6.0.3

vCenter Single Sign-On Components
vCenter Single Sign-On includes the Security Token Service (STS), an administration server, and vCenter
Lookup Service, as well as the VMware Directory Service (vmdir). The VMware Directory Service is also
used for certicate management.
During installation, the components are deployed as part an embedded deployment, or as part of the
Platform Services Controller.
STS (Security Token
Service)
The STS service issues Security Assertion Markup Language (SAML) tokens.
These security tokens represent the identity of a user in one of the identity
source types supported byvCenter Single Sign-On. The SAML tokens allow
both human users and solution users who authenticate successfully to
vCenter Single Sign-On to use any vCenter service that vCenter Single Sign-
On supports without authenticating again to each service.
The vCenter Single Sign-On service signs all tokens with a signing certicate,
and stores the token signing certicate on disk. The certicate for the service
itself is also stored on disk.
Administration server
The administration server allows users with administrator privileges to
vCenter Single Sign-On to congure the vCenter Single Sign-On server and
manage users and groups from the vSphere Web Client. Initially, only the
user administrator@your_domain_name has these privileges. In vSphere 5.5
this user was [e-mail]. With vSphere 6.0, you can change
the vSphere domain when you install vCenter Server or deploy the
vCenter Server Appliance with a new Platform Services Controller. Do not
name the domain name with your Microsoft Active Directory or OpenLDAP
domain name.
VMware Directory
Service (vmdir)
The VMware Directory service (vmdir) is associated with the domain you
specify during installation and is included in each embedded deployment
and on each Platform Services Controller. This service is a multi-tenanted,
multi-mastered directory service that makes an LDAP directory available on
port 389. The service still uses port 11711 for backward compatibility with
vSphere 5.5 and earlier systems.
If your environment includes more than one instance of the
Platform Services Controller, an update of vmdir content in one vmdir
instance is propagated to all other instances of vmdir.
Starting with vSphere 6.0, the VMware Directory Service stores not only
vCenter Single Sign-On information but also certicate information.
Identity Management
Service
Handles identity sources and STS authentication requests.
How vCenter Single Sign-On Affects Installation
Starting with version 5.1, vSphere includes a vCenter Single Sign-On service as part of the vCenter Server
management infrastructure. This change aects vCenter Server installation.
Authentication with vCenter Single Sign-On makes vSphere more secure because the vSphere software
components communicate with each other by using a secure token exchange mechanism, and all other users
also authenticate with vCenter Single Sign-On.
vSphere Security
22 VMware, Inc.