vCAC 6.1 SSO configuration gotcha

This drives me crazy.  An FQDN is not case-sensitive.  SERVER.DOMAIN.TLD is the same as sERvEr.dOMaIn.tlD.  VMware has added significantly to the server certificate authenticity checking in version 6.1.  When configuring the SSO settings in the VAMI, it not only connects and validates the certificate, but also checks the host name against the SAML ticket.  In general, more security and validation is a good thing, but in this case, the code requires that the hostname you entered is exactly the value in the SAML ticket.  If the spelling and name do not exactly match, the step returns Invalid “Host Settings”.  Worse, the value it states is expected is NOT the value from the SAML ticket.

Expecting the same value
Wait… what?!

To make sure you enter the correct value, browse to https://ssoserver:7444/websso/SAML2/Metadata/vsphere.local and save the file when prompted.  Open the file in notepad or some text editor.  Locate the entityID attribute of the EntityDescriptor element.  That is the name and spelling required.

<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" ...>
<vmes:ExportedBy>Exported by VMware Identity Server (c) 2012
<EntityDescriptor entityID="https://VCSSO.ragazzi.lab:7444/websso/SAML2/Metadata/vsphere.local">
<IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">

In my example, once I submitted the SSO Host name as VCSSO.ragazzi.lab, it was accepted and configuration continued.

I’m hoping this simple case-sensitivity issue is corrected in the next patch.


Configuring Highly Available vCenter SSO with SSL certificates

*** UPDATE 12/18/14 ***
Instead of this blog, I strongly suggest you use and follow the
Configuring VMware vCenter SSO High Availability for VMware vRealize Automation Technical Whitepaper. It is somewhat more comprehensive and authoritative. For VMware documentation, it’s really good.
*** UPDATE ***

I love the simplicity of the vCenter Server Appliance and the VMware Identity Appliance for vCAC, but neither offer a high availability option better than vSphere HA. There are use cases where you’d need your SSO service to offer better uptime and resilience. In addition, there is some SSL certificates to be configured and for that, we’ll follow the instructions in KB2034833,  KB2061934 and KB2034181.

Notes, caveats, warnings
AFAIK, this will only work with vSphere 5.5. v5.1 handles SSO differently. I’m only using two nodes, if you have more, there will be extra steps. I do not have intermediate CAs, if you do, consult the KBs for the additional steps. I’m going to use a vCloud Networking and Security Edge Gateway as my load-balancer.  It does not offer SSL offload like some other load-balancers do, so you may have to take extra steps to configure SSL offload.

Here's what I have in mind; load-balanced SSO Servers
Here’s what I have in mind; load-balanced SSO Servers

Reserve the IP addresses for your actual SSO servers, plus the Virtual IP address.
Add A or CNAME records to your DNS for the SSO servers and the virtual IP.
The DNS name of the virtual IP is what the SSL certificate must match (vcsso in my case)
You should have an edge gateway already configured with an interface in the same networks as your virtual IP and actual SSO servers.

First SSO Server

I’m starting with two freshly deployed Windows Server 2008 R2 VMs, joined to the domain and named vcsso1 and vcsso2.  On vcsso1, install the Single Sign-on service.  Be sure the prerequisites are all ok.

vCenter SSO Prereqs

On the deployment mode step, choose “vCenter Single Sign-On for your first vCenter Server” First SSO Server

Next,next,finish your way through the installation. You’ve set up an SSO server, YAY!

Second SSO Server

On the second server, vcsso, also install the SSO service.  We’re going to make a few different selections than we did on vcsso1 though.  On the deployment mode step, here we’re going to select “vCenter Single Sign-On for an additional vCenter Server in an existing site”.Second SSO


Next, we’re prompted for information about the first, or partner, SSO server.  SSO Partner


We have to confirm that the information obtained from the first SSO server is correct, so click Continue.Certificate Verification

Then we select the site name configured on the first SSO server.  I named mine “Lab”, but you can leave yours as “Default-First-Site” or whatever makes sense for your environment. Select Site Name


From here, you’ll Next,Next,Finish your way to completion.

Generating the Cert
Prerequisites: Either the VMware ssl-certificate-updater-tool or OpenSSL Win32 v0.9.8

  1. Log on to the first SSO server (vcsso1), extract the VMware SSL certificate updater tool to C:\ssltool or similar.  Create folders named “C:\certs\sso“.  Open notepad and paste the following:

    [ req ]
    default_bits = 2048
    default_keyfile = rui.key
    distinguished_name = req_distinguished_name
    encrypt_key = no
    prompt = no
    string_mask = nombstr
    req_extensions = v3_req

    [ v3_req ]
    basicConstraints = CA:FALSE
    keyUsage = digitalSignature, keyEncipherment, dataEncipherment
    extendedKeyUsage = serverAuth, clientAuth
    subjectAltName = DNS:ServerShortName, IP:ServerIPAddress,, DNS:ServerIPAddress

    [ req_distinguished_name ]
    countryName = Country
    stateOrProvinceName = State
    localityName = City
    0.organizationName = Company Name
    organizationalUnitName = vCenterSSO
    commonName =
  2. Replace the values in red with those appropriate for your environment. Be sure to specify the server name and IP address as the Virtual IP and its associated DNS record. Save the file as c:\certs\sso\sso.cfg
  3. At a command prompt, navigate to the folder containing openssl.exe (eg: C:\ssltool\tools\openssl). Run this command to create the key and certificate site request (CSR):

    openssl req -new -nodes -out c:\certs\sso\rui.csr -keyout c:\certs\sso\rui-orig.key -config c:\certs\sso\sso.cfg

    Generate CSR
    Generate CSR
  4. In the same command prompt, run this to change the key to the necessary type.

    openssl rsa -in c:\certs\sso\rui-orig.key -out c:\certs\sso\rui.key

  5. Follow the steps in KB2062108 to create the appropriate certificate template in you Active Directory Certificate Authority.
  6. Log into the Microsoft CA certificate authority Web interface. By default, it is http://servername/CertSrv/.
  7. Click the Request a certificate link.Click advanced certificate request.
  8. Click the Submit a certificate request by using a base-64-encoded CMC or PKCS #10 file, or submit a renewal request by using a base-64-encoded PKCS #7 file link.
  9. Open the certificate request (rui.csr) in notepad. Copy the content between —–BEGIN CERTIFICATE REQUEST—– and —–END CERTIFICATE REQUEST—–
  10. Paste the copied content into the “Base-64-encoded certificate request” textarea. Select VMware Certificate as the Certificate Template. See KB2062108 if you don’t have the “VMware Certificate” template
  11. Click Submit to submit the request.
  12. Click Base 64 encoded on the Certificate issued screen. Click the Download Certificate Chain link.
  13. Save the package as C:\certs\certnew.p7b.
  14. Double-click the p7b to open it in certmgr.  Navigate to Certificates – Current User\C:\Certs\Certnew.p7b\Certificates.

    Certs in P7b
    Certs in P7b
  15. You’ll see two certificates here (unless you have intermediate certificates, then you’ll have more).
  16.  Right-click the one for the SSO server, choose All Tasks|Export.  Save the file as Base-64 encoded X.509 (.CER) to c:\certs\sso\rui.crt
  17. Right-click the one for root CA server, choose All Tasks|Export.  Save the file as Base-64 encoded X.509 (.CER) to c:\certs\root.cer ..  Close certmgr.
  18. Generate the pfx by running this command:

    openssl pkcs12 -export -in c:\certs\sso\rui.crt -inkey c:\certs\sso\rui.key -certfile c:\certs\Root64.cer -name "ssoserver" -passout pass:changeme -out c:\certs\sso\ssoserver.p12

    Note: The certificate store password must be changeme and the key alias must be ssoserver. Do not change these parameters.

Install and Configure the Certificate

  1. While logged on to the first SSO server (vcsso1) as an administrator, make sure this folder exists: C:\Program Files\Common Files\VMware vCenter Server – Java Components If it doesn’t, you’ll need to check your SSO installation
  2. Open an elevated command prompt (as administrator) and enter the following

    SET JAVA_HOME=C:\Program Files\Common Files\VMware vCenter Server - Java Components
    SET PATH=%PATH%;C:\Program Files\VMware\Infrastructure\VMware\CIS\vmware-sso;%JAVA_HOME%\bin

  3. In the command prompt, cd to the folder containing openssl.exe (eg: C:\ssltool\tools\openssl)
  4. Generate a subject hash from the certificate using this command:

    openssl x509 -subject_hash -noout -in c:\certs\root.cer

    This will return an 8-character hash. Record it, we’ll need it later

  5. On both SSO servers, create the folder C:\ProgramData\VMware\SSL
  6. On both SSO servers, copy c:\certs\root.cer to C:\ProgramData\VMware\SSL renaming it to ca_certificates.crt
  7. On both SSO servers, copy c:\certs\root.cer to C:\ProgramData\VMware\SSL again, this time renaming it to <subjecthash>.0 (replacing <subjecthash> with your hash value from above and appending dot zero)
  8. Just on the first SSO server, paste the following into a text file named c:\certs\ Replace the red text with appropriate values.

    friendlyName=The group check interface of the SSO server
    description=The group check interface of the SSO server


  9. Paste the following into a text file named c:\certs\ Replace the red text with appropriate values.

    friendlyName=The administrative interface of the SSO server
    description=The administrative interface of the SSO server


  10. Paste the following into a text file named c:\certs\ Replace the red text with appropriate values.

    friendlyName=STS for Single Sign On
    description=The Security Token Service of the Single Sign On server.


  11. Next, we need the service ID for each of the three services SSO uses. To get these, run the following command, replacing the red text with the FQDN to your first SSO server:

    ssolscli.cmd listServices https://vcsso1.domain.local:7444/lookupservice/sdk

    SSO Services
    SSO Services
  12. The service ID for each service should be saved to a file. Use quickedit to copy the service id for each and echo it to a file:

    Echo service ID to files
    Echo service ID to files
  13. Update the Group Check service:

    ssolscli updateService -d -u SSO_administrator -p password -si c:\certs\gc_id -ip c:\certs\

  14. Update the Admin service:

    ssolscli updateService -d -u SSO_administrator -p password -si c:\certs\admin_id -ip c:\certs\

  15. Update the STS service:

    ssolscli updateService -d -u SSO_administrator -p password -si c:\certs\sts_id -ip c:\certs\

  16. Copy the new SSL files to C:\ProgramData\VMware\CIS\runtime\VMwareSTS\conf on both/all SSO servers:

    copy C:\certs\SSO\ssoserver.p12 C:\ProgramData\VMware\CIS\runtime\VMwareSTS\conf\ssoserver.p12
    copy C:\certs\Root.cer C:\ProgramData\VMware\CIS\runtime\VMwareSTS\conf\ssoserver.crt
    copy C:\certs\SSO\rui.key C:\ProgramData\VMware\CIS\runtime\VMwareSTS\conf\ssoserver.key

  17. Stop and restart the VMware Secure Token Service on both servers

Preparing to load-balance

  1. Navigate to http://firstssoserver.domain.local:7444/sts/STSService/vsphere.local notice that the certificate gives an error, but look at the cert. The certificate should return the “common” name (in my case, “vcsso” instead of “vcsso1”. Repeat this for the second and subsequent SSO servers, verifying that they provide the same certificate
  2. Using vCNS Manager, locate the appropriate edge gateway, click Actions|Manage to open it for editing
  3. On the Configure Tab, edit the interface that will listen on the virtual IP
  4. Edit the Subnet and add the Virtual IP. It’s probably not the primary IP. Save and publish those changes

    Add the virtual IP to the Edge Gateay
    Add the virtual IP to the Edge Gateay
  5. On the Load Balancer tab, on the Pools page, click “Enable”, then “Publish Changes”Enable Load Balancer
  6. Click the green plus to add a load-balancing pool
  7. Enter a recognizable Name and Description, click “Next”LB2-AddPool1
  8. On the Services step, check HTTPS, set Balancing Method to “ROUND_ROBIN” and the Port to 7444. Clck “Next”LB2-AddPool2
  9. On the Health Check step, set it as shown. Click “Next” when done.LB2-AddPool3-HealthCheck
  10. On the members step, click the green plus to add the IP address of you SSO servers to the pool. I suggest keeping the weifght for each at 1, unless you have a reason to send more requests to specific nodes. Keep the HTTPS port and Monitor Port at 7444 for each. Click “Next” once all you members are added.LB2-AddPool4-Members
  11. Review the Ready to complete step and click “Finish” if it all correct
  12. Click the Publish Changes Button before proceeding
  13. Click the “Virtual Servers” link, then the green plus to add a Virtual Server
  14. Enter a meaningful name and description, provide the Virtual IP adddress that you added to the edge earlier, select the Pool created in the steps above and Enable HTTPS on port 7444. Set the Persistence Method to SSL_SESSION_ID and make the “Enabled” box is checked. Click “Add” then “Publish Changes”LB2-AddVirtualServer
  15. Test by navigating to https://ssovirtual.domain.local:7444/lookupservice/sdk and https://ssovirtual.domain.local:7444/sts/STSService/vpshere.local verifying that the certificates match.
  16. YAY, load-balanced SSO with matching SSL certs!

One more thing….

Using your favorite web browser, navigate to http://ssovirtual.domain.local:7444/websso/SAML2/Metadata/vsphere.local you’ll be prompted to download and save an XML file named Now open the XML file in notepad or Notepad++.  First, make sure you received a readable XML file.  Second, noticed that the EntitiesDescriptor/EntityDescriptor entityID property is server-specific.  We’ll need both servers to respond with the same information.

<EntitiesDescriptor xmlns="urn:oasis:names:tc:SAML:2.0:metadata" xmlns:saml="urn:oasis:names:tc:SAML:2.0:assertion" xmlns:vmes="" Name="vsphere.local" validUntil="2014-08-12T23:54:04Z">
<vmes:ExportedBy>Exported by VMware Identity Server (c) 2012</vmes:ExportedBy>
<EntityDescriptor entityID="https://VCSSO1.domain.local:7444/websso/SAML2/Metadata/vsphere.local">
<IDPSSODescriptor WantAuthnRequestsSigned="false" protocolSupportEnumeration="urn:oasis:names:tc:SAML:2.0:protocol">
<KeyDescriptor xmlns:ds="" use="signing">

Warning This is not in a VMware KB, and may not be best way to do it. Having the value in the EntitiesDescriptor/EntityDescriptor entityID property match the FQDN is going to be very important in the near future. Trust me.

  1. On each server, open C:\ProgramData\VMware\CIS\cfg\vmware-sso\hostname.txt. It only contains the resolved hostname, so update it to the virtual hostname (vcsso.ragaazzi.lab in my case) save the file
  2. Retrieve the XML file from http://ssovirtual.domain.local:7444/websso/SAML2/Metadata/vsphere.local again open it and confirm that it contains the virtual hostname

This was such a lengthy post, I considered breaking it up, but there was no good break-point. Thanks for sticking with it. This is mostly for my own benefit, hopefully you’ll find it helpful too.

vCloud Suite 5.1 upgrade suggestions

This information will probably be outdated quickly, but for now (9/14/2012), here are my suggestions and tips concerning vCloud Suite 5.1

  • If you plan to use Microsoft SQL Server for your SSO database, update the service configuration to listen on a static port.  vCenter Server and VUM use the .NET native SQL client, so they can deal with dynamic TCP ports on the SQL service, but SSO uses the Java SQL driver, which will require a static port (TCP 1433 by default)
  • Many administrators have had problems logging into their vCenter Server after installing SSO and upgrading vCenter Server to 5.1.  It appears that if the vCenter Server is a member of the domain, it may still try to use local credentials as the initial/default SSO source.  If your vCenter Server is a member of an Active Directory domain, be sure to locate/create a local admin account before upgrading vCenter Server to 5.1 so you can log on if you are affected by this issue
  • If you are running EMC Powerpath/VE on your ESXi hosts, do NOT upgrade to ESXi 5.1 yet.  The version of Powerpath/VE that works with ESXi 5.1 has not yet been released.
  • Despite the naming similarities, VMware View 5.1 is not compatible with vSphere 5.1.  Do not yet upgrade to vSphere 5.1 in your View environment.
  • The vCloud API for vCloud Director 5.1 is different from the API for vCloud Director 1.5.1.  If you have developed anything that consumes the vCloud API, you will probably have to make significant changes.  If you have vCO packages/workflows that use the vCloud API, you may be affected and should upgrade vCO and vCloud in a lab/test environment where you can update the objects appropriately first.
  • There is a new version of the Cisco Nexus 1000V for vSphere 5.1 that should be factored into your upgrade plan if your environment uses that component.
  • In vCenter Server 2.5-4.0, host passwords are encrypted in the database using an encryption key of 512-to-1024 bits. However, in 5.1, the encryption key must be 2048 bits. If it is not, the vCenter Services may not start. Check this KB article to see how to check and correct this issue.