Single Sign-On Identity Source configuration using LDAPS in vSphere Client

Products

• VMware vCenter Server

Issue/Introduction

Configure an Identity Source in vCenter SSO using secured LDAPS. This configuration encrypts all authentication traffic between vCenter Server and the Domain Controller.

 

For instructions configuring AD/LDAP(S) as an identity provider in VCF 9.x, see Configure Active Directory as an Identity Provider Using AD/LDAP.

Environment

VMware vCenter 7.x
VMware vCenter 8.x
VMware vCenter 9.x

Resolution

Caution: This article provides a general how-to guide. Consultation with the Directory Administrators in the organization is recommended for specific procedures.

For information on configuring the LDAP server to use SSL, see the Microsoft article LDAP over SSL (LDAPS) Certificate .
The steps in this article assume that the Domain Controller in question has a valid certificate available and that this certificate has been exported. See the Microsoft article linked above for more details.

Refer to the Active Directory over LDAP and OpenLDAP Server Identity Source Settings documentation for further information relating to implementing Active Directory over LDAPs.

Table of Contents

• Step 1: Extract certificate details from the active directory domain controller
• Step 2: To configure an Identity Source in vCenter Single Sign On to use a secured LDAPS:

 

Step 1: Extract certificate details from the active directory domain controller

 

1. The vCenter Server appliance includes an openssl binary.
2. The following command gathers the entire SSL certificate chain from the desired Domain Controller to a file (replace dc.domain.com with your domain controller hostname):
   
   openssl s_client -showcerts -connect dc.domain.com:636 </dev/null 2>/dev/null | sed -n '/-----BEGIN CERTIFICATE-----/,/-----END CERTIFICATE-----/p' > dc.domain.com.cer
   
    

Step 2: To configure an Identity Source in vCenter Single Sign On to use a secured LDAPS:

1. If this is an ELM (Enhanced Linked Mode) environment, only perform the following steps on a single vCenter, as the IdP configurations replicate to the other linked vCenter servers.

2. Take the appropriate snapshot(s) of vCenter Server.
   Note: If Enhanced Linked Mode, make sure to take offline snapshots of all linked vCenter virtual machines before proceeding.

3. Log in to the vSphere Client using a Single Sign On Administrator.

4. Under Menu, select Administration > Configuration > Identity Sources.

   
   
   
5. Remove the existing Identity source.
   
   
6. Click Add and select Active Directory over LDAP to configure a new source.
   
   
   
   
7. Enter the required information in the Add Identity Source wizard (Active Directory over LDAP).
   
   • Specific LDAP URLs that should be added.
   • Click on Browse next to "Certificates (for LDAPS)" and select the certificates exported from the domain controllers specified in the LDAPs URL(s).
     Refer to LDAP over SSL (LDAPS) Certificate in the documentation for more details.
   • The hostname specified in the connection string must be listed in the Domain Controller's Subject Alternative Name (SAN), even if root certificates are provided.
     
     
8. Click on Add and the new source will be listed in the client:
   
   

Additional Information

Note:

• The "Any domain controller in the domain" option in the "Connect to" section should not be used when configuring AD over LDAPS.  This option is intended to be used with AD over LDAP where certificates for each domain controller are not necessary.

Important Information about configuring an LDAPS identity source:

1. "If an existing identity source exists with the same domain, that identity source must be removed before configuring an LDAPS identity source.
2. If updating or replacing the SSL certificate, the identity source must be removed and re-added.
3. If the "Username" used during the addition of the Identity Source becomes locked, disabled, or has an expired password, AD user logins to vCenter fail. The task must be redone, and the AD username and password should be updated.
4. Ensure the account being used to add the identity source is not in a restricted AD group, such as the Protected Users group.
5. Use the openssl command mentioned below to verify the domain connectivity. If the connection is good, it should return a certificate and if the connection is blocked by some external firewall, the command will fail or get stuck for long time.

   openssl s_client -connect Domain_Controller_IP:636