CAC integration with VCF 9 SSO Identity Broker

Products

• VMware vCenter Server

Issue/Introduction

• Integrating Common Access Card (CAC) with Identity Broker.
  
  
• On-prem solution is required.

Environment

vCenter 9.x

Cause

vCenter Native Smart Card (deprecated in 8.x) is removed in VCF 9.x.

Resolution

• Configure AD FS support for user certificate authentication.
  
  
• After installing or upgrading to VCF 9.0, to configure VCF Single Sign-On, you can configure Microsoft ADFS as an identity provider using OIDC as the authentication protocol.

Additional Information

Removal of SSPI, CAC and RSA:

vCenter 9.0 discontinues support for Windows Session Authentication (SSPI) used as part of the Enhanced Authentication Plug-in, Smart Card support, and RSA SecurID. In place of SSPI, Smart Card, or RSA SecurID, users and administrators can configure and use Identity Federation with a supported Identity Provider to sign in to their vCenter system.