• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 731
  • Last Modified:

VMWARE SSO 5.5 : advice needed for identity source type

I am looking at this screen ID an It looks like SSO automaticly uses the machine account to connect to and browse AD. I am not sure IF I have a good reason to use the SPN and UPN for this , it seems like it is not needed . I am not going to rename the Vcenter server and I am able to add users from the domain . I have never seen this before

the domain name is DS.companyname.com and I know this is redundant and can fail over from one domain controller to another

1. is there any reason I cannot use this configuration as is?

2.what is the difference between " active directory ( integrated Windows authentication )

and " active directory as LDAP server"??????

thanks
0
NAMEWITHELD12
Asked:
NAMEWITHELD12
2 Solutions
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
1. is there any reason I cannot use this configuration as is?

But I would use Active Directory ( integrated Windows authentication

2.what is the difference between " active directory ( integrated Windows authentication )

and " active directory as LDAP server"??????

see here, gives an explanation in the documents,

http://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc%2FGUID-1F0106C9-0524-4583-9AC5-A748FD1DC4C5.html

Add you Domain as an Indentity Source, for AD users to be able to login.
0
 
AbhilashBloggerCommented:
You  can use your environment as is. As far you do not have problems with adding the domain accounts and give permissions on vcenter you should not have any issues.

There is a really good article of connecting AD(IWA) with local account or SPN and UPN.
http://wahlnetwork.com/2013/09/09/using-active-directory-integrated-windows-authentication-sso-5-5/

For difference between them, see the VMware documentation.
http://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc%2FGUID-1F0106C9-0524-4583-9AC5-A748FD1DC4C5.html
0
 
NAMEWITHELD12Author Commented:
SO , it looks like you 2 agree , I have looked at the WAHLnetwork link about and found that not having a service account express is a reason within it self to use the machine account

I am going to leave the config "AS-IS"

thanks !!!!!
0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

Join & Write a Comment

Featured Post

Has Powershell sent you back into the Stone Age?

If managing Active Directory using Windows Powershell┬« is making you feel like you stepped back in time, you are not alone.  For nearly 20 years, AD admins around the world have used one tool for day-to-day AD management: Hyena. Discover why.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now