vCenter SSO Identity Provider (IdP) management - Edit user credentials for Active Directory (AD) over LDAP authentication
search cancel

vCenter SSO Identity Provider (IdP) management - Edit user credentials for Active Directory (AD) over LDAP authentication

book

Article ID: 448527

calendar_today

Updated On:

Products

VMware vCenter Server

Issue/Introduction

  • An AD account used as a service account for vCenter Single Sign-On (SSO) Identity Provider integration (e.g., Active Directory over LDAP) requires a password reset or replacement due to credential exposure. The administrator needs to update the service account credentials.

Environment

VMware vCenter Server 8.x

Cause

This is a administrative configuration task triggered by security requirements to rotate exposed credentials or transition to a new service account for Identity Provider authentication.

Resolution

Follow these steps to update the service account credentials. In an Enhanced Linked Mode environment, these changes only need to be performed on one vCenter Server instance, as the configuration will replicate to all other linked vCenter Servers.

 

Prerequisites

  1. Ensure that the new service account or updated password has already been configured and verified on the external Identity Provider (e.g., Active Directory).

  2. (Optional but recommended) Take a snapshot of the vCenter Server Appliance (VCSA) before making configuration changes. In ELM, it is best practice to snapshot all linked appliances while powered off, though not strictly required for this specific UI-based change.

  3. Confirm the vCenter Servers are in a healthy replication state.

 

Procedure

  1. Log in to the vSphere Client with an account that has SSO administrator privileges.

  2. Navigate to Administration > Single Sign On > Configuration.

  3. Select the Identity Provider tab.

  4. Identify the relevant Identity Source (e.g., the AD over LDAP source) and click Edit.

  5. In the Edit Identity Source window:

    • To update the existing account: Enter the new password in the Password field.

    • To switch to a new account: Update the Username field (use the format user@domain or <domain>\user) and enter the new password.

  6. Click Save or OK.

    • The vCenter will attempt to authenticate with the LDAP server using the new credentials. If authentication fails, the original settings are typically retained.

  7. Verify an AD user is able to successfully log into the vCenter. If in linked mode, verify replication completed by logging into a different linked vCenter instance with an AD account and checking the Identity Provider settings.

  8. Once it has been confirmed the change is completed without issues and AD users are able to log in, delete the snapshots from the VCSA VMs if any were created before the task.

Additional Information

  • In Enhanced Linked Mode, vCenter servers replicate their SSO configurations. Changing the IdP credentials on one node is sufficient for the entire SSO domain.
  • If the Edit option is unavailable or the UI fails to update, ensure the account used to log in has the SystemConfiguration.Administrators role.
Powered by Wolken Software