VMware VS4-ENT-PL-A - vSphere Enterprise Plus Setup Manual page 88

vSphere Installation and Setup
Option
OpenLDAP
LocalOS
N If the user account is locked or disabled, authentications and group and user searches in the
OTE
Active Directory domain will fail. The user account must have read-only access over the User and
Group OU, and must be able to read user and group attributes. This is the default Active Directory
domain configuration for user permissions. VMware recommends using a special service user.
5 If you configured an Active Directory as an LDAP Server or an OpenLDAP identity source, click Test
Connection to ensure that you can connect to the identity source.
6 Click OK.
What to do next
When an identity source is added, all users can be authenticated but have the No access permission. A user
with vCenter Server Modify.permissions privileges can assign permissions to users or groups of users to
enable them to log in to vCenter Server. See
Active Directory Identity Source Settings
If you select the Active Directory (Integrated Windows Authentication) identity source type, you can either
use the local machine account as your SPN (Service Principal Name) or specify an SPN explicitly.
Select Use machine account to speed up configuration. If you expect to rename the local machine on which
vCenter Single Sign-On runs, specifying an SPN explicitly is preferable.
Table 4‑1. Add Identity Source Settings
Field
Domain name
Use machine account
Use SPN
Service Principal
88
Description
Use this option for an OpenLDAP identity source. See
LDAP Server and OpenLDAP Server Identity Source Settings,"
page 89.
Use this option to add the local operating system as an identity source.
You are prompted only for the name of the local operating system. If you
select this option, all users on the specified machine are visible to vCenter
Single Sign-On, even if those users are not part of another domain.
"Assign Permissions in the vSphere Web Client,"
Description
FDQN of the domain. Do not provide an IP address in this
field.
Select this option to use the local machine account as the
SPN. When you select this option, you specify only the
domain name. Do not select this option if you expect to
rename this machine.
Select this option if you expect to rename the local
machine. You must specify an SPN, a user who can
authenticate with the identity source, and a password for
the user.
SPN that helps Kerberos to identify the Active Directory
service. Include the domain in the name, for example,
STS/example.com.
You might have to run setspn -S to add the user you
want to use. See the Microsoft documentation for
information on setspn.
The SPN must be unique across the domain. Running
setspn -S checks that no duplicate is created.
"Active Directory
on
on page 89.
VMware, Inc.