6.0.3

3 Export the vCenter Single Sign-On metadata.
a In the Metadata for your SAML service provider eld, click Download.
b Specify a le location.
4 Go to the SAML service provider, for example VMware vRealize Automation 7.0 or later, and follow the
instructions for your SAML service provider to add the vCenter Single Sign-On metadata to that service
provider.
See the vRealize Automation documentation for details on importing the metadata.
Managing the Security Token Service (STS)
The vCenter Single Sign-On Security Token Service (STS) is a Web service that issues, validates, and renews
security tokens.
To acquire SAML tokens, users present their primary credentials to the STS interface. The primary
credentials depend on the type of user.
User
User name and password available in a vCenter Single Sign-On identity
source.
Application user
Valid certicate.
STS authenticates the user based on the primary credentials, and constructs a SAML token that contains user
aributes. STS signs the SAML token with its STS signing certicate, and assigns the token to the user. By
default, the STS signing certicate is generated by VMCA. You can replace the default STS signing certicate
from the vSphere Web Client.
After a user has a SAML token, the SAML token is sent as part of that user's HTTP requests, possibly
through various proxies. Only the intended recipient (service provider) can use the information in the
SAML token.
Generate a New STS Signing Certificate on the Appliance
If you want to replace the default vCenter Single Sign-On Security Token Service (STS) signing certicate,
you have to rst generate a new certicate and add it to the Java key store. This procedure explains the steps
on an embedded deployment appliance or an external Platform Services Controller appliance.
Procedure
1 Create a top-level directory to hold the new certicate and verify the location of the directory.
mkdir newsts
cd newsts
pwd
#resulting output: /root/newst
2 Copy the certool.cfg le into the new directory.
cp /usr/lib/vmware-vmca/share/config/certool.cfg /root/newsts
3 Open your copy of the certool.cfg le and edit it to use the local Platform Services Controller IP
address and hostname.
The country is required and has to be two characters. The following sample illustrates this.
#
# Template file for a CSR request
#
# Country is needed and has to be 2 characters
Chapter 2 vSphere Authentication with vCenter Single Sign-On
VMware, Inc. 47