Configuring authentication using Active Directory

You can configure vCenter and NSX-T in Google Cloud VMware Engine to use your on-premises Active Directory as an LDAP or LDAPS identity source for user authentication. Once setup is complete, you can provide access to vCenter and NSX-T Manager and assign required roles for managing your private cloud.

Caution: Joining your private cloud vCenter to an Active Directory domain is unsupported and unnecessary. Your private cloud vCenter server only supports the Active Directory over LDAP identity source type, which doesn't require joining your vCenter to an Active Directory domain. Avoid the Active Directory (Windows Integrated Authentication) identity source type.

Before you begin

The steps in this document assume that you first do the following:

• Establish connectivity from your on-premises network to your private cloud
• Enable DNS name resolution of your on-premises Active Directory:
  • For Legacy VMware Engine Networks: Enable DNS name resolution of your on-premises Active Directory by creating DNS forwarding rules in your private cloud.
  • For Standard VMware Engine Networks: Enable DNS name resolution of your on-premises Active Directory by configuring DNS bindings to your VMware Engine network.

The following table lists the information you need when setting up your on-premises Active Directory domain as an SSO identity source on vCenter and NSX-T. Gather the following information before setting up SSO identity sources:

Information	Description
Base DN for users	The base distinguished name for users.
Domain name	The FQDN of the domain, for example, example.com. Don't provide an IP address in this field.
Domain alias	The domain NetBIOS name. If you use SSPI authentication, add the NetBIOS name of the Active Directory domain as an alias of the identity source.
Base DN for groups	The base distinguished name for groups.
Primary server URL	The primary domain controller LDAP server for the domain. Use the format ldap://hostname:port or ldaps://hostname:port. The port is typically 389 for LDAP connections and 636 for LDAPS connections. For Active Directory multi-domain controller deployments, the port is typically 3268 for LDAP and 3269 for LDAPS. A certificate that establishes trust for the LDAPS endpoint of the Active Directory server is required when you use ldaps:// in the primary or secondary LDAP URL.
Secondary server URL	The address of a secondary domain controller LDAP server that is used for failover.
Choose certificate	To use LDAPS with your Active Directory LDAP server or OpenLDAP server identity source, click the Choose certificate button that appears after you type ldaps:// in the URL field. A secondary server URL isn't required.
Username	The ID of a user in the domain who has a minimum of read-only access to the base DN for users and groups.
Password	The password of the user who is specified by Username.

Add an identity source on vCenter

1. Elevate privileges on your private cloud.
2. Sign in to the vCenter for your private cloud.
3. Select Home > Administration.
4. Select Single Sign On > Configuration.
5. Open the Identity Sources tab and click +Add to add a new identity source.
6. Select Active Directory as an LDAP Server, and click Next.
7. Specify the identity source parameters for your environment, and click Next.
8. Review the settings, and click Finish.

Add an identity source on NSX-T

1. Sign in to NSX-T Manager in your private cloud.
2. Go to System > Settings > Users and Roles > LDAP.
3. Click Add identity source.
4. In the Name field, enter a display name for the identity source.
5. Specify the Domain Name and Base DN of your identity source.
6. In the Type column, select Active Directory over LDAP.
7. In the LDAP Servers column, click Set .
8. In the Set LDAP Server window, click Add LDAP Server.
9. Specify the LDAP server parameters and click Check status to verify the connection from NSX-T manager to your LDAP server.
10. Click Add to add the LDAP server.
11. Click Apply and then click Save.

Ports required for using on-premises Active Directory as an identity source

The ports listed in the following table are required to configure your on-premises Active Directory as an identity source on the private cloud vCenter.

Port	Source	Destination	Purpose
53 (UDP)	Private cloud DNS servers	On-premises DNS servers	Required for forwarding DNS lookup of on-premises Active Directory domain names from a private cloud vCenter server to an on-premises DNS server.
389 (TCP/UDP)	Private cloud management network	On-premises Active Directory domain controllers	Required for LDAP communication from a private cloud vCenter server to Active Directory domain controllers for user authentication.
636 (TCP)	Private cloud management network	On-premises Active Directory domain controllers	Required for secure LDAP (LDAPS) communication from a private cloud vCenter server to Active Directory domain controllers for user authentication.
3268 (TCP)	Private cloud management network	On-premises Active Directory global catalog servers	Required for LDAP communication in multi-domain controller deployments.
3269 (TCP)	Private cloud management network	On-premises Active Directory global catalog servers	Required for LDAPS communication in multi-domain controller deployments.
8000 (TCP)	Private cloud management network	On-premises network	Required for vMotion of virtual machines from the private cloud network to the on-premises network.

What's next

For more information about SSO identity sources, see the following vSphere and NSX-T Data Center documentation:

• Add or Edit a vCenter Single Sign-On Identity Source.
• LDAP Identity Source.