Adding a vCenter server Single Sign-On Active Directory Identity Source Using LDAPS with an External LDAP Load Balancer

Products

• VMware vCenter Server

Issue/Introduction

• Cannot add a vCenter Single Sign On (SSO) Active Directory Identity Source using LDAPS using an external load balancer for ldaps

Environment

VMware vCenter Server

Cause

This issue arises when the Active Directory Domain Controllers are configured behind an external load balancer for LDAPS connections.

When vCenter attempts to connect to ldaps://ldap.example.com:636, the load balancer redirects the traffic to one of the servers in the pool.

Additionally, a certificate that establishes trust for the LDAPS endpoint of the Active Directory server is required when using ldaps:// in either the primary or secondary LDAP URL.

Resolution

To resolve this issue:

1. Export the LDAP server certificates for all domain controllers behind the load balancer using OpenSSL command
2. Identify the list of domain controllers under the load balancer for LDAPS.
3. Connect to the vCenter Server Appliance with SSH and login as root.

4. Run the following command to show the LDAP certificate
       openssl s_client -connect dc1.domain.com:636 -showcerts

   1. When the openssl connect command completes, the full contents of the SSL certificate are displayed. The certificate chain appears similar to:
      
      Certificate chain
      0 s:/CN=DC3.example.com
      i:/DC=com/DC=example/CN=cn
      -----BEGIN CERTIFICATE-----
      MIIFyjCCBLKgAwIBAgIKYURFHAAAAAAABDANBgkqhkiG9w0BAQUFADBCMRMwEQYK
      ..........
      ...snip...
      ..........
      TmqX6OuznopBJKNW5Z5LbHzuUCfY8ryBhYZhHKsf9CmZa12j/ODfznFtAgbPNw==
      -----END CERTIFICATE-----
      1 s:/DC=com/DC=example/CN=cn
      i:/CN=BRM-ROOT-CA
      -----BEGIN CERTIFICATE-----
      MIIFkjCCBHqgAwIBAgIKYSn5HgAAAAAAAjANBgkqhkiG9w0BAQUFADAWMRQwEgYD
      ..........
      ...snip...
      ..........
      N4C2CAlLaR3sXlHBRNlfsLO+rZo45hwW8Xw3rLD+ETtgKMmAVUI=
      -----END CERTIFICATE-----
       
   2. The top most certificate in this chain is the certificate of the domain controller.
   3. Copy the complete string including -----BEGIN CERTIFICATE----- until (including) -----END CERTIFICATE----- into a text file.
   4. Remove any additional characters after -----END CERTIFICATE-----.
   5. Save that file as .cer.
   1. Example: If you have 6 domain controllers under the load balancer, repeat the command for each DC
      openssl s_client -connect dc2.domain.com:636 -showcerts
      openssl s_client -connect dc3.domain.com:636 -showcert
5. Log in to the vSphere Client using [email protected] credentials.
6. Browse to Administration > Single Sign On > Configuration in the vSphere Client.
7. Under Identity Provider > Identity Sources, select Active Directory over LDAP and then choose Edit.
8. Under Primary server URL, ldaps://ldap.example.com
   
9. For Certificates (for LDAPS), Click Browse.
10. Select the correct .cer Root CA certificate for all domain controllers.
11. Click Save.