Remove-HVEntitlement removes all entitlements for a given pool about powercli-example-scripts HOT 4 CLOSED

You can see the issue here. One of the four entitlements actually contains a group. After running this, there are no entitlements on the pool FC-Test.

from powercli-example-scripts.

Hi, I'm using Horizon View 7.3.1 and I confirm that the original problem occurs in my environment too. However, I don't think that the fix is complete as it introduces a new problem.

Taking an environment with no user entitlements add a user entitlement for the test user to all pools

$(Get-HVPool -HvServer $vcs).base.Name |% { New-HVEntitlement -HvServer $vcs -User "domain.local\user1" -Type User -ResourceName $_ -ResourceType Desktop }`

Count how many there were

$($(Get-HVPool -HvServer $vcs).base.Name | measure).Count
7

Now try to remove the user from a specific pool.

Remove-HVEntitlement -HvServer $vcs -User "domain.local\user1" -ResourceName "Pool1" -ResourceType Desktop -Type User -Confirm:$true
7  desktopUserEntitlement(s) will be removed for UserOrGroup  domain.local\user1

7 results but there should be just 1. The problem is that the internal query doesn't return what we'd necessarily expect. Try this:

$ResourceObjs = Get-HVPool -PoolName 'Pool1' -suppressInfo $true -HvServer $vcs
$x = @()
$x += Get-HVQueryFilter base.loginName -Eq 'user1'
$x = Get-HVQueryFilter 'localData.desktops' -contains ([VMware.HV.DesktopId[]] $ResourceObjs.Id)
$myfilter = Get-HVQueryFilter -And -Filters $x
$r = Get-HVQueryResult -EntityType EntitledUserOrGroupLocalSummaryView -Filter $myFilter -hvServer $vcs

Looking at $r shows that it contains just one entry, but $r.LocalData.Desktops contains 7 desktop IDs. These are the IDs of all the pools that the user is entitled to, not just the one in the query. In PR#164 where the query is expanded to include the base.loginName, it now deletes the specified user's entitlements for all local pools not just the specific pool on the command line.

The original code, which basically did the query below, returns $r listing all users of the pool, AND for each user $r.LocalData.Desktops contains a list of all the pools that user is entitled to.

$x = @()
$x = Get-HVQueryFilter 'localData.desktops' -contains ([VMware.HV.DesktopId[]] $ResourceObjs.Id)
$myfilter = Get-HVQueryFilter -And -Filters $x
$r = Get-HVQueryResult -EntityType EntitledUserOrGroupLocalSummaryView -Filter $myFilter -hvServer $vcs

If, for example, we entitle a second user to just a couple of pools

'Pool1', 'Pool2' |% { New-HVEntitlement -HvServer $vcs -User "domain.local\user2" -Type User -ResourceName $_ -ResourceType Desktop }

We see that $r has two entries and $r[0].LocalData.Desktops.Length is 2 and $r[1].LocalData.Desktops.Length is 7

The API says that desktops is "Local desktops for which this user has an entitlement." and desktopUserEntitlements is "Local desktop user entitlements for this user or group. The array index will correspond to the same desktop entitlement as the DesktopId array." Therefore I'd suggest that we need to process the output from the query like this to extract a list of IDs we want to delete.

$deleteResources = @()
for ($i = 0; $i -lt $r.localdata.desktops.length; $i++) {
	if ($ResourceObjs.Id.id -eq $r.localdata.Desktops[$i].id) {
		$deleteResources += $r.localdata.DesktopUserEntitlements[$i]
	}
}

With this addition the results as expected

Remove-HVEntitlement -HvServer $vcs -User "domain.local\user1" -ResourceName "Pool1" -ResourceType Desktop -Type User -Confirm:$true
1  desktopUserEntitlement(s) will be removed for UserOrGroup  domain.local\user1

I can see the same issue with the Global Entitlement code and would suggest that it is also true for other three cases (but I don't have any of those things to test with)

I propose PR #165

from powercli-example-scripts.

Fixed by #165

from powercli-example-scripts.

I'll note that this is now fixed for Desktop entitlements, but the same thing happens for local and global Application entitlements. Remove-HVEntitlement -User 'domain\userid' -ResourceName 'AppName' -ResourceType Application will attempt to remove every Application entitlement that user has, rather than just the entitlement for AppName.

from powercli-example-scripts.