VCF Operations 9.0.2 List AD Groups and Users via API

We discussed how to capture AD Groups and Users brokered by vIDB into VCF Operations 9.1 a few weeks ago. In this blog we'll do the same, but against 9.0.2, which is a bit different.

First, we need an API Client and Secret, which we can get in the VCF Operations 9.0.2 UI at Fleet Management - Identity & Access - VCF Other Components.

Click REGENERATE to regenerate a new Client Secret for your Client ID.

Once you have your Client Secret you need to take your client_id:client_secret and Base64 encode it, which will give you a long string. Take that string and use it to authenticate with the VCF Operations API:

curl --location --request POST "https://your_identity_broker_issuer_goes_here/token" -H "Authorization: Basic your_base64encodedstringgoeshere" -H "Content-Type: application/x-www-form-urlencoded" --data-urlencode "grant_type=client_credentials" -k

Your Identity Broker Issuer is in the first screenshot above. That will return an Operations Bearer Token.

{"scope":"profile openid user admin group","access_token":"your_bearer_token_will_be_here","token_type":"Bearer","expires_in":1798}

We will now use this Bearer Token to issue Operations API calls. The call we need to list vIDB Brokered AD/SSO users looks like this.

curl -s -X GET "https://your_identity_broker_issuer_goes_here/scim/v2/Users" -H "Authorization: Bearer your_bearer_token_goes_here" -H "Accept: application/scim+json" -k

The response here will be fairly long and ugly, so I appended my curl call with some Python to massage it (you could also jq if you'd like).

curl -s -X GET "https://your_identity_broker_issues_goes_here/scim/v2/Users" -H "Authorization: Bearer your_bearer_token_goes_here" -H "Accept: application/scim+json" -k | python3 -c "import json,sys; data=json.load(sys.stdin); [print('{:20} {}'.format(u.get('userName'), ', '.join(g.get('display', g.get('value')) for g in u.get('groups', [])))) for u in data.get('Resources', [])]"

The response now looks like this:

Administrator   	ALL_USERS, Domain Admins, Enterprise Admins
bob                ALL_USERS, CloudAdmins
sean               ALL_USERS, CloudAdmins
mary               ALL_USERS, Domain Admins
john               ALL_USERS
andy               ALL_USERS, CloudAdmins

Which corresponds to our vIDB Brokered AD Groups/Users.

• 

• 

And to our User Accounts/Groups.

• 

• 

Additional SCIM API Endpoints can be found here if you'd like to explore. Thanks to my colleague Gopal Gorthi for his insight here. Hope this was helpful, enjoy!