What permissions level in VMWare must be granted for the ServiceNow Discovery vCenter credential?

Rakesh16i · ‎04-24-2017

To ensure scans are successful without granting VMWare Admin level permissions since Orchestration is not required in this case, what permissions level in VMWare must be granted for the ServiceNow Discovery vCenter credential?

Does read-only permissions are sufficient? got confused over below lines from servicenow documentation.

"Discovery and Orchestration require vCenter credentials for any work that it performs on vCenter, such as cloning a virtual machine."

"Prepare VMware for CIM discovery" - is it mandatory??

Rakesh16i · ‎04-25-2017

I have received the following updates from ServiceNow support related to VMware credentials, which are completely aligned with previous updates.

Thanks all for your inputs

Q: Is CIM credential needed for ESX/I discovery?

A: Starting from Geneva onward, you no longer need CIM credentials to discover ESX/I as they are discovered through vCenter API. The only credentials needed are the vCenter credentials and the Windows credentials for the host running vCenter.

Q: Could you also confirm if read only permissions of vCenter credentials will be sufficient to discover VMware infrastructure completely.

A:The Read-only role is enough to allow ServiceNow users to run Discovery and view resources.

View solution in original post

doug_schulze · ‎04-27-2017

Correct! Where we used CIM to discover the physical serial number of the ESX hosts we now can gather it from the API itself like all other info from vCenter. CIM is now relegated to storage information only. While available if needed in other technologies OOB, storage is all we use it for...

Heiko Bllr · ‎12-20-2017

Hi Doug,

my client is currently switching from Windows to Linux for the vCenter platform. Means they will run vCenter on a Linux appliance.

What else do I need to discover vCenter on Linux, besides Linux credentials and vCenter credentials? Is there anything specific I need for Linux?

They also said they intend to access vCenter through a web interface (not sure if that is important at all from a discovery point of view).

Thanks,

Heiko

doug_schulze · ‎12-20-2017

You don't have to worry, the same vCenter credential configured on the appliance as it was on the server will do the very same work. We actually look for vCenter appliances through the vmapp port probe. So as long as the appliance responds to one of those IP services in the probe (in a standard discovery) then we trigger the very same (API) probe that gathers vCenter information, will be sent.

Let me know if this helps.

Heiko Bllr · ‎12-27-2017

Thank you Doug!