Configure VMware vCenter Single Sign On for High Availability (HA) by installing two nodes in HA mode and putting them behind load balancing software. In HA mode, both the nodes work with the same database, use the same data, and have the same user stores.
When configured for High Availability, Single Sign On (SSO) cannot perform authentication with Windows users because it cannot leverage the local operating system users as user stores.
Important: Follow this process before installing any other services, such as the Inventory service, vCenter Server, or vSphere Web Client. Single Sign On (SSO) for High Availability (HA) must be configured first.
To set up SSO for HA:
C:\Program Files\VMware\Infrastructure\SSOServer\ssolscli
, replace ssolscli.jar
with the ssolscli.jar.gz file attached to this article.Install vCenter SSO on the machine that will become the backup node. When prompted, select these options:
On each SSO node, modify the session configuration.
SingleSignOn_install_dir\conf\server.xml
.<Engine defaultHost="localhost" name="Catalina">
<Engine defaultHost="localhost" name="Catalina" jvmRoute="routeID">
routeID
must be the same as the one that is specified in the corresponding BalancerMember
directive in the configuration file.The Load Balancer acts as a failover server. Configure the load balancing software of your choice. Because sensitive information is sent to and from SSO, the load balancing software should be configured for SSL. The requirements for load balancing software configuration include:
/groupcheck
to /sso-adminserver
to both SSO HA nodes./lookupservice
to both SSO HA nodes./ims
to both SSO HA nodes./sso-adminserver
to /sso-adminserver
on the primary node only.Notes:
mod_proxy
and mod_proxy_balancer
modules. For more information about the recommended configuration when using Apache as a load balancing software for Single Sign On, see Setting up Apache load balancing software with vCenter Single Sign On (2034157).C:\UpdateInfo\
.JAVA_HOME
variable. Using the default location in which VMware products install JRE, run:set JAVA_HOME=C:\Program Files\VMware\Infrastructure\jre
cd /d C:\Program Files\VMware\Infrastructure\SSOServer\ssolscli
ssolscli listServices https://primary_node_hostname:7444/lookupservice/sdk
urn:sso:groupcheck
urn:sso:admin
urn:sso:sts
sts.properties
, gc.properties
, and admin.properties
. The location in which you store these files is not important. For this example, save these files to C:\UpdateInfo
. Reference the output of the listServices command in Step 7-2.sts.properties
file might look similar to:[service]
friendlyName=STS for Single Sign On
version=1.0
ownerId=
type=urn:sso:sts
description=The Security Token Service of the Single Sign On server
[endpoint0]
uri=https://location_of_your_load_balancer:<configured port>
/ims/STSService?wsdl
ssl=C:\UpdateInfo\cacert.pem
protocol=wsTrust
admin.properties
file might look similar to:[service]
friendlyName=The administrative interface of the SSO server
version=1.0
ownerId=
type=urn:sso:admin
description=The Security Token Service of the Single Sign On server
[endpoint0]
uri=https://location_of_your_load_balancer:
<configured port>
/sso-adminserver/sdk
ssl=C:\UpdateInfo\cacert.pem
protocol=vmomi
gc.properties
file might look similar to:[service]
friendlyName=The group check interface of the SSO server
version=1.0
ownerId=
type=urn:sso:groupcheck
description=The group check interface of the SSO server
[endpoint0]
uri=https://location_of_your_load_balancer:
<configured port>
/groupcheck/sdk
ssl=C:\UpdateInfo\cacert.pem
protocol=vmomi
serviceId
for each of the three services. The service ID is located in serviceId
on the list of services you created earlier.sts_id
, gc_id
, admin_id
) and save them to C:\UpdateInfo
. The service ID file (sts_id
) contains only the service ID. The file must not contain any other data.admin_id
file:{D46D4BFD-CC5B-4AE7-87DC-5CD63A97B194}:1
sts_id
file:{D46D4BFD-CC5B-4AE7-87DC-5CD63A97B194}:2
gc_id
file:{D46D4BFD-CC5B-4AE7-87DC-5CD63A97B194}:3
For each of the three services, run this command:
<SingleSignOn install dir>\ssolscli\ssolscli updateService
-d Lookup_Service_URL -u sso_administrator -p sso_administrator password
-si serviceid_file -ip
service.properties
The commands must be run in this order:
Example:
ssolscli.cmd updateService -d https://sso1.example.com/lookupservice/sdk -u admin@System-Domain -p VMware123 -si sts_id -ip sts.properties
ssolscli.cmd updateService -d https://sso1.example.com/lookupservice/sdk -u admin@System-Domain -p VMware123 -si admin_id -ip admin.properties
You have now completed the Single Sign On configuration for High Availability.ssolscli.cmd updateService -d https://sso1.example.com/lookupservice/sdk -u admin@System-Domain -p VMware123 -si gc_id -ip gc.properties
During the installation of vCenter Server, vSphere Web Client, and the Inventory service, you must provide the address of the new load balanced hostname for Lookup Service. The address must be in the form https://<load balancer fqdn>:<configured<font face="Times New Roman">. port>/<configured path>
.