Launching soon: The world's first vendor agnostic bug scrubLearn more & join waitlist
OPERATIONAL DEFECT DATABASE
...
...
This article provides answers to frequently answered questions about vCenter Single Sign-On 5.1 (SSO). For frequently asked question on vCenter Single Sign-On 5.5, see vCenter Single Sign-On 5.5 FAQs (2057799).Notes: For more information, see the vSphere 5.1 documentation. The documentation contains definitive information. If there is a discrepancy between the documentation and this article, assume that the documentation is correct. For more information about troubleshooting vCenter Single Sign-On issues, see Troubleshooting Single Sign On (SSO) issues in vCenter Server 5.1 (2033137).
This article answers questions in these subject areas:General questions SSO database questionsSSO application questionsGeneral questionsWhat is vCenter Single Sign-On (SSO)?vCenter Single Sign-On (SSO) is a component of the VMware Cloud Suite. SSO deals with identity management for administrators and applications that interact with the vSphere platform.SSO is based on identity management technology built by RSA and specifically tailored for VMware Cloud Infrastructure deployment.What are the key capabilities of SSO?SSO can add multiple AD domains, OpenLDAP, and the local operating system where SSO is deployed. It also lets you create local users and groups. SSO now allows VMware vSphere to connect to a non-AD Identity Source, OpenLDAP. SSO supports the SAML 2.0 standard and WS-TRUST, both of which are open industry standards. SSO lets users delegate tasks to solutions that can run as the identity of the user. SSO supports identity delegation for long-lived tasks with the ability to renew tokens.Is SSO a replacement for my Active Directory or LDAP setup and management?No. SSO only federates authentication and principal data queries to your Active Directory or LDAP instances. It does not allow for managing your AD or LDAP data.Do I need an Active Directory or LDAP setup to use SSO?No. SSO has its own internal user store. You can manage all principal data in it, using the SSO admin interface in the vSphere Web Client. You can also assign vCenter Server privileges to users and groups from this internal datastore. Alternatively, you can also point SSO to users residing in the OS where you deployed SSO.Does SSO replace VMware's Horizon Identity Manager?No. Horizon is aimed at providing identity management in layer-3 of the VMware product suite.How does SSO work?SSO is an authentication service that implements the brokered authentication architectural pattern.The SSO server provides an authentication interface called Security Token Service (STS).Clients send WS-Trust authentication messages to the STS, which checks the user's credential against one of the attached identity sources. Upon successful authentication, STS generates a SAML 2.0 token.There are two points of exposure: The SSO Server and the vCenter Server. The vCenter Server uses the token to perform operations on behalf of the primary user. From the client's perspective, the vCenter Server stands between the client and any vSphere services that the client can use through the vCenter Server.How is SSO secured?SSO is administered by a default administrative account admin@System-Domain. The password is set during installation and is encrypted using SSHA-256 (Salted SHA-256).How is SSO Licensed?SSO is an integral part of vCenter Server and is not a licensable feature. It is available with all licensable versions of vCenter Server.SSO is not available with the freely downloadable version of vSphere.What versions of vCenter Server does SSO work with?SSO works with vCenter Server 5.1.Do existing vSphere applications (such as Site Recovery Manager and vRealize Operations, formerly known as vCenter Operations) work with SSO?SSO exposes a new authentication API. However, the old API continues to exist for applications that are already integrated with vCenter Server. All existing applications that have not yet migrated to the SSO APIs will continue to work with vCenter Server 5.1, just as they work with vCenter Server 5.0.How is SSO packaged?SSO is available as a Windows installable package. SSO is also embedded within the vCenter Server Appliance.What is the upgrade process for vCenter Server with SSO in the mix?vCenter Server 5.1 needs SSO to run. Upgrades of vCenter Server to version 5.1 include the mandatory SSO installation step, followed by upgrading the Inventory Service and vCenter Server and pointing it to the installed SSO instance.What are the compatibility requirements for SSO?The compatibility requirements for SSO are the same as those for vCenter Server.What is the memory and HDD consumption of the SSO server itself?400 MB RAM on average, and up to 1 GB RAM 200 MB HDD without the logs Up to 5 GB HDD for the logs (for the long run) What is the deployment model for SSO?For more information, see the vCenter Single Sign-On Deployment Modes section in the vSphere Installation and Setup Guide.What is the deployment model for vCenter Server with SSO?For more information, see the How vCenter Single Sign-On Affects vCenter Server Installation and Upgrades section of the vSphere Upgrade Guide.Why would I install SSO on a separate machine from vCenter Server?If SSO is on the same machine as one of your vCenter Servers, and the machine goes down, you will lose not only that vCenter Server, but also the ability to log in to all your other vCenter Servers.Why would I install SSO on the same machine as vCenter Server?vCenter and SSO on the same machine is the default configuration, if you have only one vCenter Server instance.How many vCenter Servers can an SSO instance serve?SSO poses no restriction on the number of vCenter Servers registered to it.What happens when the SSO server is down?When SSO is down, any operation that requires authentication or session validation cannot function. This implies some vCenter Server capabilities will not be available. It also implies users cannot connect to vCenter Server or the Web Client. The hypervisor layer continues to work as usual and your workloads continue to run.Is SSO available in High Availability mode?For more information, see the vCenter Single Sign-On Deployment Modes section in the vSphere Installation and Setup Guide.How does SSO back up and restore data?SSO stores data in a database similar to vCenter Server. The sensitive database data is encrypted with an encryption key, which should be backed up after installation.Can SSO be used with vCenter Server Heartbeat?Yes. vCenter Server Heartbeat can be also used to protect SSO.How does SSO integrate with the vSphere Client?SSO does not integrate with the vSphere Client. However, when you log in through the vSphere Client, vCenter Server sends the authentication request to SSO.How does SSO integrate with the vSphere Web Client?SSO is very closely integrated with the vSphere Web Client. Administrators must authenticate to SSO as part of the Web Client login process.The SSO configuration and management UI is integrated into the vSphere Web Client.Can I disable SSO and revert to the old method of authentication in vCenter Server?No.Is there a published API associated with SSO?Yes. A client can use the vCenter Single Sign-On API to obtain a SAML token. The client can then use that token to establish a vCenter Server session. The SSO Server presents a WSDL-based API that supports a subset of the WS-TRUST and WS-SECURITY standards. For more information, see the vCenter Single Sign-On Programming Guide.Is there an SSO SDK that I can reference?Yes. The SDK can be downloaded from Customer Connect.#SSO database questionsCan I use Windows Authentication for the MSSQL database user name and password, as the JDBC Setup screen implies?No. For MSSQL databases, you must use SQL Server Authentication database users. Windows Authentication users are not supported. For more information, see Connection to the MSSQL database fails during vCenter Single Sign-On installation section of the VMware vSphere 5.1 Release Notes.What SQL access rights does the database user require?The database user you specify during installation must have the DBA privilege. However, you can grant the DBA privilege just before you encounter this screen in the installer and revoke the privilege after installation is complete. For more information about required database users and permissions, see Required Information for Installing or Upgrading vCenter Single Sign-On, Inventory Service, and vCenter Server section in the vSphere Installation Guide.Is the database user that I specify during installation a separate user from the RSA_USER and RSA_DBA (the database users that are created during SSO installation)?Yes. The database user you specify during installation is used to create the users RSA_USER and RSA_DBA. For more information, see the Required vCenter Single Sign-On Database Users section of the vSphere Installation and Setup Guide.Do RSA_USER and RSA_DBA need to be SQL users?Yes.When the installer creates RSA_USER and RSA_DBA, it assigns a password that does not meet my organization's password complexity requirements. Can I change the password for these automatically created users?You cannot change the password for RSA_DBA during install, but you have the option to manually specify created users rather than allowing the installer to create these users for you. Manually create RSA_USER and RSA_DBA before you begin the installation process and assign a password that meets your requirements. Enter the names and passwords of the users when you run the installer. VMware provides optional scripts that you can run to create the required database users. For more information, see the Required vCenter Single Sign-On Database Users section of the vSphere Installation and Setup Guide. You can reset the password for RSA_USER. For more information, see Updating the vCenter Single Sign On server database configuration (2045528).Note: The user RSA_DBA is only utilized during the installation of vCenter Single Sign-On. Modifying the password for RSA_DBA after installation should have no impact.Why are the RSA_DBA and RSA_USER users required, and what SQL access rights do they require?RSA_DBA is used for creating the schema (DDL) and requires DBO permissions. RSA_USER reads and writes data (only DML). For a list of the required access rights, see the Required vCenter Single Sign-On Database Users section of the vSphere Installation and Setup Guide. The accounts are required and the best practice is to use the default listed names: RSA_USER and RSA_DBA.What information is stored in the SSO Database?The SSO database stores system users and groups, SSO configuration information, and connection details for the attached identity sources, including domain accounts.Why does the SSO administration interface in the vSphere Web Client display information about locked and disabled domain accounts?The SSO administration interface provides a single view of all attached identity sources, including Active Directory domain accounts. The SSO administrator does not need to open the Active Directory management interface to view information about locked or disabled domain accounts.#SSO application questionsCan I change the SSO administrator user name from admin@System-Domain to another user name?The admin@System-Domain user name cannot be changed. It is similar to the Administrator user name on a Windows system. You can disable admin@System-Domain after you grant SSO administrator privileges to another user. The user is only necessary when you perform HA/multisite setup or recovery.Can I change a forgotten password for the admin@System-Domain user?Yes, if you remember your master password (i.e. the password with which you installed SSO) : rsautil reset-admin-password --master-pwd masterpass --admin-name admin --admin-pwd your-new-passwordIf you have forgotten the admin@System-Domain password, do not have the master password and have no other administrative account it is not possible to reset the admin@System-Domain password.When configuring vCenter Server with an external SSO, which user should I specify for Account with right to register vCenter with the SSO server?Specify a user with SSO administrative privileges. If your SSO runs on the vCenter Server Appliance (VCSA), this is the root user of the operating system encapsulating the appliance. If your SSO runs on Windows, this user is admin@System-Domain with the password you picked during installation.What Single Sign-On deployment modes are possible with the vCenter Server Appliance?Only basic mode is supported with the vCenter Server Appliance at this time. Windows SSO is currently required to deploy in HA or multisite modes.Which user should I specify for Account that will be assigned as vCenter administrator?You can specify any user, but VMware recommends picking the operating system administrator ("root", "Administrators") or the administrators group ("root", "Administrators").During the installation process, the installer appears to initiate a scan of the Active Directory domains to automatically add them as identity sources. Can I disable this functionality?The installer does not scan Active Directory domains. It only verifies that it can connect to the Active Directory identity source and configure connection data.During the installation process, I get the error, Identity source discovery error. Is this related to the installer's scan of the Active Directory domains in my environment?No. This error is usually due to an incorrect configuration of the environment.How many vCenter Single Sign-On servers can be part of a High Availability SSO cluster?There is no limit to the number of SSO systems you can add to a High Availability SSO cluster.Is a multisite configuration made up of multiple instances of High Availability SSO clusters in separate physical sites?Yes.Do the clusters of a multisite configuration share one common global database, or is a database aligned to each cluster?A database is aligned to each cluster.Do clusters in a multisite configuration have any form of federation?You can run manual replication scripts to synchronize the data across a multisite configuration. For more information, see the Manually Replicate Data in a Multisite vCenter Single Sign-On Deployment section of the vSphere Security Guide.When we configure an Active Directory identity source, we are required to use the Password Authentication type because Active Directory is locked down in our organization. What rights does this user require?The user you specify when you choose Password Authentication requires read-only access to Base DN for users and groups.vCenter Single Sign-On seems to use auto-generated certificates. Can we replace these certificates with internally generated certificates?Yes. For more information, see Replacing Default vCenter 5.1 and ESXi Certificates on the Technical Resources page at www.vmware.com.Can we mix components from the vCenter Server Appliance and Windows stack? For example, could a Windows-based vCenter Server installation use SSO services provided by an SSO instance on a vCenter Server Appliance?Yes. You can point vCenter Server Appliance and Windows-based vCenter Server installations to SSO instances installed on either platform.How can I separate vCenter components such as SSO, vCenter Server, and the vSphere Web Client to comply with placement strategies for optimal failover and availability?For more information, see vSphere Installation and Setup.
Troubleshooting Single Sign On (SSO) issues in vCenter Server 5.1Updating the vCenter Single Sign-On server database configurationVMware vCenter Single Sign-On Server 5.5 FAQsvCenter Single Sign-On 5.1 常见问题解答vCenter Single Sign-On 5.1 の FAQ