Failed to create permissions for individual users with ADLDS/ADAM configured as an LDAP Identity Source

Products

• VMware vCenter Server

Issue/Introduction

• When assigning permissions in VMware vCenter Server, only groups are added successfully. Individual users cannot be selected or resolved.
• This issue occurs when Active Directory Lightweight Directory Services (ADLDS, formerly ADAM) is configured as an LDAP Identity Source in vCenter Server.
• Although LDAP connection is successful, groups are bound successfully, and group searches succeed, user object resolution fails.
• Running the below ldapsearch  command returns "objectClass: userProxy":
  

  ldapsearch -x -H ldap://<ldap-server> -D "cn=vcenter-bind,ou=services,dc=<example>,dc=com" -W -b "ou=users,dc=<example>,dc=com" "(uid=<username>)" objectClass 

Environment

VMware vCenter Server

Cause

VMware vCenter Server does not support non-native Active Directory controllers or directory proxies using "userProxy" object classes. The Active Directory over LDAP identity source configuration requires a native Active Directory Domain Controller or supported schema attributes

 

Resolution

To resolve this issue, ensure that your directory environment meets vCenter Server identity source requirements:

1. Point the Active Directory over LDAP identity source to a native Active Directory Domain Controller rather than a third-party directory proxy.
2. Ensure user objects in the directory schema are implemented with an `objectClass` of `inetOrgPerson'.

 

Additional Information

OpenLDAP schemas supported in VMware vCenter Single Sign-On

Using identity source in vCenter with the “Active Directory over LDAP” with Radiant Logic schema is unsupported and leads to directory query failures.