Setting Up Single Sign On (SSO) in VCF Operations 9.1 (Using Active Directory)

In VCF 9, VMware introduced the ability to configure SSO across the entire VCF Fleet. As many other centralized management capabilities, this is done through VCF Operations. Let's review how we can set this up. For the purposes of this article, we will be using Active Directory: Navigate to Manage > Identity and Access > VCF SSO Overview. Click configure SSO:

Ensure you mean the proper prerequisites.

Click Choose Deployment mode. Instance is recommended because it allows for multinode resiliency. Hit Configure. This may take some time to complete:

Select AD/LDAP:

Fill out the directory information:

Review:

Next hit Configure under Configure User and Group provisioning. Review the directory information, then ensure the appropriate attribute mapping, and then most importantly for this use case specify the base group DN:

Press Add Base DN and then search for the groups that you would like to include in VCF Operations:

You can also go through a similar process to add users:

Lastly review and hit finish. You will optionally have the ability to test signing into SSO:

From here we will have the ability to add vCenter and NSX to the SSO domain, by clicking start and then selecting the components, and hitting configure.

NOTE: this will disconnect any existing authentication methods from vCenter!

Lastly, we have the optional but highly recommended ability to add in roles. Click start and then select the Users/Groups you want to assign roles to:

From here they will have the ability to set the access scope at a Component level (i.e. NSX, vCenter, Automation, Operations access).

NOTE: We do not set the Object level scope here. We will set that up in a separate section.

Select the Scope and Role for the Users/Groups you have selected.

Click assign and then done.

Congratulations! You have configured SSO! Hope this helps!!