5.5.1

For example, to run a workflow that uses a virtual machine through the Orchestrator REST API, you access
resources both in Orchestrator and in vCenter Server. To authenticate against Orchestrator and
vCenter Server, you must pass your principal holder-of-key token in the Authorization header of the
request that you make, and the delegate token in the VCOAuthorization header. In this way, you authenticate
against Orchestrator with your principal token and Orchestrator authenticates on your behalf against
vCenter Server with the delegate token.
The vCenter Single Sign-On Server treats Orchestrator as a solution, and every solution is registered with a
unique user name with the vCenter Single Sign-On Server. You request a delegate token for Orchestrator by
passing the solution user name of Orchestrator and a principal holder-of-key token to the vCenter Single
Sign-On Server. The token that the vCenter Single Sign-On Server issues is a delegate holder-of-key token
for Orchestrator to authenticate on your behalf against third-party systems.
Example: Obtain a Session in vCenter Single Sign-On Mode
The following example code obtains a session in vCenter Single Sign-On mode.
URI uri = URI.create("https://vco-server:8283/vco/api");
VcoSessionFactory sessionFactory = new DefaultVcoSessionFactory(uri);
//provide the address of the vCenter Single Sign-On server
URI ssoUri = URI.create("https://sso-server:7444/ims/STSService?wsdl");
//set the tokens to be valid for an hour
long lifeTimeSeconds = 60 * 60;
//create a factory for vCenter Single Sign-On tokens
SsoAuthenticator sso = new SsoAuthenticator(ssoUri, sessionFactory, lifeTimeSeconds);
//provide vCenter Single Sign-On credentials
SsoAuthentication authentication = sso.createSsoAuthentication("username", "password");
VcoSession session = sessionFactory.newSession(authentication);
//use session here
Get the Solution User Name of Orchestrator
The vCenter Single Sign-On Server treats Orchestrator as a solution, and every solution is registered with a
unique user name with the vCenter Single Sign-On Server. To be able to request a delegate holder-of-key
token for Orchestrator from the vCenter Single Sign-On Server, you need the solution user name of
Orchestrator.
Prerequisites
Verify that you have a valid principal holder-of-key token that the vCenter Single Sign-On Server issued.
Procedure
1 Make a GET request at the URL of the solution user name of Orchestrator:
GET https://{vcoHost}:{port}/vco/api/users/
2 Provide your principal holder-of-key token in the Authorization header of the request.
The <user solution-user="vCOSolutionUserName"/> element of the response contains the solution user
name of Orchestrator. The following is an example of a solution user name of Orchestrator.
<user xmlns="http://www.vmware.com/vco" solution-user="vCO-133acc26ff78e5695b102146326" admin-
rights="true"/>
Chapter 2 Using the vCenter Orchestrator REST API
VMware, Inc. 13