Post-Deployment: Identity & SSO

Pre-requisite: Windows Active Directory must be fully deployed. See Windows AD Deployment.

---

Active Directory Integration

• Domain: pgnet.local
• Action: Log in to SDDC Manager and/or vCenter Server.
• Identity Provider: Configure LDAPS connection to your AD Domain Controller (10.200.1.240 forwards these requests).
• Groups: Map your VCF Admin group from pgnet.local to the Cloud Admin role.

---

SSO Configuration for VCF Operations

Adds AD users and groups as authenticated users across the VCF Operations suite. Create an embedded identity broker SSO domain:

1. Select VCF domain — pgvcf1

   

2. Choose deployment mode Start

   

3. Select Identity Broker (Embedded)

   

4. Select Configure Identity Provider

   

5. Select Directory-Based Identity Provider — AD/LDAP

   

6. Configure LDAP (see table below)

   

7. Configure Group Mappings (see table below)

   

   

LDAP Configuration

Field	Value	Notes
Identity Source Type	Active Directory over LDAP
Identity source name	pgnet-local
Primary Domain Controller	winsrv1.pgnet.local
Primary Domain Controller Port	636
Base DN for users	DC=pgnet,DC=local	Entire domain scope
Base DN for groups	DC=pgnet,DC=local	Entire domain scope
Domain name	pgnet.local
Domain alias	pgnet
Username	svc-ldap@pgnet.local	Bind account created by Salt
Password	VMware123!VMware123!	Default service account password
Connect to	Specific domain controllers
Primary server URL	ldaps://winsrv1.pgnet.local	Requires CA cert trust - will set port
Certificates	Upload Root CA Certificate	Export from NAS/SMB share (rootca.cer)

Group Mapping

VCF Identity Broker Attribute	Active Directory Attribute
userName *	sAMAccountName
firstName	givenName
lastName	sn
distinguishedName	distinguishedName
employeeID	(Not Mapped)
email	mail
userPrincipalName	userPrincipalName

User Groups in Active Directory

Name	Path
VCF-Auditors	CN=VCF-Auditors,OU=Groups,OU=it,DC=pgnet,DC=local
VCF-Certificate-Admins	CN=VCF-Certificate-Admins,OU=Groups,OU=it,DC=pgnet,DC=local
VCF-Cloud-Admins	CN=VCF-Cloud-Admins,OU=Groups,OU=it,DC=pgnet,DC=local
VCF-NSX-Admins	CN=VCF-NSX-Admins,OU=Groups,OU=it,DC=pgnet,DC=local
VCF-Operations	CN=VCF-Operations,OU=Groups,OU=it,DC=pgnet,DC=local
VCF-vSphere-Admins	CN=VCF-vSphere-Admins,OU=Groups,OU=it,DC=pgnet,DC=local

Users in Active Directory

Name	Path
Domain Administrator	CN=Domain Administrator,OU=Users,OU=it,DC=pgnet,DC=local
DevOps Admin	CN=DevOps Admin,OU=Users,OU=it,DC=pgnet,DC=local
Infrastructure Admin	CN=Infrastructure Admin,OU=Users,OU=it,DC=pgnet,DC=local
Peter Hauck	CN=Peter Hauck,OU=Users,OU=it,DC=pgnet,DC=local

---

Add SSO to VCF Components

1. Under the VCF Instance add the NSX server to SSO.

   

2. Under VCF Management select operations appliance → Enable Single Sign-On → select vc.pgnet.io identity broker.

   

---

Role Assignments via AD Groups

VCF Operations

1. Login to local account — ops.pgnet.io

2. Administration → Control Panel → Access Control → User Groups

   

3. ... → Import from Source → Search VCF → Select VCF-Cloud-Admins@pgnet.local → Finish

   

4. Edit the new group → assign Administrator — All Objects → Save

   

Workload Domain vCenter

1. Login to vc.pgnet.io using local account

2. Administration → Users and Groups → Groups

3. Select Administrators → domain pgnet.local → search and add VCF-Cloud-Admins

   

NSX Manager

1. Login to nsx.pgnet.io using local account

2. System → User Management → ADD ROLE FOR VCF SSO USER/GROUP

3. Add VCF-Cloud-Admins → assign role Enterprise Admin