[BUG] Permission Error with ContinueRetrievePropertiesEx in govc v0.37.0+ on vSphere 8.x about govmomi

[github-actions]

Howdy 🖐   robinlehrmann ! Thank you for your interest in this project. We value your feedback and will respond soon.

If you want to contribute to this project, please make yourself familiar with the CONTRIBUTION guidelines.

[dougm]

Thanks for the detailed report @robinlehrmann
I was not aware of this behavior, but will work on reproducing + fixing. In the meantime, a possible workaround would be to specify -vm.ipath, uses the SearchIndex, rather than PropertyCollector:

govc vm.console -vm.ipath /Datacenter-Name/vm/VM-Name

[dougm]

Can you also share your build number (govc about) ?

I was able to reproduce with 8.0.2b (build 23319993), and verified the -vm.ipath workaround.

But was not able to reproduce with 7.0.3 or 8.0.3 builds (currently internal).

[dougm]

Confirmed this is a known issue 7.0.3.2 up to 8.0.2, from the upcoming KB:

Workaround: To workaround the issue you can grant non-propagating ReadOnly role to the user on the root folder.
That will give access to the user to the API, without exposing any additional information.

This workaround can be applied in the UI or using govc:

govc permissions.set -principal [email protected] -role ReadOnly -propagate=false /

[robinlehrmann]

Can you also share your build number (govc about) ?

FullName: VMware vCenter Server 7.0.3 build-22837322
Name: VMware vCenter Server
Vendor: VMware, Inc.
Version: 7.0.3
Build: 22837322
OS type: linux-x64
API type: VirtualCenter
API version: 7.0.3.0
Product ID: vpx
UUID: 8897b0d7-923c-4fdd-92d5-f248d55fea61

I was able to reproduce with 8.0.2b (build 23319993), and verified the -vm.ipath workaround.

Thanks for providing the workaround 👍 I will try this out.
The only problem is, that in the system are a lot of users around 8-12 k were I need to apply this and not sure if the will scale good in regards of performance 😅