Deprecation of Integrated Windows Authentication

Products

• VMware vSphere ESXi

Issue/Introduction

This article provides information on the deprecation of the Integrated Windows Authentication (IWA) in a future release of vSphere.

Environment

VMware vSphere 7.0.x

Resolution

Starting with vSphere 7.0, Federated Identity is supported for all authentication use cases with AD FS. While Active Directory will still be supported for authentication, it is recommended to use AD over LDAP or Identity Federation with AD FS for authentication for vCenter Server and ESXi. As such, if IWA fails to authenticate, configure the identity source as AD over LDAP.

What does Deprecation of IWA mean for 7.0?
Support for IWA continues to be available in vSphere 7.0 or later and will be phased out in a future release. Although IWA can still be configured, we highly recommend using AD over LDAP or Federated Identity (AD FS).

* Active Directory over LDAP and OpenLDAP Server Identity Source Settings https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.authentication.doc/GUID-98B36135-CDC1-435C-8F27-5E0D0187FF7E.html

"The Active Directory over LDAP identity source is preferred over the Active Directory (Integrated Windows Authentication) option."

When will support be removed?
Support for IWA will be removed in a future release of vSphere.

What will happen when I upgrade my vCenter?
Migrating to vSphere 7.0 or later will retain IWA settings with no change in authentication functionality.

Additional Information

• VMware vSphere & Microsoft LDAP Channel Binding & Signing (ADV190023)
  https://blogs.vmware.com/vsphere/2020/01/microsoft-ldap-vsphere-channel-binding-signing-adv190023.html
  
  IWA uses unsigned LDAP behind the scenes to allow searching users and groups, and this will stop working. This may impact the ability to add users & groups to authentication configurations.
  
  Who Is Affected?
  
  If you have configured vCenter Server to access Active Directory over LDAP with TLS (LDAPS) or Identity Federation you will not be affected by this. You can check this by viewing your Identity Sources in the vSphere Client
  
  
• Considerations when migrating a vCenter Identity Source from Integrated Windows Authentication to AD over LDAP / OpenLDAP https://knowledge.broadcom.com/external/article?legacyId=90124
  
  
• Configuring a vCenter Single Sign-On Identity Source using LDAP with SSL (LDAPS) https://knowledge.broadcom.com/external/article?legacyId=2041378