vCenter Single Sign On

VMware vCenter Single Sign-On (SSO) is an authentication broker and security token exchange infrastructure, which allows VMware vSphere components to communicate with each other through a secure token mechanism and uses the following services:

• Security Token Service (STS)
• SSL for secure traffic
• Authentication of users by using an identity source such as Active Directory™ or OpenLDAP

Review the following vSphere SSO flow.

1. A user logs in to the vSphere Client with a username and password to access vCenter or a vCenter service.
2. The vSphere Client passes the login information to the SSO service, which checks the SAML token of the vSphere Client. If the vSphere Client has a valid token, SSO checks:
   • If the user ID is @vsphere.local, then it checks the user against the local SSO domain.
   • If the user ID is @DOMAIN, then SSO uses the identity source to check that domain.
3. If authentication is successful SSO returns a token that represents the user to the vSphere Client.
4. The vSphere Client passes the token to vCenter.
5. vCenter checks with SSO that the token is valid and is not expired.
6. The user can view and modify any objects that the user's role has privileges for.

The vSphere SSO domain is used as the initial authentication mechanism and it serves to connect an instance or multiple linked instances to the AD servers in the IBM Cloud® for VMware Solutions infrastructure domain. In the IBM Cloud for VMware Solutions vCenter Server design, the following SSO configuration is applied:

• The SSO domain of vsphere.local is always used.
• The SSO site name equals the <root_domain> captured during the ordering process.
• An identity source, the IBM Cloud for VMware Solutions infrastructure domain <root_domain>, is configured.
• The VSPHERE.LOCAL\Administrator user is configured as an Administrator role.
• The following groups are configured with Administrator roles:
  • <root_domain>\ic4v-vCenter
  • vsphere.local\Administrators

After deployment, the administrator@vsphere.local user has administrator access to both SSO and vCenter Server. This user can manage identity sources and default domains, specify password policies, and perform other administrative tasks in the vsphere.local domain. However, this user is integral to the VMware vSphere® and VMware NSX® infrastructure authentication they are not part of AD but created automatically when vSphere is deployed. As this account is not part of AD, they can be used in situations when AD is not working correctly.

As the customer, you have full access to manage the vSphere SSO users and groups as needed. For more information about changing these policies, see Managing vCenter Single Sign-On users and groups.