6.0.3

4 The vSphere Web Client passes the token to the vCenter Server system.
5 vCenter Server checks with the vCenter Single Sign-On server that the token is valid and not expired.
6 ThevCenter Single Sign-On server returns the token to the vCenter Server system, leveraging
thevCenter Server Authorization Framework to allow user access.
The user can now authenticate, and can view and modify any objects that the user's role has privileges for.
N Initially, each user is assigned the No Access role. A vCenter Server administrator must assign the
user at least to the Read Only role before the user can log in. See “Add a Permission to an Inventory Object,”
on page 142.
vCenter Single Sign-On Handshake for Solution Users
Solution users are sets of services that are used in the vCenter Server infrastructure, for example, the
vCenter Server or vCenter Server extensions. VMware extensions and potentially third-party extensions
might also authenticate to vCenter Single Sign-On.
Figure 2‑2. vCenter Single Sign-On Handshake for Solution Users
Kerberos
Solution User
1
2
3
4
VMware
Directory
Service
CA
vCenter
Server
vCenter Single
Sign-On
For solution users, the interaction proceeds as follows:
1 The solution user aempts to connect to a vCenter service,
2 The solution user is redirected to vCenter Single Sign-On. If the solution user is new to vCenter Single
Sign-On, it has to present a valid certicate.
3 If the certicate is valid, vCenter Single Sign-On assigns a SAML token (bearer token) to the solution
user. The token is signed by vCenter Single Sign-On.
4 The solution user is then redirected to vCenter Single Sign-On and can perform tasks based on its
permissions.
5 The next time the solution user has to authenticate, it can use the SAML token to log in to
vCenter Server.
By default, this handshake is automatic because VMCA provisions solution users with certicates during
startup. If company policy requires third-party CA-signed certicates, you can replace the solution user
certicates with third-party CA-signed certicates. If those certicates are valid, vCenter Single Sign-On
assigns a SAML token to the solution user. See “Use Third-Party Certicates With vSphere,” on page 112.
Chapter 2 vSphere Authentication with vCenter Single Sign-On
VMware, Inc. 21