OpenLDAP schemas supported in VMware vCenter Single Sign-On
search cancel

OpenLDAP schemas supported in VMware vCenter Single Sign-On


Article ID: 316480


Updated On:


VMware vCenter Server


This article provides information on OpenLDAP schemas supported in vCenter Single Sign-On and the derivatives of OpenLDAP and schemas that can be used with vCenter Single Sign-On when using an Open LDAP identity source. It also provides information on the requirements for certain objectClasses and attributes and the limitations.
For more information about Identity Sources in vSphere 7.0, see the Identity Sources for vCenter Server with vCenter Single Sign-On section of the vSphere Installation and Setup guide .

Earlier Versions


VMware vCenter Server Appliance 6.0.x
VMware vCenter Server 8.0.x
VMware vCenter Server 6.0.x
VMware vCenter Server 5.5.x
VMware vCenter Server Appliance 6.7.x
VMware vCenter Server Appliance 6.5.x
VMware vCenter Server 7.0.x
VMware vCenter Server Appliance 5.5.x


Currently, vCenter Single Sign-On supports the use of OpenLDAP as an identity source only if it satisfies all of these requirements:
  • The OpenLDAP schema is RFC4519 compliant.
  • All users have an objectClass of inetOrgPerson.
  • All groups have an objectClass of groupOfUniqueNames.
  • All groups have a group membership attribute of uniqueMember.
  • All users and group objects have entryUUID configured (The objects have a unique GUID and should not be changing)

    This is required for adding users or groups from OpenLDAP to any group or role apart from vSphere.local.

    Note: In vSphere 5.5a and later, entryUUID is no longer a required attribute for OpenLDAP users to authenticate. However, it still remains a requirement for users/groups to add them into vsphere.local groups. Users or objects that are deleted and recreated in the LDAP tree without preserving entryUUID may remove the users from vsphere.local groups.
If any of these requirements are missing or if the schema is non-compliant, the OpenLDAP identity source is unsupported with vCenter Single Sign-On.

Additional Information

Note: The preceding links were correct as of March 21, 2014. If you find a link is broken, provide feedback and VMware employee will update the link.

Cannot perform tasks requiring directory search after adding an OpenLDAP directory as an Identity Source in vCenter Single Sign-On
VMware vCenter Single Sign-On がサポートする OpenLDAP スキーマの要件