6.0.2

Table Of Contents
n
Local operating system users. Local operating system users are local to the operating system where the
vCenter Single Sign-On server is running. The local operating system identity source exists only in basic
vCenter Single Sign-On server deployments and is not available in deployments with multiple vCenter
Single Sign-On instances. Only one local operating system identity source is allowed. Shown as localos
in the vSphere Web Client.
N Do not use local operating system users if the Platform Services Controller is on a dierent
machine than the vCenter Server system. Using local operating system users might make sense in an
embedded deployment but is not recommended.
n
vCenter Single Sign-On system users. Exactly one system identity source named vsphere.local is created
when you install vCenter Single Sign-On. Shown as vsphere.local in the vSphere Web Client.
N At any time, only one default domain exists. If a user from a non-default domain logs in, that user
must add the domain name (DOMAIN\user) to authenticate successfully.
vCenter Single Sign-On identity sources are managed by vCenter Single Sign-On administrator users.
You can add identity sources to a vCenter Single Sign-On server instance. Remote identity sources are
limited to Active Directory and OpenLDAP server implementations.
For more information about vCenter Single Sign-On, see vSphere Security.
Restore ESXi Certificate and Key Files
When you replace a certicate on an ESXi host by using the vSphere Web Services SDK, the previous
certicate and key are appended to a .bak le. You can restore previous certicates by moving the
information in the .bak le to the current certicate and key les.
The host certicate and key are located in /etc/vmware/ssl/rui.crt and /etc/vmware/ssl/rui.key. When
you replace a host certicate and key by using the vSphere Web Services SDK vim.CertificateManager
managed object, the previous key and certicate are appended to the le /etc/vmware/ssl/rui.bak.
N If you replace the certicate by using HTTP PUT, vifs, or from the ESXi Shell, the existing certicates
are not appended to the .bak le.
Procedure
1 On the ESXi host, locate the le /etc/vmware/ssl/rui.bak.
The le has the following format.
#
# Host private key and certificate backup from 2014-06-20 08:02:49.961
#
-----BEGIN PRIVATE KEY-----
previous key
-----END PRIVATE KEY-----
-----BEGIN CERTIFICATE-----
previous cert
-----END CERTIFICATE-----
2 Copy the text starting with -----BEGIN PRIVATE KEY----- and ending with -----END PRIVATE KEY-----
into the /etc/vmware/ssl/rui.key le.
Include -----BEGIN PRIVATE KEY----- and -----END PRIVATE KEY-----.
Chapter 6 After Upgrading vCenter Server
VMware, Inc. 121