Determination of a minimal set of privileges to execute a workflow in a virtualized computing environment

1. A method to determine a minimal set of privileges to execute a workflow in a virtualized computing environment, the method comprising:

recording interactions with a user interface in the virtualized computing environment while executing the workflow;

capturing, from at least the recorded interactions, application program interface (API) calls that are made while executing the workflow on the user interface in the virtualized computing environment;

excluding, from the recorded interactions, API calls that are irrelevant to the workflow, wherein the excluded API calls include an API call involving a data retrieval caused by a refresh;

identifying privileges that correspond to the captured API calls; and

combining the identified privileges to form the minimal set of privileges.

2. The method of claim 1 , wherein capturing the API calls includes identifying the API calls from a common format that is generated by recording the interactions with the user interface while executing the workflow, and wherein identifying the privileges includes identifying the privileges from API metadata that corresponds to the captured API calls.

3. The method of claim 1 , further comprising:

generating a model that associates the minimal set of privileges to the workflow; and

applying the model to a user to determine privileges to assign to the user to perform a same workflow.

4. The method of claim 3 , further comprising updating the model.

5. The method of claim 1 , wherein the workflow pertains to management of elements in the virtualized computing environment.

6. The method of claim 1 , wherein recording the interactions includes recording code that is executed while interacting with the user interface during the workflow, wherein the recorded code includes the API calls, and wherein the method further comprises:

obfuscating confidential data that is present in the recorded code;

converting the recorded code into a script; and

translating the script into a language usable by a processor to identify the API calls and the privileges.

7. The method of claim 1 , wherein capturing the API calls further includes intercepting at least some of the API calls during run-time, separately from the recorded interactions.

8. A non-transitory computer-readable medium having instructions stored thereon, which in response to execution by one or more processors, cause the one or more processors to perform or control performance of operations to determine a minimal set of privileges to execute a workflow in a virtualized computing environment, the operations comprising:

recording interactions with a user interface in the virtualized computing environment while executing the workflow;

capturing, from at least the recorded interactions, application program interface (API) calls that are made while executing the workflow on the user interface in the virtualized computing environment;

excluding, from the recorded interactions, API calls that are irrelevant to the workflow, wherein the excluded API calls include an API call involving a data retrieval caused by a refresh;

identifying privileges that correspond to the captured API calls; and

combining the identified privileges to form the minimal set of privileges.

9. The non-transitory computer-readable medium of claim 8 , wherein capturing the API calls includes identifying the API calls from a common format that is generated by recording the interactions with the user interface while executing the workflow, and wherein identifying the privileges includes identifying the privileges from API metadata that corresponds to the captured API calls.

10. The non-transitory computer-readable medium of claim 8 , wherein the operations further comprise:

generating a model that associates the minimal set of privileges to the workflow; and

applying the model to a user to determine privileges to assign to the user to perform a same workflow.

11. The non-transitory computer-readable medium of claim 10 , wherein the operations further comprise:

updating the model.

12. The non-transitory computer-readable medium of claim 8 , wherein the workflow pertains to management of elements in the virtualized computing environment.

13. The non-transitory computer-readable medium of claim 8 , wherein recording the interactions includes recording code that is executed while interacting with the user interface during the workflow, wherein the recorded code includes the API calls, and wherein the operations further comprise:

obfuscating confidential data that is present in the recorded code;

converting the recorded code into a script; and

translating the script into a language usable by a processor to identify the API calls and the privileges.

14. The non-transitory computer-readable medium of claim 8 , wherein capturing the API calls further includes intercepting at least some of the API calls during run-time, separately from the recorded interactions.

15. An apparatus to determine a minimal set of privileges to execute a workflow in a virtualized computing environment, the apparatus comprising:

a display screen configured to present a user interface in the virtualized computing environment;

a recorder service configured to record interactions with the user interface while executing the workflow;

an application program interface (API) converter configured to capture, from at least the recorded interactions, API calls that are made while executing the workflow on the user interface, wherein the API converter is further configured to exclude, from the recorded interactions, API calls that are irrelevant to the workflow, wherein the excluded API calls include an API call involving a data retrieval caused by a refresh; and

a processor coupled to the API converter and configured to:

identify privileges that correspond to the captured API calls; and

combine the identified privileges to form the minimal set of privileges.

16. The apparatus of claim 15 , wherein:

to capture the API calls, the API converter is configured to identify the API calls from a common format that is generated from the recorded interactions with the user interface while executing the workflow, and

to identify the privileges, the processor is configured to identify the privileges from API metadata that corresponds to the captured API calls.

17. The apparatus of claim 15 , wherein the processor is further configured to:

generate a model that associates the minimal set of privileges to the workflow; and

apply the model to a user to determine privileges to assign to the user to perform a same workflow.

18. The apparatus of claim 17 , wherein processor is further configured to update the model.

19. The apparatus of claim 15 , wherein the workflow pertains to management of elements in the virtualized computing environment.

20. The apparatus of claim 15 , wherein to record the interactions, the recorder service is configured to record code that is executed while interacting with the user interface during the workflow, wherein the recorded code includes the API calls, wherein the API converter is further configured to:

obfuscate confidential data that is present in the recorded code; and

convert the recorded code into a script, and

wherein the apparatus further comprises a translator configured to translate the script into a language usable by a processor to identify the API calls and the privileges.

21. The apparatus of claim 15 , wherein to capture the API calls, the API converter is further configured to intercept at least some of the API calls during run-time, separately from the recorded interactions.