VMware Identity Manager 3.3.7 using RC4 encryption

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

• The VMware Identity Manager (vIDM) supports RC4 encryption.
• The usage is dependent on each environment based on the configuration of the Active Directory Domain Controller (DC).
• If RC4 is disabled at the domain level, the VMware Identity Manager will not use it, even if it's listed in the krb5.conf file in the VMware Identity Manager.

Environment

VMware Identity Manager 3.3.7

Cause

RC4 is an outdated and insecure encryption.

Resolution

Disabling RC4 encryption in VMware Identity Manager:

1. Take a snapshot for all vIDM nodes
2. Follow the steps below for all the nodes  
3. Edit the krb5.conf file
   1. If Kerberos is configured
      vi /etc/krb5.conf
   2. If Kerberos is NOT configured
      vi ./opt/vmware/horizon/workspace/webapps/hc/WEB-INF/classes/krb5.conf
      
      
4. Change the lines as
   

    default_tgs_enctypes = AES256-CTS AES128-CTS 
    default_tkt_enctypes = AES256-CTS AES128-CTS 
    preferred_enctypes = AES256-CTS AES128-CTS 

   
   
    to 
   

   default_tgs_enctypes = AES256-CTS AES128-CTS RC4-HMAC
   default_tkt_enctypes = AES256-CTS AES128-CTS RC4-HMAC
   preferred_enctypes = AES256-CTS AES128-CTS RC4-HMAC

   
   
   
5. Save the changes
6. Restart the sssd service:
   systemctl restart sssd
   
   
7. Restart the krb5kdc service:
   systemctl restart krb5kdc


8. Before removing all snapshots, ensure that all functionalities are working as expected.

Additional Information

For information about configuring Kerberos, see the link Configure Kerberos Authentication for Desktops with Integrated Windows Authentication.

Disabling the legacy RC4 cipher on your Windows Active Directory (AD) servers will not require any subsequent configuration changes within the VMware Identity Manager (vIDM) or vCenter Server appliances. Because these appliances support modern cryptographic standards, they will seamlessly renegotiate the connection with AD during the handshake process and automatically switch to a supported, highly secure alternative protocol (such as AES-128 or AES-256 for Kerberos authentication).