iControl PowerShell Authentication Behavior (Initialize-F5.iControl)

I don't know of any documentation that describes the Powershell implementation the way you're asking, but I can try to answer your questions.

First, the only documentation I know of would be the download page and then the iControl PowerShell page.

When you do

Initialize-F5.iControl

, it sets up the information for a connection to the specified device. If you call it subsequent times, it will overwrite the existing connection information.

Then, when you make a call like

$iControl = Get-F5.iControl

it will be based on the connection you just initialized. (Note that if you run the initialize command again after calling the Get-F5.iControl function, your object will be updated to point to the new device. So you wouldn't be able to have multiple different

$iControl

instances going to different devices.

Regarding the way authentication works on each call, PowerShell will send the credentials in a header as the service uses Basic authentication to validate the user. So each command is essentially independent of any others, and will always send the authorization header for each request.

So basically, if you have multiple devices you want to interact with (as your script does), the

Initialize-F5.iControl

command will keep updating with the specified hostname instead of creating additional connection objects. Then the subsequent commands in your loop will be scoped to that device.

Hope this helps.

Hi Michael,

 

Thank you so much for your detailed explanation. So by using the above code snippet to retrieve pool statistics, I'm making several thousands of authentication calls... is there any alternative or better way of retrieving pool member statistics for a given set of pools?

 

Thanks.

 

It will probably work that way. Not sure how the performance will be. Your other option since you're on 11.4.1 is to check out iControlRest. From PowerShell you can use the

Invoke-RestMethod

(I think PowerShell needs to be on version 4 or later) to make the calls there.

Here's some links for iControlREST:

• iControlREST Home
• Introducing iControlREST
• iControlREST 101 Technical Articles
• iControlREST User Guide

I heard about iControl REST protocol, but it looks like this approach requires full ADMIN rights to initiate calls which is little bit difficult to get approval in our ENT environment at this time.

 

Thanks again!

 

Michael has it pretty much correct but each time you make a call it doesn't make a separate auth calls. The Initialize-F5.iControl essentially creates an internal iControl.Interfaces object that can be retrieved with the Get-F5.iControl cmdlet. When you call Initialize-F5.iControl it makes a call to the BIG-IP's system information interface just to check that the credentials will work. Then when you access any of the interface members of the Interfaces object (returned from Get-F5.iControl), a separate auth call isn't made. It just uses the credentials you originally supplied and adds Authentication headers to all method call requests. iControl is stateless in that each call you make will establish a new HTTPS connection to the BIG-IP and request the URL for the given method. I believe I set the PreAuthenticate header on the .Net connection object so that it would pass the credentials on the first pass without requiring retries.

If you wish to manage multiple systems, you can create individual interfaces objects, initialize each once, and then use them for your different devices. Essentially it's just a object storing the server IP and client credentials.

You can do something like this for multiple systems if you don't want to have to keep calling Initialize-F5.iControl back and forth

$bigip1 = New-Object iControl.Interfaces
$bigip1.initialize("address1", 443, "username1", "password1")
$bigip2 = New-Object iControl.Interfaces
$bigip2.initialize("address2", 443, "username2", "password2")
...
$sysinfo1 = $bigip1.SystemSystemInfo.get_system_information()
$sysinfo2 = $bigip2.SystemSystemInfo.get_system_information()

Hope this helps...

-Joe