Configure VCF 9 SSO with Active Directory

HOMELAB JOURNAL

Configure VCF 9 Active Directory SSO with an external Identity Broker, LDAPS provisioning, and user or group permissions in vCenter and NSX.

Overview

This VCF 9 Active Directory SSO walkthrough starts after deploying the external Identity Broker in my lab. I configure the directory connection and provisioning, then assign access in vCenter and NSX; other components have their own SSO guides.

LDAPS prerequisites and recovery access

Prepare a directory bind account with the required read scope and a Base DN that includes the users/groups you intend to provision. CN=Users is a container, not the name of a group.
Use reachable domain-controller FQDNs with matching forward and reverse DNS, synchronized time, valid LDAPS certificates and the full issuing CA trust chain. Test from the Identity Broker network, not only your workstation.
Verify the LDAPS endpoint and configured port (normally 636), hostname/SAN and certificate expiry. Do not disable validation to work around a trust error.
Use dedicated VCF groups and the smallest component roles/scopes needed. Synchronizing a directory group does not justify assigning global Administrator access.
Before changing SSO, verify a local recovery account for each component and store its credentials securely. Afterward test both SSO and local recovery login in separate sessions.

The Domain Admins and propagated Global Permissions in the screenshots are lab examples. For troubleshooting a VCF 9 directory connection, Broadcom specifically calls out domain-controller forward/PTR DNS checks.

Related background: here

For this lab, I have built an active directory domain to use for my identity provider. VCF 9 has the capability of supporting the following identity providers.

OKTA
Ping Identity
Microsoft Entra ID
Microsoft ADFS
Generic SAML 2.0
Open LDAP
AD/LDAP

Select the identity provider

After deploying identity broker, I can configure single sign on for all my VCF components. Start by logging into the VCF Operations web gui and expand Fleet Management. Then click on Identity & Access

VCF SSO introductory guidance explains embedded and appliance Identity Broker deployment modes and configuration across VCF components and instances.

Review the Prerequisites and click the checkboxes next to each confirmation, then click Continue

SSO prerequisites warn that existing identity-provider settings may be overwritten, Enhanced Linked Mode must be disabled, integrations may need re-provisioning, and the configuring user needs All Objects scope.

In the SSO Overview screen, click the dropdown to select which VCF Instance you are configuring. I am configuring my vcf-mgmt domain first.

Click on Start under Choose deployment mode.

Select the radio button next to Identity broker appliance and click Next

Click on Start next to Configure Identity Provider.

I will be using Active Directory for my identity provider in this lab so select the AD/LDAP provider and click Next

Click Configure in the Configure the identity provider section.

Configure the directory connection

In the Identity Provider Configuration, enter in the Active Directory information for your domain. I am using secure LDAP for the connection to all my domain controllers so a root certificate is required to be provided as well. The base DN and Bind username/password are required for connection.

The lab Base DN CN=Users,DC=jtec,DC=local points to the default Users container. Choose the container or OU that actually contains your intended users and groups, then click Next.

Review the information you entered in for your directory and click Finish to complete

The AD/LDAP review shows Global Catalog enabled, primary and secondary domain controllers using LDAPS on port 3269, uploaded certificates, sAMAccountName search, and the directory base and bind-user distinguished names.

Provision users and groups

Under configure user and group provisioning, click Configure. This is where we will connect the VCF users and admins to our VCF instance.

At the Review Directory Information screen, click Next.

Review the attribute mapping is correct for that directory and click Next

Identity Broker attribute mappings pair userName with sAMAccountName, firstName with givenName, lastName with sn, and email with mail; distinguishedName and userPrincipalName retain their matching directory attributes.

For Group Provisioning, I will be adding the Domain Admins and VCF Users group. Search for the groups you want to add and click the checkbox next to them so they appear in the groups selected section. Click Next after all the groups have been selected

If you have specific users that you want to be included, search for them and click the checkbox next to them so they show up under users selected. For this example, I am going to add my VCF Admin user even though it is a domain admin. Click Next to continue.

Review the information you provided for the provisioning setup, if you have additional groups nested under the main groups you added, be sure to click the check box to Sync Nested Groups. Click Finish to complete the provisioning.

Provisioning review lists two groups and one user; the notice says Finish starts a background sync, followed by a weekly schedule that can be changed in Sync Settings.

Click on Done to complete the configuration.

Enable component SSO

Click Start to configure the individual components.

This will take you to the screen to configure the NSX Manager and vCenter. click the checkboxes next to each component and click Configure

The selected NSX Manager and vCenter clients are not yet configured; the notice limits SSO support here to version 9.0 or later components outside an Enhanced Linked Mode ring.

A pop-up will appear advising that each of these components will need to be manually configured. Click the checkbox next to the confirmation and click Continue

The role-assignment notice requires logging in locally to each component and assigning service roles to provisioned users or groups before SSO access works.

Click Finish Setup and then we will configure the components for single sign on login.

Before continuing past the backup prompt, verify the required component backups and local recovery logins. Then proceed with the SSO configuration.

Finish Setup recommends backing up VCF Operations and the management vCenter or Identity Broker appliance, including after major SSO changes, and reiterates component role assignments.

We have completed the single sign on configuration in fleet manager, now we need to configure the appliances.

The Identity Source page shows appliance-based Identity Broker deployment, AD/LDAP authentication, two synced groups, three synced users, and zero alerts.

Configure vCenter permissions

First I will login to the vCenter server and provision it for SSO. You will notice there is an option to use VCF SSO as login method now with vCenter. Click the drop-down to select Local Account

Click the menu icon in the top left hand corner and select Administration

Click on Global Permissions

Click Add underneath Global Permissions

Click on Domain and select the active directory domain we just configured. Enter in group or user you want to add and select the appropriate role for that user or group. Since this is at the Global level, I am going to click the checkbox to propagate to children so it applies to all levels. Click Ok.

The vCenter permission example assigns the VCF Users group the Read-only role at Global Permission Root with Propagate to children selected.

Repeat the steps above for any additional users or groups you want to add. After you have added all the groups and users they will appear in the Global Permissions list.