6.0.3

Option Description
Maximum bearer token lifetime
Bearer tokens provide authentication based only on possession of the
token. Bearer tokens are intended for short-term, single-operation use. A
bearer token does not verify the identity of the user or entity that is
sending the request. This value species the lifetime value of a bearer
token before the token has to be reissued.
Maximum holder-of-key token
lifetime
Holder-of-key tokens provide authentication based on security artifacts
that are embedded in the token. Holder-of-key tokens can be used for
delegation. A client can obtain a holder-of-key token and delegate that
token to another entity. The token contains the claims to identify the
originator and the delegate. In the vSphere environment, a vCenter Server
system obtains delegated tokens on a user's behalf and uses those tokens to
perform operations.
This value determines the lifetime of a holder-of-key token before the
token is marked invalid.
5 Click OK.
Managing vCenter Single Sign-On Users and Groups
A vCenter Single Sign-On administrator user can manage users and groups in the vsphere.local domain
from the vSphere Web Client.
The vCenter Single Sign-On administrator user can perform the following tasks.
n
Add vCenter Single Sign-On Users on page 55
Users listed on the Users tab in the vSphere Web Client are internal to vCenter Single Sign-On and
belong to the vsphere.local domain.
n
Disable and Enable vCenter Single Sign-On Users on page 55
When a vCenter Single Sign-Onuser account is disabled, the user cannot log in to the vCenter Single
Sign-On server until the account is enabled by an administrator. You can disable and enable users from
the vSphere Web Client interface.
n
Delete a vCenter Single Sign-On User on page 56
You can delete users that are in the vsphere.local domain from the vCenter Single Sign-On. You cannot
delete local operating system users or users in another domain from the vSphere Web Client.
n
Edit a vCenter Single Sign-On User on page 56
You can change the password or other details of a vCenter Single Sign-On user from the
vSphere Web Client. You cannot rename users in the vsphere.local domain. That means you cannot
rename [e-mail].
n
Add a vCenter Single Sign-On Group on page 57
In the vCenter Single Sign-On, groups listed on the Groups tab are internal to vCenter Single Sign-On.
A group lets you create a container for a collection of group members (principals).
n
Add Members to a vCenter Single Sign-On Group on page 57
Members of a vCenter Single Sign-On group can be users or other groups from one or more identity
sources. You can add new members from the vSphere Web Client.
n
Remove Members from a vCenter Single Sign-On Group on page 58
You can remove members from a vCenter Single Sign-On group from the vSphere Web Client. When
you remove a member (user or group) from a local group, you do not delete the member from the
system.
vSphere Security
54 VMware, Inc.