• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 495
  • Last Modified:

vCenter 5.5 SSO

I want to make sure I am understanding things correctly with SSO in vCenter. The password you give the adminstrator@vsphere.local account can only manage SSO options and nothing within vcenter correct? Does the root account has access into SSO by default?
0
compdigit44
Asked:
compdigit44
2 Solutions
 
Ganesh Kumar ASr Infrastructure SpecialistCommented:
Administrator access allows a user complete super user privileges on the Single Sign On system, including the ability to create users and groups, assign permissions, add identity sources, and modify policies (lockout and password). Upon installation, only one user (admin@System-Domain) has this role.
0
 
compdigit44Author Commented:
Thanks .. What I am trying to confirm is the SSO admin access is separate from vCEnter admin access.

Also root access on the vCenter appliances differs from SSO admin how?
0
 
GG VPCommented:
Yes, SSO sits between your AD/LDAP and vCenter Server and this takes the credentials and verifies with the source (AD/LDAP) and once successful it provides a security token to the authenticated user.

With this token user can access vSphere products (vCenter, vCloud directory, vCO).

For more detailed explanation, please visit below link,

http://vxpresss.blogspot.com/2013/12/part-2-architecting-vcenter-single-sign.html

YES, the administrator@vsphere.local by default has administrator access on vCenter.

Please refer below VMware documentation for further details,

http://pubs.vmware.com/vsphere-55/index.jsp?topic=%2Fcom.vmware.vsphere.security.doc%2FGUID-A2A90265-4A6B-4E23-9681-97B867E55457.html

Hope this helps!

Thank you!
0
 
Andrew Hancock (VMware vExpert / EE MVE^2)VMware and Virtualization ConsultantCommented:
The password you give the adminstrator@vsphere.local account can only manage SSO options and nothing within vcenter correct?

It can manage and access both, (SSO and vCenter Server) it's like THE SUPER USER account, never lose the password, you cannot recover it if you forget it, (well not easily!).

e.g. normally after an installation you would login in as administrator@vsphere.local and then add Administrator access.

also - administrator@vsphere.local is a good account to use for Plugin Access and registration.....because it has overall rights to EVERYTHING! (and is non-AD, does not expire, or get locked!!!!)

Just give it a super secure password e.g. 26 letters, numbers and special chars, and lock in the vault!

root account, is an account specific for local root access to the local server e.g. Linux super user, it cannot access vCenter Server, but can configure the Host Appliance, e.g. change IP Address, look at logs, change scripts and config.

i.e. you may not want your vCenter Administrator, logging in or changing configuration on the Linux server.

root is a standalone user on the Linux appliance!
0

Featured Post

Upgrade your Question Security!

Your question, your audience. Choose who sees your identity—and your question—with question security.

Tackle projects and never again get stuck behind a technical roadblock.
Join Now