6.4

Managing Authentication in
vRealize Operations for Published
Applications 10
RMI servers provide a certicate that the agents use to authenticate the
vRealize Operations for Published Applications adapter. Broker agents use SSL/TLS client authentication
with a certicate that the vRealize Operations for Published Applications adapter uses to authenticate the
broker agents. Desktop agents provide tokens that the vRealize Operations for Published Applications
adapter uses to authenticate the desktop agents.
To increase security, you can replace the default self-signed certicates that the
vRealize Operations for Published Applications adapter and broker agents use.
Understanding Authentication for Each Component
Each vRealize Operations for Published Applications component handles authentication dierently.
vRealize Operations for Published Applications Adapter Authentication
When an RMI connection is established between the desktop message server and a desktop agent, or
between the broker message server and a broker agent, the agent requests a certicate from the server to
perform authentication. This certicate is validated against the agent's trust store before proceeding with the
connection. If the server does not provide a certicate, or the server certicate cannot be validated, the
connection is rejected.
When the vRealize Operations for Published Applications adapter is rst installed, a self-signed certicate is
generated. The desktop message server and broker message server use this self-signed certicate by default
to authenticate to their agents. Because this certicate is generated dynamically, you must manually pair the
vRealize Operations for Published Applications adapter and broker agent before the agents can
communicate with the vRealize Operations for Published Applications adapter. See Chapter 13, “Certicate
Pairing,” on page 63.
Desktop Agent Authentication
Connections to the desktop message server require an authentication token to verify that the connection is
coming from a valid desktop agent. The desktop agent generates a unique authentication token for each
remote desktop.
In addition, the desktop agent generates a serverID for the XD-XA server and write the serverID into
vRealize Operations Manager. When a desktop agent aempts to send data to the
vRealize Operations for Published Applications adapter, the adapter will verify whether the authentication
token has been cached in memory. If there is no server with same name, the adapter caches the server name
and authentication token in memory. If the server has been cached, compare the cached authentication token
and the one sent. If the tokens are same, accept the message, else reject the desktop agent message.
VMware, Inc.
55