Active Directory for VMware vCenter 6.5

Editor's Notes

• #6 Welcome to Netcom Learning’s VMware vSphere Webinar series Today we’re going to introduce ourselves, then tell you just a little bit about our VMware vSphere Boot Camp And then jump right into the topic: Active Directory for VMware vSphere First, we’ll explain what VMware vCenter SSO is Then we will show you two ways to integrate your vCenter with Active Directory
• #7 Our practical, real-world VMware training is designed specifically to teach what you need to know to install, run, maintain and update VMware vSphere. Our Boot Camp materials are current to the most recent release of VMware vSphere and always have an emphasis on Best Practices and Real world techniques. In class we teach you how to use, manage and diagnose VMware vSphere as a whole and do not fixate on the most expensive options and features available to only a percentage of users.
• #8 During class, each student has access to real (physical) servers in a real data center, where you will build your own VMware vSphere environment. At every stage of the process, you will be working live, with equipment specifically assigned to you for the duration of class. You’ll have 24 by 7 access to your resources in the class lab, and you can request up to two additional weeks of access to your lab at NO EXTRA COST! Bottom line is: If you need to improve your skills with VMware vSphere, there’s no better choice than the Netcom VMware vSphere Boot Camp!
• #9 The procedures and methods we are going to go over in this webinar were taken right from our experience as active consultants. In class, you will have the opportunity to explore both methods of using AD with vCenter, using your own vCenter Server!
• #11 VMware vCenter 5 and prior versions were Windows-only applications that required Active Directory to install. Domain Admins of the AD Domain where vCenter was installed, became vCenter Administrators by default. As you can imagine, in larger organizations with multiple “silos,” AD administrators may not be qualified on VMware and VMware admins may not be authorized for AD administration.
• #12 VMware vCenter SSO was actually introduced with version 5.1, but it was a non-functional mess with plaintext passwords and complex installation requiring manual creation of database tables in SQL! Beginning with vCenter 5.5, VMware vCenter SSO became fully-functional as an independent implementation of MIT Kerberos. In SSO, it is possible to create Users and Groups, just like any other directory. It’s also possible to configure aging, password complexity, and two-factor authentication to be compliant with most any standards such as SSAE 16 and ISO 27001
• #13 One of the notable advantages of vCenter 5.5 and later versions is that Active Directory is no longer required as a prerequisite for installation, only functioning forward and reverse DNS. This means non-Windows shops no longer have to keep one or two licensed editions of Windows Server just to run vSphere! The biggest advantage is that VMware vCenter Server is no longer a subset of a single AD Domain, but potentially a superset of many AD Domains, all authenticating against vCenter SSO independently. Moreover, the VMware vCenter SSO administrator is created at the time of installation (administrator@vsphere.local or other TLD you create), and is the ONLY default vCenter administrator. In larger organizations, this is very important, because Domain Administrators not qualified on VMware, will not be granted default access.
• #15 The most common, yet disadvantageous, method of integrating VMware vCenter SSO and AD is by using the Machine Account of the vCenter Server. This means, joining either the Windows OS or the SUSE Linux OS to the AD Domain where it is hosted. Joining a Windows server to a Domain is common-practice. Joining the VCSA to a Domain is easy and done entirely in the GUI. Both require a reboot. The problem is that this creates a potential “chicken-and-egg” dependency between the AD Domain and the Operating System where vCenter Server is hosted. You wouldn’t want to encounter a situation where AD had failed and you couldn’t access vCenter to recover it!
• #16 To join the VCSA to an AD Domain, click on: Administration
• #17 Then click on: System Configuration
• #18 Click on: Nodes
• #19 Then locate your vCenter node. Most likely, it will be the only choice.
• #20 Enter credentials authorized to join the AD Domain, preferably in UPN format
• #21 And reboot your VCSA
• #22 After the system has rebooted, choose: Configuration Then click the tab: Identity Sources
• #23 Now choose: Active Directory (Integrated Windows Authentication), followed by: Finish Your vCenter and Active Directory are now integrated, but we have yet to create a default permission
• #25 The best way to integrate vCenter SSO with Active Directory (or any directory) is to use LDAP / LDAPs In this way, vCenter becomes a client of the directory(ies) that need to authenticate against vCenter No dependencies are created, and vCenter can run entirely independently of any domain
• #26 Click on: Administration
• #27 Choose: Configuration then click the tab: Identity Sources
• #28 Now choose: Active Directory as an LDAP Server
• #29 Enter all of the information in LDAP format, as we show you in the screenshot. If DNS is working correctly, you will not need to pprovide the address of a specific LDAP Server. Your vCenter is now integrated with one AD Domain. You can add more if required or desirable simply by repeating the process. To use Active Directory, however, we must create a default permission.
• #31 Once the connection between vCenter and AD is established, no matter how it is created, the steps to create the first Global Permission allowing users of that directory to manage vCenter is the same.
• #32 Click on: Global Permissions Then choose the tab: Manage And finally, click on the: +
• #33 Now you can choose the AD Domain Followed by searching or browsing for the user/group you would like to add Then click on: Add And finally: OK
• #34 Once the Directory user is added, you chose the Role, which will allow the user limited ot total access to the vCenter Server In class, we go over how to create and use Roles in detail, to delegate authority to Silos such as “desktop support” or “Linux”, as well as create completely independent multi-tennancy environments.
• #35 Now you are ready to use your directory! We recommend to never “Use Windows Session Credentials” as it requires the “Client Integration Plugin” to the browser, which has had numerous documented vulnerabilities We recommend using UPN format usernames wherever possible, in vSphere and in general IP practice.
• #36 Don’t Forget, we have a Boot Camp in just TWO Weeks in Las Vegas, Followed by a class on August 14 in New York City
• #42 Further, if your interested in “Learning from the Top American Leaders”, please logon to the e-learning platform - www.sarderlearning.com. Avail the special promotion meant for FIRST TIME USERS. Use your coupon code – SARDER10 and begin your leadership journey. Now!!
• #43 Sarder Learning is a micro-learning knowledge platform that brings the world’s best Fortune 500 companies CXOs, Ivy League professors and best selling authors together to share industry –wide best practices related to leadership & management. Sarder Learning under 13 different categories has a rapidly growing course library relevant across multiple domains with well defined specific learning paths and scenario –based learning. An intuitive and responsive learning management system environment makes it easy to track one’s learning journey take courses at convinence
• #44 To get your dose of Latest Business Insights FROM Corporate America, logonto Sardertv.com. Don’t forget to register for our newsletter.
• #47 I’d like to thank the team members that were part of this webinar: Swedha Sarah Gaurav Ben Ankuna vashali &special thanks to Chief Engineer Mina Henery from IBM Germany for his valuable support