I have an ESXi Server with a vCenter virtual appliance image and an image of a Windows 2008 TS.

The Windows 2008 image has an external Ethernet connection configured to another network, so users can login via a terminal session and get access the virtual machines on the ESXi Host via vCenter image.

It’s all working really well, but I have one problem - SSO. I would like to control access for the vCenter via the users configured on the Windows 2008 R2 Server, but I would also like to avoid installing AD functionality on the image because I want to keep it simple and keep the Windows 2008 fast and light.

Is this possible in any way? I have tried to read up on AD LDS, but can’t figure out if that I what I am looking for?

Any suggestions?

  • What version of vSphere? – ewwhite Aug 27 '14 at 12:08
  • its version 5.5 – user2536967 Aug 27 '14 at 13:48
  • What's the reason for using OS local users instead of employing your company's AD? – Mario Lenz Aug 27 '14 at 17:45
  • This is a test network, and we are completely cut-off any other networks or internet. the only connection into the network is via a RDP connection from a cooperate network to the Windows 2008 TS. We are not allowed to configure firewall to authenticate with cooperate domain (we would like to). – user2536967 Aug 27 '14 at 18:31

The users on your Windows VM are local, right? I think you have to install SSO on this machine. That's the only option possible to make use of local operating system users. (see Identity Sources for vCenter Server with vCenter Single Sign-On)

You'll have to reconfigure your VCSA to use this new SSO installation, though.

edit: Change the vCenter Single Sign-On Mode in the VMware vCenter Server Appliance

| improve this answer | |
  • Thanks Mario, that actually sounds like a really good solution. I did not know that I was possible to install SSO without vCenter. I will download vCenter and see if it solves my problem. Thanks. – user2536967 Aug 27 '14 at 18:23

My suggestion is to install a domain controller virtual machine. That's what the vSphere appliance works best with, and it's the native solution for your Windows RDS server.

vSphere/vCenter is using Likewise to provide AD/LDAP integration. It expects either pure LDAP or Microsoft Active Directory. Think about the target market for paid vSphere; shops with Windows footprints. Anything outside of the norm isn't going to be tested as well or supported in the best manner... Soo...

| improve this answer | |
  • Thanks for the reply, I would really like to avoid installing a AD service on the network. I can see that its possible to use AD LDS as to authenticate user from eg. ASP, so I tried to setup LDAP the same way in vCenter, but I can't get it to work. ramanam.wordpress.com/2011/05/20/… – user2536967 Aug 27 '14 at 17:21
  • @user2536967 So... you want AD, but you don't want to use AD to get AD? – HopelessN00b Aug 27 '14 at 17:24
  • Yes, I want someway to authenticate users without a full AD setup. manually configuring user in vCenter that authenticate against windows users would be fine. – user2536967 Aug 27 '14 at 17:28
  • 1
    What's a "full AD setup"? Installing a role on a server? What's the problem with using a domain controller? – ewwhite Aug 27 '14 at 17:29
  • 3
    Sheesh. You can squeeze a DC for just a few users into 512MB of RAM. This is not a big deal, and has a lot of benefits beyond just this particular situation. Besides, how did you think people were going to sign on to Terminal Services? – Michael Hampton Aug 27 '14 at 17:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.