How to determine whether a task in vCenter was executed via an external API or the vSphere Client UI

Products

• VMware vSphere ESXi

Issue/Introduction

When investigating administrative or automated operations in vCenter Server, administrators often need to audit the source of a specific action—specifically, whether a task was triggered directly via the vSphere Client User Interface (UI) or through an external API client (such as PowerCLI, pyVmomi, GoVC, or third-party backup software).

This article provides a step-by-step method using vpxd.log to trace task session details, SAML token characteristics, and delegation chains to confirm the execution source.

Example Used in This Article: The vim.VirtualMachine.consolidateDisks (Consolidate Disks) task is used as a baseline workflow for demonstration purposes.

Environment

vCenter Server 8.x

Cause

The fundamental difference between vSphere Client UI execution and External API execution lies in the SAML Token Authentication Architecture:

• vSphere Client UI: Requests go through the vSphere UI proxy service (vsphere-webclient). As a result, SSO generates a Holder-of-Key (Saml_HOK) token containing a delegationChain that lists the vsphere-webclient and vpxd solution users.

• External API / SDK: Direct API calls authenticate directly with SSO without proxy delegation, resulting in a Bearer (Saml_Bearer) token with an empty delegation chain (delegationChain=[]).

Resolution

Follow these steps to trace a task back to its authentication source in vpxd.log:

Step 1: Identify the Task, Session ID, and opID

Search vpxd.log for the target API method name or task execution around the estimated time frame.

YYYY-MM-DDTHH:MM:SS info vpxd[07591] [Originator@6876 sub=vpxLro opID=1ca2943f] [VpxLRO] -- BEGIN task-####### -- vm-##### -- vim.VirtualMachine.consolidateDisks -- 52848555-b70d-84c1-aaf8-9678c6808366(########-####-####-####-############)

• Note the Session ID: 52848555-b70d-84c1-aaf8-9678c6808366

Step 2: Trace the Session Login Record

Search for the Session ID extracted in Step 1 to locate the corresponding SessionManager.login event and obtain its Operation ID (opID).

YYYY-MM-DDTHH:MM:SS info vpxd[07527] [Originator@6876 sub=vpxLro opID=3444050e] [VpxLRO] -- BEGIN lro-######### -- SessionManager -- vim.SessionManager.login -- 52848555-b70d-84c1-aaf8-9678c6808366

• Note the login opID: 3444050e

Step 3: Analyze the SAML Authentication Token

Filter vpxd.log using sub=SsoClient and the login opID obtained in Step 2 (3444050e) to inspect the token details.

Scenario A: Triggered by External API / Automation

Log entry pattern:

YYYY-MM-DDTHH:MM:SS.637+08:00 info vpxd[07527] [Originator@6876 sub=SsoClient opID=3444050e] Successfully acquired token: SamlToken [subject={Name: Administrator; Domain:<Reality SSO name>}, groups=[{Name: Users; Domain:<Reality SSO name>}, {Name: Administrators; Domain:<Reality SSO name>}, {Name: CAAdmins; Domain:<Reality SSO name>}, {Name: SystemConfiguration.Administrators; Domain:<Reality SSO name>}, {Name: ComponentManager.Administrators; Domain:<Reality SSO name>}, {Name: SystemConfiguration.BashShellAdministrators; Domain:<Reality SSO name>}, {Name: SystemConfiguration.ReadOnly; Domain:<Reality SSO name>}, {Name: SystemConfiguration.SupportUsers; Domain:<Reality SSO name>}, {Name: LicenseService.Administrators; Domain:<Reality SSO name>}, {Name: Everyone; Domain:<Reality SSO name>}], delegationChain=[], startTime=YYYY-MM-DD HH:MM:SS, endTime=YYYY-MM-DD HH:MM:SS, renewCount=10, delegableCount=10, isSolution=false, type=Saml_Bearer]

Key Characteristics:

1. delegationChain=[]: Indicates no intermediate vsphere-webclient proxy was involved.

2. type=Saml_Bearer: Standard Bearer token requested directly from vCenter SSO.

Conclusion: The operation was directly invoked via an external script, SDK (e.g., Python pyVmomi, PowerCLI, govomi), or third-party integration (e.g., backup solutions like Veeam/Commvault).

Scenario B: Triggered via vSphere Client UI

Log entry pattern:

YYYY-MM-DDTHH:MM:SS info vpxd[06841] [Originator@6876 sub=SsoClient] Successfully acquired token: SamlToken [subject={Name: Administrator; Domain:<Reality SSO name>}, groups=[{Name: Users; Domain:<Reality SSO name>}, {Name: Administrators; Domain:<Reality SSO name>}, {Name: CAAdmins; Domain:<Reality SSO name>}, {Name: SystemConfiguration.Administrators; Domain:<Reality SSO name>}, {Name: ComponentManager.Administrators; Domain:<Reality SSO name>}, {Name: SystemConfiguration.BashShellAdministrators; Domain:<Reality SSO name>}, {Name: SystemConfiguration.ReadOnly; Domain:<Reality SSO name>}, {Name: SystemConfiguration.SupportUsers; Domain:<Reality SSO name>}, {Name: LicenseService.Administrators; Domain:<Reality SSO name>}, {Name: Everyone; Domain:<Reality SSO name>}], delegationChain=[{Name: vsphere-webclient-5dee597f-51b8-4582-ba80-547c4ceb3781; Domain:<Reality SSO name>} at YYYY-MM-DDTHH:MM:SS, {Name: vpxd-########-####-####-####-############; Domain:<Reality SSO name>} at YYYY-MM-DDTHH:MM:SS], startTime=YYYY-MM-DD HH:MM:SS, endTime=YYYY-MM-DD HH:MM:SS, renewCount=8, delegableCount=8, isSolution=false, type=Saml_HOK]

Key Characteristics:

1. delegationChain: Explicitly includes the UI solution user (e.g., vsphere-webclient-xxxxx).

2. type=Saml_HOK: Holder-of-Key token used by UI proxy sessions.

Conclusion: The operation was initiated manually by a user interacting with the vSphere Client web interface.

Additional Information

 

• If logs confirm the operation was initiated via an External API (Saml_Bearer), check third-party backup software schedules, orchestration tools (e.g., vRealize Automation / Aria Automation), or custom administrative scripts running in your environment.

• Logs for vCenter Server can be found at: /var/log/vmware/vpxd/vpxd.log on the vCenter Server Appliance (VCSA).