VMware vRealize Log Insight supports integration with VMware Identity Manager (VIDM), which provides single sign-on for multiple identity sources, including Active Directory. It is recommended to migrate user accounts to VMware Identity Manager.
Each user account in Log Insight has a unique identity associated with their saved fields, dashboards, alerts and other saved content. If two identity providers are present and a person authenticates with both, they may have two independent sets of saved content.
This article provides steps to convert existing Log Insight users' identity source from Active Directory to VMware Identity Manager.
To convert Active Directory users to VMware Identity Manager users in vRealize Log Insight:
Note: Only lowercase users are supported for migration from AD to vIDM.
root
./opt/vmware/bin/li-convert-ad2vidm.sh
id
- This is the identifier for the Role.directory_groups
- The Active Directory groups currently assigned the Role.name
- This is the friendly name associated to the Role that you see in the UI.capabilities
- These are the capabilities for the Roles./opt/vmware/bin/li-convert-ad2vidm.sh id
/opt/vmware/bin/li-convert-ad2vidm.sh 00000000-0000-0000-0000-000000000002
For more information about VMware Identity Manager and Log Insight, see https://blogs.vmware.com/management/2017/06/vidm-log-insight.html published 2017-06-20.
Impact/Risks:
This migration solution is limited to altering 500,000 vRealize Log Insight users. For larger scale, please contact Broadcom Support.