Support of VCF Operations orchestrator Plug-In for VCF Automation for VM Apps in Greenfield VM Apps Organization (VCF Automation 9.x)

Products

• VCF Automation

Issue/Introduction

• For the VCF Operations orchestrator Plug-In for VCF Automation for VM Apps in a Greenfield deployment, a shared session is only supported when vIDM is configured as the Identity Provider (IDP). 

• The VM Apps Org should also be marked as default login org.

Environment

• VCF Automation 9.x 
• VCF Operations Orchestrator 9.x

Cause

With VCFA 9.x (Greenfield deployment), the VCF Operations orchestrator Plug-In for VCF Automation for VM Apps supports shared sessions only when vIDM is configured as the Identity Provider (IDP). By default, shared sessions for the plug-in will not work for fresh VCFA 9.x setups unless vIDM is set as the IDP and the VM Apps organization is made the default login organization.

Resolution

To simplify the configuration, download and run the two attached scripts from a VCF Automation VM command line

Step 1: Creates an OAuth client in vIDM

1. Download the attached createOauthClient.sh
2. Copy the file to /tmp directory in VCF Automation appliance using winscp with vmware-system-user credentials
3. Login to VCF Automation appliance using user vmware-system-user credentials.
4. Change the user to root and provide the password of vmware-system-user user when asked
   

   sudo su -

5. Copy the file to any of the directory in VCF Automation. Ex: /root
6. Change the permission of the file. 
   

   chmod 777 createOauthClient.sh

7. Run the script createOauthClient.sh 
   

   ./createOauthClient.sh

8. Provide the below details. 
   1. Enter the vIDM Hostname:
   2. Enter vIDM admin password
   3. Enter oauth Client Name:
   4. Enter oauth client secret:
   5. Enter the VCFA Hostname (for cluster, enter VIP FQDN)::
9. You will see OAuth 2 client created in vIDM as shown below

 

 

Step 2: Creating a vm apps org with OIDC connection and importing a user

1. Download the attached oidc_config.sh
2. Copy the file to /root/ or any other directory apart from /tmp in VCF Automation appliance using winscp with vmware-system-user credentials
3. Login to VCF Automation appliance using user vmware-system-user credentials.
4. Change the user to root and provide the password of vmware-system-user user when asked
   

   sudo su -

5. Copy the file to any of the directory in VCF Automation. Ex: /root
6. Change the permission of the file. 
   

   chmod 777 oidc_config.sh

7. Run the script oidc_config.sh 
   

   ./oidc_config.sh

8. Provide the below details.
   
   1. Enter a comma seperated tenant list:
   2. Enter VCFA Hostname: 
   3. Enter VCFA admin password:
   4. Enter vIDM Hostname:  
   5. Enter vIDM admin password:
   6. Enter oauth client secret:
   7. Enter import user name:
9. Once you login to VCF Automation UI, you will see the information as shown below. 

Step 3: Re-deploy Application service and Login

      1. Re-deploy application services in the VCF Automation Setup via the below commands:

# Login to VCFA Setup through SSH

1. export KUBECONFIG={your .kubeconfig file}   # Eg: vmsp-#######.kubeconfig

2. Run the below command to re-deploy the application services:                                                      

   kubectl delete hr -n prelude vmsp-prelude-deployer       

 

       2. Login to VCF Automation VM Apps Org with the imported vIDM Username and Password. Login should be successful.