6.0.2

Authenticating to the vCenter Server Environment
In vCenter Server versions 5.1 and later, users authenticate through vCenter Single Sign-On.
In vCenter Server versions earlier than vCenter Server 5.1, when a user connects to vCenter Server,
vCenter Server authenticates the user by validating the user against an Active Directory domain or the list of
local operating system users.
The user administrator@your_domain_name has vCenter Single Sign-On administrator privileges by default.
When logged in to the vCenter Single Sign-On server from the vSphere Web Client, the
administrator@your_domain_name user can assign vCenter Single Sign-On administrator privileges to other
users. These users might be dierent from the users that administer vCenter Server.
Users can log in to vCenter Server with the vSphere Web Client. Users authenticate to vCenter Single Sign-
On. Users can view all the vCenter Server instances that the user has permissions on. After users connect to
vCenter Server, no further authentication is required. The actions users can perform on objects depend on
the user's vCenter Server permissions on those objects.
For more information about vCenter Single Sign-On, see vSphere Security.
Identity Sources for vCenter Server with vCenter Single Sign-On
You can use identity sources to aach one or more domains to vCenter Single Sign-On. A domain is a
repository for users and groups that the vCenter Single Sign-On server can use for user authentication.
An identity source is a collection of user and group data. The user and group data is stored in Active
Directory, OpenLDAP, or locally to the operating system of the machine where vCenter Single Sign-On is
installed.
After installation, every instance of vCenter Single Sign-On has the identity source your_domain_name, for
example vsphere.local. This identity source is internal to vCenter Single Sign-On. A vCenter Single Sign-On
administrator can add identity sources, set the default identity source, and create users and groups in the
vsphere.local identity source.
Types of Identity Sources
vCenter Server versions earlier than version 5.1 supported Active Directory and local operating system users
as user repositories. As a result, local operating system users could always authenticate to the
vCenter Server system. vCenter Server version 5.1 and version 5.5 uses vCenter Single Sign-On for
authentication. See the vSphere 5.1 documentation for a list of supported identity sources with vCenter
Single Sign-On 5.1. vCenter Single Sign-On 5.5 supports the following types of user repositories as identity
sources, but supports only one default identity source.
n
Active Directory versions 2003 and later. Shown as Active Directory (Integrated Windows
Authentication) in the vSphere Web Client. vCenter Single Sign-On allows you to specify a single
Active Directory domain as an identity source. The domain can have child domains or be a forest root
domain. VMware KB article 2064250 discusses Microsoft Active Directory Trusts supported with
vCenter Single Sign-On.
n
Active Directory over LDAP. vCenter Single Sign-On supports multiple Active Directory over LDAP
identity sources. This identity source type is included for compatibility with the vCenter Single Sign-On
service included with vSphere 5.1. Shown as Active Directory as an LDAP Server in the vSphere Web
Client.
n
OpenLDAP versions 2.4 and later. vCenter Single Sign-On supports multiple OpenLDAP identity
sources. Shown as OpenLDAP in the vSphere Web Client.
vSphere Upgrade
120 VMware, Inc.