IDENTITY SOURCES AND THE DEFAULT DOMAIN
0 Comments
An identity source is a repository for users and groups that can be used by vCenter SSO for user authentication. This is usually a directory service such as Active Directory or OpenLDAP. Each identity source is associated with a domain, which enables vCenter SSO to authenticate users against multiple domains.
Here is a list of supported identity sources in vCenter Server version 5.5:
| Identity source | Description | Name in Web Client |
| Active Directory version 2003 and later | You can specify a single Active Directory domain as an identity source. The domain can have child domains or be a forest root domain. | Active Directory (Integrated Windows Authentication) |
| Active Directory over LDAP | Included mainly for compatibility with the vCenter Single Sign-On service included with vSphere 5.1. | Active Directory as an LDAP Server |
| OpenLDAP versions 2.4 and later | Multiple OpenLDAP identity sources are supported. | OpenLDAP |
| Local operating system users | Local operating system users are local to the operating system where the vCenter Single Sign-On server is running. This identity source is supported only in basic vCenter Single Sign-On server deployments and is not available in deployments with multiple vCenter Single Sign-On instances. Only one local operating system identity source is allowed. | localos |
| vCenter SSO system users | This identity source named vsphere.local is created when you install vCenter Single Sign-On. | vsphere.local |
The default identity source (vshpere.local)
The default identity source named vsphere.local is created when vCenter SSO is installed. This identity source is used when a user logs in without a domain name. The user named administrator is created in this domain and can be used to add identity sources, set the default identity source, change the password and lockout policy and manage users and groups in the vsphere.local domain.
Users who do not belong to the vsphere.local domain must specify their domain name in one of two ways:
1. specifying the domain name prefix, for exaxmple, DOMAIN\john
2. including the domain, for example, john@domain.local
2. including the domain, for example, john@domain.local
