6.1

5 For machines that belong to a domain, enable and test Kerberos authentication:
a Open a command prompt and use the following commands to enable Kerberos authentication:
winrm set winrm/config/service/auth '@{Kerberos=”true”}'
winrm set winrm/config/service '@{AllowUnencrypted="true"}'
winrm set winrm/config/client/auth '@{Kerberos=”true”}'
winrm set winrm/config/client '@{AllowUnencrypted="true"}'
b Use the following command to test Kerberos authentication:
winrm id -r:machine.domain.com -auth:Kerberos -u:[e-mail] -p:'password'
6 Install View Agent in the physical machine.
What to do next
Configure authentication on the vRealize Orchestrator server. See “Configure vRealize Orchestrator to Use
Kerberos Authentication with Physical Machines,” on page 73.
Configure vRealize Orchestrator to Use Kerberos Authentication with Physical
Machines
You must edit a configuration file on your vRealize Orchestrator server to specify the domain name and
domain controller name.
Prerequisites
You must have the root password if you are using the vRealize Orchestrator virtual appliance or the
administrator credentials if vRealize Orchestrator is installed in a Windows server.
Procedure
1 Log in as root (or as an administrator if you have a Windows server).
2 Search for the krb5.conf file and rename it to krb5.conf.back.
On a virtual appliance, this file is located in etc/krb5.conf, if it exists.
3 Create a krb5.conf file in the appropriate directory.
Server Type Description
Virtual appliance
/usr/java/jre-vmware/lib/security/
Windows server
C:\Program Files\Common Files\VMware\VMware vCenter Server
- Java Components\lib\security\
4 Open the krb5.conf file with a text editor and add the following lines, with the appropriate values:
[libdefaults]
default_realm = YOURDOMAIN.COM
udp_preference_limit = 1
[realms]
YOURDOMAIN.COM = {
kdc = yourDC.yourdomain.com
default_domain = yourdomain.com
}
[domain_realms]
. yourdomain.com= YOURDOMAIN.COM
yourdomain.com= YOURDOMAIN.COM
Chapter 7 Working with Unmanaged Machines
VMware, Inc. 73