VMware vCenter 5.1 Installation: Part 9 (Optional SSO Configuration)

UPDATE 1/28/2013: Added licensing information.
--

In Part 8 of my series we installed the vSphere Web Client and only performed minimal configuration changes. In this installment of the vCenter 5.1 installation series I'll show you a couple of basic, but probably common, configuration tweaks you can make to your SSO installation. These steps are optional, but probably nearly everyone will want to implement some form of these changes. The two tweaks are setting the default login domain for SSO and the other is using an AD group to control admin rights to the SSO service and not rely on the default built-in account.

Let's go to work!

1. Login to the vSphere Web Client with the SSO administrator credentials (admin@System-Domain). In the left pane click on Administration then click on Configuration under Sign-On and Discovery.

2. If you wish to reduce future sign in keystrokes you can add your Active Directory domain to the list of default SSO domains. To do that highlight your AD server URL then click on the blue dot with an arrow, as shown below.

3. Acknowledge any warning about possible locked out accounts, and you should now see your AD domain listed under default domains.

 

Important! Click on the blue disk icon to save your change, otherwise you will be wondering why it is not working as expected.



 

 

4. At this point you may want to add an AD-based group to the SSO administrator group, so you don't have to remember, or share, the built-in admin account credentials. To do that click on SSO Users and Groups in the left pane. Click on the ___Administrators___ principal name then click on the person icon with the plus sign next to it.

5. Now I created a group in AD called APP_VCTR_SSO_Administrator and added my admin account to it. Use whatever group name suits your needs. Change the identity source to your domain name then enter the name of the AD group and click on Search. After a few seconds it should populate the fields, then click on Add. Finally click OK.

6. Log out of the vSphere web client, logoff Windows if needed to refresh your group membership, then then validate you can access the SSO configuration once you login to the Web Client.

7. You probably want to assign a license key to your vCenter server, otherwise after the grace period is up, it will be non-functional. In the web client, go back to the Home page in the left pane, then click on Administration.

8. Once that pane opens, click on Licenses. You can now input your licenses for vCenter and ESXi hosts. Don't forget to assign the licenses to their respective products.

Next up is creating the VUM DSN, which is covered in Part 10.