Remove RC4 encryption in VMware Identity Manager (vIDM)

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• The VMware Identity Manager (vIDM) supports RC4 encryption.
• The usage is dependent on each environment based on the configuration of the Active Directory Domain Controller (DC).
• If RC4 is disabled at the domain level, the VMware Identity Manager will not use it, even if it's listed in the krb5.conf file in the VMware Identity Manager.

Environment

VMware Identity Manager 3.3.7

Cause

RC4 is an outdated and insecure encryption.

Resolution

Disabling RC4 encryption in VMware Identity Manager:

1. Take a snapshot for all vIDM nodes
2. Follow the steps below for all the nodes  
3. Edit the krb5.conf file
   • If Kerberos is configured

     1. vi /etc/krb5.conf

     2. Find the following lines:
        

         default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC
         default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC
         preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC

     3. Update the lines, deleting references to RC4

        default_tgs_enctypes = AES256-CTS AES128-CTS
        default_tkt_enctypes = AES256-CTS AES128-CTS
        preferred_enctypes = AES256-CTS AES128-CTS

     4. Save the changes
     5. Restart the sssd service:
        

        systemctl restart sssd

     6. Restart the krb5kdc service:
        

        systemctl restart krb5kdc

   • If Kerberos is NOT configured, skip to step
     
     

     1. vi /opt/vmware/horizon/workspace/webapps/hc/WEB-INF/classes/krb5.conf

     2. Find the following lines:
        

         default_tgs_enctypes = AES RC4-HMAC
         default_tkt_enctypes = AES RC4-HMAC
         preferred_enctypes = AES RC4-HMAC

     3. Update the lines, deleting references to RC4

        default_tgs_enctypes = AES
        default_tkt_enctypes = AES
        preferred_enctypes = AES

     4. Save the changes
4. Before removing all snapshots, ensure that all functionalities are working as expected.

Additional Information

For information about configuring Kerberos, see the link Configure Kerberos Authentication for Desktops with Integrated Windows Authentication.

Disabling the legacy RC4 cipher on your Windows Active Directory (AD) servers will not require any subsequent configuration changes within the VMware Identity Manager (vIDM) or vCenter Server appliances. Because these appliances support modern cryptographic standards, they will seamlessly renegotiate the connection with AD during the handshake process and automatically switch to a supported, highly secure alternative protocol (such as AES-128 or AES-256 for Kerberos authentication).