has began.

clipboard_e44a154cada04bf871c043ce8b45cc524.png

Click Answer.

This will ask if you want all identified connections to also be removed. The default is No. If you choose No the connections will be moved to the Uncategorized organization. If you choose Yes they will be removed entirely.

clipboard_e7270189bcf3598b057f1a369894d630c.png

Automated Fleet Authentication via Pure1

If you have more than one array, the vRO plugin offers an automated way to authenticate all of your arrays. Once you have authenticated a Pure1 organization, there is a workflow called Register FlashArrays from Pure1 under Library > Pure Storage > Pure1 Meta > Array Registration.

clipboard_e429567b014e409a0094e9d4e769b4590.png

Right-click on the workflow and click Start Workflow.

clipboard_eb475da74c8a9a2d6227a37b22c22dd1f.png

There are a few required inputs:

clipboard_e2da58c061eafcabd8235466e2977441f.png

Pure1 Connection. Specify the Pure1 organization from which you would like to register the arrays. Use same credentials? If one set of credentials is valid for all targets, you can specify them here. If not, choose No and it will not require credentials. They can be added one at a time during the workflow Resolve IPs? Pure1 (currently) does not offer the FQDN of arrays, only the IP. The vRO workflow will attempt to do a DNS lookup of the IPs and use the identified FQDN. If the lookup fails, it will use the IP. If you would like it to skip arrays that it cannot resolve, choose No.
clipboard_e210c545abeb64345dc76f3f2d6c41ca1.png clipboard_e95cb830b7bab38dba6396e46167f35fa.png clipboard_efcc35a6e84f3ed0a240414d6f6701e80.png

When ready click Submit.

clipboard_e2d64801360465fb417c8661c0f380908.png

If you have chosen to specify credentials one at a time, or the credentials are wrong, it will prompt for credentials for arrays that the credentials are not valid for. You will see the workflow is waiting for input by the person icon next to the workflow run:

clipboard_e76e35243096d81291ff923644f6a595c.png

You can right-click on it and choose Answer to enter credentials.

clipboard_e2d59cadbb20a2ccb68a2956a9a458db1.png

Enter the credentials and click Submit.

clipboard_ecddafeb855a6a0e6108ee51b47c16305.png

You can choose to skip arrays if you prefer that cannot be authenticated with the specified credentials.

Once done, all of the arrays in that organization will be authenticated and added to the Pure1 organization in the vRO inventory.

clipboard_eda56921f12421a38841048e7ca5f1b12.png

There are a few points to make about this workflow:

  1. This is only supported for FlashArray and Cloud Block Store. FlashBlades will be skipped. Inclusion of FlashBlades will come in a future release.
  2. Arrays that cannot be reached on the network will be skipped.
  3. Arrays that are already registered will be skipped.
  4. The workflow will automatically import certificates.
  5. There is no option to choose a REST version--it will automatically choose the latest available on that target.

 

 

 

 

Authenticating with a FlashArray or Cloud Block Store

Adding a FlashArray Connection

If you do not have access to Pure1, or you want to customize the FlashArray connections as added, you can manually authenticate each FlashArray or Cloud Block Store storage platform. To do so, navigate to the Import FlashArray certificate from URL workflow under Library > Pure Storage > FlashArray Connection Management. Right-click and choose Start workflow:

clipboard_ee7cae27bf1875966a01bb5145546070c.png

Enter in the FQDN of the FlashArray management address and  choose whether or not to accept an untrusted certificate. Click Submit.

clipboard_ee8b75f891aacdabc116ecd744e1779fc.png

Now right-click on the workflow Add FlashArray Connection and choose Start workflow.

clipboard_e4b76cfac8770b251f2785fce12165e72.png

Enter in the following pieces of information:

  • Name. This is a friendly name and can be anything.
  • IP/FQDN. Enter in whatever you entered when adding the certificate.
  • REST API version. If you have added the certificate, the workflow will pull all available REST API versions and will choose the latest available on on that array. If this list does not show up (make sure autopopulate is set to yes), it means either the certificate was not loaded, or the IP/FQDN was entered incorrectly.
  • Credentials. Enter in a user name and password.

clipboard_ec628935c1d50855902d753c7d21c7bf4.png

The vRO Plugin does not yet support REST API version 2.x on the FlashArray so those versions are filtered out. Support for that will be in a future release.

Click Submit to add the FlashArray.

Once added it will appear in the vRO inventory. Navigate to the inventory tab, then click on Pure Storage. A FlashArray will be added to the Pure1 organization owning it if the Pure1 organization is authenticated in vRO. If it is not, it will be added to the default group called Uncategorized. Both FlashArrays and Cloud Block Storage connections will appear under the FlashArray Connection folder.

clipboard_ed9367e7656f98a33bc711615abc2f857.png

 

Permission Requirements of a FlashArray Connection

A FlashArray or Cloud Block Store supports a variety of permission levels:

clipboard_ec42c4891571881aa11eb2c1278d051e3.png

While vRO does not require a certain level, the higher level credentials you provide, the more you can do with the plugin. If you plan on orchestrating array configuration or pod creation/management, you will need array admin permissions. If you plan to only configure and provision storage, storage admin will suffice.

It is recommended, however, to create a local service account (or through LDAP/active directory) to authenticate the plugin.

Updating a FlashArray Connection

To update a FlashArray connection find the FlashArray connection in the vRO inventory and right-click and choose Run Workflow or select it and click the green start button on the top panel:

clipboard_eeb9992cf3d341d21be1372e5accacc2a.png

Find Update FlashArray Connection and click Select.

clipboard_e1e04f4a9c42c2733b4ffca9a8c2d59d3.png

Update the credentials, name, FQDN, REST version as needed. No matter what, you must re-enter valid credentials to complete any change.

clipboard_e970f11dd5617217fb7468e218955fa7d.png

Running an update connection on a connection will also ensure the array is in the right Pure1 organization. So if it is currently in the Uncategorized organization because its owning organization was not yet registered in vRO, but is subsequently, when the update connection workflow is run, the connection will be moved to the right organization.

 

Removing a FlashArray Connection

To remove a FlashArray or Cloud Block Store connection one at a time, find the FlashArray connection in the vRO inventory and select it and click on the green button on the top of the panel or right-click and choose Run Workflow:

To remove all FlashArray or Cloud Block Store connections within a specific Pure1 connection, you can remove the Pure1 connection and opt to also remove all children connections.

clipboard_eeb9992cf3d341d21be1372e5accacc2a.png

Choose Remove FlashArray Connection and click Select.

clipboard_e71b22ebf1a22bbec7ffec952ca9afafe.png

Verify that this is the correct FlashArray or Cloud Block Store connection and click Submit.

clipboard_e80a4355d575d87b6b4c63286b7921358.png

This completes the process to remove the connection.

 

Authenticating with a FlashBlade

Adding a FlashBlade Connection

Authentication with a FlashBlade uses an API token which can be generated or pulled via a user name and password. The API token cannot be retrieved through the API--only through SSH to the FlashBlade. The vRO Plugin has the ability to do this, but it means that port 22 TCP to the FlashBlade must be open from the vRO appliance in addition to port 443 TCP for the REST connection.

Retrieve a FlashBlade API Token

If you do not have a FlashBlade API token, but you do have a username and password to the FlashBlade, you can either login to the FlashBlade via SSH directly and retrieve it, or you can use the vRO Plugin to do so. To generate (or retrieve) an API token, run the workflow called Create FlashBlade Token under Library > Pure Storage > FlashBlade Connection Management.

Right-click on it and choose Start workflow

clipboard_e796ce913920b5eebb92b3c477d04ab76.png

Enter in the FlashBlade IP or FQDN and valid credentials.

clipboard_e94ba252fea423fe2926fdf17ce9cdf8a.png

Click Submit. This will either retrieve the token for that user or create a new one and return it. You can go into the logs and copy the token from the log line showing the token:

clipboard_e66f1675b28797395271a07ab1e2f84ab.png

Copy it.

Import the FlashBlade Certificate

Before adding a FlashBlade, you must import its certificate. To do so, navigate to the Import FlashBlade certificate from URL workflow under Library Pure Storage > FlashBladeConnection Management. Right-click and choose Start workflow:

clipboard_e08357b95078defc313453f3b5a40f76d.png

Enter in the FQDN of the FlashBlade management address and choose whether or not to accept an untrusted certificate. Click Submit.

clipboard_ee5abaf1df88a5ebe82eacc31ec29794f.png

Authenticate the FlashBlade

To authenticate a FlashBlade, run the workflow called Add FlashBlade Connection under Library > Pure Storage > FlashBlade Connection Management.

Right-click on it and choose Start workflow

clipboard_e777c02d39041e2db0b8238591f2f74c5.png

Enter in the following pieces of information:

  • Name. This is a friendly name and can be anything.
  • IP/FQDN. Enter in whatever you entered when adding the certificate.
  • REST API version. If you have added the certificate, the workflow will pull all available REST API versions and will choose the latest available on on that array. If this list does not show up (make sure autopopulate is set to yes), it means either the certificate was not loaded, or the IP/FQDN was entered incorrectly.
  • API token. Enter in an API token.

clipboard_eff53ad0ed492ef155a57bf2f9387451d.png

If the certificate is self-signed, it will ask you to reconfirm that the certificate is valid.

clipboard_eb57c6a6a42810b86da32ffe6901e8fb5.png

If a Pure1 organization that owns that FlashBlade is registered, it will be added to it automatically. If not, it will be added the the Uncategorized organization:

clipboard_e56aba0dbb2386247a30d991efeac3fa5.png

To move the FlashBlade into a correct organization once that Pure1 organization has been added, run the Update FlashBlade Connection workflow and it will be automatically placed in the right organization.

 

Permission Requirements of a FlashBlade Connection

A FlashBlade supports a variety of permission levels:

clipboard_e343de99a01f9c344659c4a17b99f5430.png

While vRO does not require a certain level, the higher level credentials you provide, the more you can do with the plugin. If you plan on orchestrating array configuration, you will need array admin permissions. If you plan to only configure and provision storage, storage admin will suffice.

Updating a FlashBlade Connection

To update a FlashBlade connection, run the workflow called Update FlashBlade Connection under Library Pure Storage > FlashBlade Connection Management.

Right-click on it and choose Start workflow

clipboard_ebd8dc7903cd8cd497021abbe19afc304.png

In the FlashBlade Connection input, click in the search (on Not set) to find the correct FlashBlade

clipboard_ef84b7e8a71ea22ff126e75ac9f86bd44.png

Find the FlashBlade connection and click Select

clipboard_ef20fde54d0b8f8db1f5f8edba116a762.png

Update the API token or name. You do not need to re-enter the API token to change the name.

clipboard_e7e3aee811c520136b5d0fa9c743fede8.png

Click Submit to make the change.

Running an update connection on a connection will also ensure the array is in the right Pure1 organization. So if it is currently in the Uncategorized organization because its owning organization was not yet registered in vRO, but is subsequently, when the update connection workflow is run, the connection will be moved to the right organization.

Removing a FlashBlade Connection

To remove a FlashBlade connection one at a time, find the FlashBlade connection in the vRO inventory and select it and click on the green button on the top of the panel or right-click and choose Run Workflow:

To remove all FlashBlade connections within a specific Pure1 connection, you can remove the Pure1 connection and opt to also remove all children connections.

clipboard_e1130f41a798d802fd3b932405ffa90bd.png

Choose Remove FlashBlade Connection and click Select.

clipboard_eabf1694450bb9f52709523b1c9e4138a.png

Verify that this is the correct FlashBlade connection and click Submit.

clipboard_ef1963eba2e39697f5a6b4558717e3ba5.png

This completes the process to remove the connection.