6.0.3

Understanding vCenter Single Sign-On
To eectively manage vCenter Single Sign-On, you need to understand the underlying architecture and how
it aects installation and upgrades.
vCenter Single Sign-On 6.0 Domains and Sites
(hp://link.brightcove.com/services/player/bcpid2296383276001?
bctid=ref:video_sso_6_domains_sites)
How vCenter Single Sign-On Protects Your Environment
vCenter Single Sign-On allows vSphere components to communicate with each other through a secure token
mechanism instead of requiring users to authenticate separately with each component.
vCenter Single Sign-On uses a combination of STS (Security Token Service), SSL for secure trac, and
authentication of human users through Active Directory or OpenLDAP and of solution users through
certicates.
vCenter Single Sign-On Handshake for Human Users
The following illustration shows the handshake for human users.
Figure 2‑1. vCenter Single Sign-On Handshake for Human Users
Kerberos
vSphere Web Client
1
2
3
4
5
6
VMware
Directory
Service
CA
vCenter
Server
vCenter Single
Sign-On
1 A user logs in to the vSphere Web Client with a user name and password to access the vCenter Server
system or another vCenter service.
The user can also log in without a password and check the Use Windows session authentication
checkbox.
2 The vSphere Web Client passes the login information to the vCenter Single Sign-On service, which
checks the SAML token of the vSphere Web Client. If the vSphere Web Client has a valid token, vCenter
Single Sign-On then checks whether the user is in the congured identity source (for example Active
Directory).
n
If only the user name is used, vCenter Single Sign-On checks in the default domain.
n
If a domain name is included with the user name (DOMAIN\user1 or user1@DOMAIN), vCenter
Single Sign-On checks that domain.
3 If the user can authenticate to the identity source, vCenter Single Sign-On returns a token that
represents the user to the vSphere Web Client.
vSphere Security
20 VMware, Inc.