跨vCenter克隆VM模板：如何生成ServiceLocatorSAMLCredential Token？

在VMware vSphere环境中，通过SDK而非PowerCLI cmdlet跨vCenter克隆VM模板时，需调用VM模板对象的CloneVM_Task方法。操作中必须配置$spec.Location.Service.Credential以完成跨vCenter部署：

• 尝试实例化[VMware.Vim.ServiceLocatorSAMLCredential]并设置Token属性失败
• 使用[VMware.Vim.ServiceLocatorNamePassword]的用户名密码方式虽可行，但存在极高安全风险

现咨询如何生成$spec.Location.Service.Credential.Token的有效值。

操作代码示例 #

$vc_source = '____DNSNAME1____'
$vc_dest = '____DNSNAME2____'
$cred = Get-Credential -Title '目标vCenter的凭据'
Connect-VIServer -Server $vc_source
$vc = Connect-VIServer -Server $vc_dest

### 获取VM模板...
$tmpl = Get-View -ViewType VirtualMachine -Filter @{ Name = '____VM_TEMPLATE_NAME____'; 'Config.Template' = 'TRUE' } -Server $vc_source
# 获取VM模板所在ESXi主机名：
(Get-View -Id $tmpl.Runtime.Host -Property Name -Server $vc_source).Name
# 获取VM模板所有磁盘：
$aHD_tmpl = $tmpl.Config.Hardware.Device | ?{ $_ -is [VMware.Vim.VirtualDisk] }
# 获取VM模板所有网卡：
$aNIC_tmpl = $tmpl.Config.Hardware.Device | ?{ $_ -is [VMware.Vim.VirtualVmxnet] }

### 创建VM模板克隆规格...
$spec = [VMware.Vim.VirtualMachineCloneSpec]::new()
...
$spec.Location = [VMware.Vim.VirtualMachineRelocateSpec]::new()
...
$spec.Location.Service = [VMware.Vim.ServiceLocator]::new()
...

尝试失败的SAML Credential配置代码 #

### 无法使用"[VMware.Vim.ServiceLocatorSAMLCredential]"...
$spec.Location.Service.Credential = [VMware.Vim.ServiceLocatorSAMLCredential]::new()
$spec.Location.Service.Credential.Token = '未记录敏感数据'

$spec.Location.Service.SslThumbprint = ...
$spec.Location.Service.InstanceUuid = ...
$spec.Location.Service.Url = 'https://____FQDN_VC____:443/sdk'

启动克隆任务的代码 #

...
$folder = [VMware.Vim.ManagedObjectReference]::new()
$folder.Type = 'Folder'
$folder.Value = ...

$name = '____VMNAME____'

$vmClone_task = $tmpl.CloneVM_Task($folder, $name, $spec)

可行但安全性极低的用户名密码方案 #

$spec.Location.Service.Credential = [VMware.Vim.ServiceLocatorNamePassword]::new()
$spec.Location.Service.Credential.Username = $cred.UserName
$spec.Location.Service.Credential.Password = $cred.GetNetworkCredential().Password

内容的提问来源于stack exchange，提问作者Thomas Ertl