6.0.3

Select Use machine account to speed up conguration. If you expect to rename the local machine on which
vCenter Single Sign-On runs, specifying an SPN explicitly is preferable.
N In vSphere 5.5, vCenter Single Sign-On uses the machine account even if you specify the SPN. See
VMware Knowledge Base article 2087978.
Table 2‑5. Add Identity Source Settings
Text Box Description
Domain name FDQN of the domain name, for example, mydomain.com.
Do not provide an IP address. This domain name must be
DNS-resolvable by the vCenter Server system. If you are
using a vCenter Server Appliance, use the information on
conguring network seings to update the DNS server
seings.
Use machine account Select this option to use the local machine account as the
SPN. When you select this option, you specify only the
domain name. Do not select this option if you expect to
rename this machine.
Use Service Principal Name (SPN) Select this option if you expect to rename the local
machine. You must specify an SPN, a user who can
authenticate with the identity source, and a password for
the user.
Service Principal Name (SPN) SPN that helps Kerberos to identify the Active Directory
service. Include the domain in the name, for example,
STS/example.com.
The SPN must be unique across the domain. Running
setspn -S checks that no duplicate is created. See the
Microsoft documentation for information on setspn.
User Principal Name (UPN)
Password
Name and password of a user who can authenticate with
this identity source. Use the email address format, for
example, [e-mail]. You can verify the User
Principal Name with the Active Directory Service
Interfaces Editor (ADSI Edit).
Active Directory LDAP Server and OpenLDAP Server Identity Source Settings
The Active Directory as an LDAP Server identity source is available for backward compatibility. Use the
Active Directory (Integrated Windows Authentication) option for a setup that requires less input. The
OpenLDAP Server identity source is available for environments that use OpenLDAP.
If you are conguring an OpenLDAP identity source, see VMware Knowledge Base article 2064977 for
additional requirements.
Table 2‑6. Active Directory as an LDAP Server and OpenLDAP Settings
Field Description
Name Name of the identity source.
Base DN for users Base Distinguished Name for users.
Domain name FDQN of the domain, for example, example.com. Do not
provide an IP address in this eld.
Domain alias For Active Directory identity sources, the domain's
NetBIOS name. Add the NetBIOS name of the Active
Directory domain as an alias of the identity source if you
are using SSPI authentications.
For OpenLDAP identity sources, the domain name in
capital leers is added if you do not specify an alias.
Chapter 2 vSphere Authentication with vCenter Single Sign-On
VMware, Inc. 33