VMware vCenter supports different identity sources for authentication of users
who access vCenter. Your private cloud vCenter can be set up to authenticate
with Active Directory to let your VMware administrators access vCenter. When
the setup is complete, the
CloudOwner user can add users from the identity
source to vCenter.
You can set up your Active Directory domain and domain controllers in any of the following ways:
- Active Directory domain and domain controllers running on-premises
- New Active Directory domain and domain controllers running in your private cloud
Identity source options
- Add on-premises Active Directory as a single sign-on identity source.
- Set up a new Active Directory on a private cloud.
Add on-premises Active Directory as a single sign-on identity source
To set up your on-premises Active Directory as a single sign-on (SSO) identity source, you need:
- A site-to-site VPN connection from your on-premises data center to your private cloud.
- An on-premises DNS server IP added to your vCenter and Platform Services Controller (PSC).
The following table lists the information you need when setting up your on-premises Active Directory domain as an SSO identity source on vCenter.
|Name||The name of the identity source.|
|Base DN for users||The base distinguished name for users.|
|Domain name||The FDQN of the domain, for example, example.com. Do not provide an IP address in this field.|
|Domain alias||The domain NetBIOS name. If you are using SSPI authentication, add the NetBIOS name of the Active Directory domain as an alias of the identity source.|
|Base DN for groups||The base distinguished name for groups.|
|Primary Server URL||The primary domain controller LDAP server for the domain.
Use the format
A certificate that establishes trust for the LDAPS endpoint of the Active Directory server is required when you use
|Secondary server URL||The address of a secondary domain controller LDAP server that is used for failover.|
|Choose certificate||To use LDAPS with your Active Directory LDAP server or OpenLDAP server
identity source, click the Choose certificate button that appears after
|Username||The ID of a user in the domain who has a minimum of read-only access to the base DN for users and groups.|
|Password||The password of the user who is specified by Username.|
For more information about SSO identity sources, see the VMware documentation.
Set up a new Active Directory on a private cloud
You can set up a new Active Directory domain on your private cloud and use it as an identity source for SSO. The Active Directory domain can be a part of an existing Active Directory forest, or it can be set up as an independent forest.
New Active Directory forest and domain
To set up a new Active Directory forest and domain, you need:
- One or more VMs running Microsoft Windows Server to use as domain controllers for the new Active Directory forest and domain.
- One or more VMs running DNS service for name resolution.
For detailed steps, see Install a New Windows Server 2012 Active Directory Forest.
For high availability of services, Google recommends that you set up multiple domain controllers and DNS servers.
After setting up the Active Directory forest and domain, you can add an identity source on vCenter for your new Active Directory.
New Active Directory domain in an existing Active Directory forest
To set up a new Active Directory domain in an existing Active Directory forest you need:
- A site-to-site VPN connection to your Active Directory forest location.
- A DNS server to resolve the name of your existing Active Directory forest.
For more information, see Installing a New Windows Server 2012 Active Directory Child or Tree Domain.
After setting up the Active Directory domain, you can add an identity source on vCenter for your new Active Directory.
Add an identity source on vCenter
- Elevate privileges on your private cloud,
- Sign in to the vCenter for your private cloud.
- Select Home > Administration.
- Select Single Sign On > Configuration.
- Open the Identity Sources tab and click +Add to add a new identity source.
- Select Active Directory as an LDAP Server, and click Next.
- Specify the identity source parameters for your environment, and click Next.
- Review the settings, and click Finish.