Sysadmin blog: VCSA

Tuesday, October 6, 2015

In the "VMware vCenter Server Appliance" web site got to vCenter Server -> Authentication

Domain - domain name.
Administrator user - user principal name (UPN) with administrative rights in the domain.
Administrator password - password

Go to Administration -> Sign-On and Discovery -> Configuration -> Identity Sources
Click the + (green) symbol (Add Identity Source) and fill in the required information:

Name - Anything you want to refer to this Identity source as (typically domain name)
Primary Server URL: ldap://<domain server FQDN>
Secondary Server URL: <optional>
Base DN for users: distinguished name (DN) of object unit (OU) with users
Domain Name: <Domain Name>
Domain alias: <NetBIOS domain name>.
WARNING!!! You must fill out this field. If you dont - you can't login to vSphere Web Client with AD login <domain>\<username> and option "Use Windows session authentication" don't work.
Base DN for groups: distinguished name (DN) of object unit (OU) with groups
Authentication Type: (How you want to authenticate the initial connection to your domain)

Select your AD server URL and click on the blue dot with an arrow ("Add to default domains").
WARNING!!! When your domain appears in default domains list click on the blue disk icon to save your change, otherwise you will be wondering why it is not working as expected.
Go to Administration -> Access -> SSO Users and Groups -> Groups

Monday, September 12, 2011

prepare your_cert.cer and your_key.key file and copy these files to VCSA server in temporary folder
create server.pem file:
cat your_key.key > server.pem
cat your_cert.crt >> server.pem
server.pem file should be like this:
  -----BEGIN RSA PRIVATE KEY-----
   <private_key>
  -----END RSA PRIVATE KEY-----
  -----BEGIN CERTIFICATE-----
   <certificate>
  -----END CERTIFICATE-----
copy and replace our new server.pem file to folder /opt/vmware/etc/lighttpd/server.pem
restart lighttpd web server:
/etc/init.d/vami-lighttp stop
/etc/init.d/vami-lighttp start

- Vmware vCenter service

prepaire rui.crt and rui.key file
create rui.pfx. Better way create pfx on VCSA server with this command:
openssl pkcs12 -export -in rui.crt -inkey rui.key -name rui -passout pass:testpassword -out rui.pfx
connect to VCSA via SSH and create backup of these files:
/etc/vmware-vpx/ssl/rui.*
/usr/lib/vmware-vpx/inventoryservice/ssl/rui.*
copy and replace yours rui.crt, rui.key and rui.pfx to folders:
/etc/vmware-vpx/ssl/
/usr/lib/vmware-vpx/inventoryservice/ssl/
open file /etc/hosts and add one line in the beginnign of the file:
<vcsa_ipv4_address> <VCSA_FQDN> <VCSA_host_name>for example:
192.168.10.15 vcsa.vmware.com vcsa
load replacement certificates to memory:

open browser and connect to
https://<VCSA_FQDN>/mob/?moid=vpxd-securitymanager&vmodl=1
enter administrators login and password
click reloadSslCertificate
Click Invoke Method.
A message appears on the Web page: Method Invocation Result: void.

open browser, connect to https://<VCSA_FQDN> and check that you see correct sertificate.