If you select the Active Directory (Integrated Windows Authentication) identity source type, you can use the local machine account as your SPN (Service Principal Name) or specify an SPN explicitly. You can use this option only if the vCenter Single Sign-On server is joined to an Active Directory domain.

Prerequisites for Using an Active Directory Identity Source

You can set up vCenter Single Sign-On to use an Active Directory identity source only if that identity source is available.
  • For a Windows installation, join the Windows machine to the Active Directory domain.
  • For a vCenter Server Appliance, follow the instructions in the vCenter Server Appliance Configuration documentation.
Note: Active Directory (Integrated Windows Authentication) always uses the root of the Active Directory domain forest. To configure your Integrated Windows Authentication identity source with a child domain within your Active Directory forest, see VMware Knowledge Base article 2070433.

Select Use machine account to speed up configuration. If you expect to rename the local machine on which vCenter Single Sign-On runs, specifying an SPN explicitly is preferable.

Note: In vSphere 5.5, vCenter Single Sign-On uses the machine account even if you specify the SPN. See VMware Knowledge Base article 2087978.

Table 1. Add Identity Source Settings
Text Box Description
Domain name FQDN of the domain name, for example, mydomain.com. Do not provide an IP address. This domain name must be DNS-resolvable by the vCenter Server system. If you are using a vCenter Server Appliance, use the information on configuring network settings to update the DNS server settings.
Use machine account Select this option to use the local machine account as the SPN. When you select this option, you specify only the domain name. Do not select this option if you expect to rename this machine.
Use Service Principal Name (SPN) Select this option if you expect to rename the local machine. You must specify an SPN, a user who can authenticate with the identity source, and a password for the user.
Service Principal Name (SPN) SPN that helps Kerberos to identify the Active Directory service. Include the domain in the name, for example, STS/example.com.

The SPN must be unique across the domain. Running setspn -S checks that no duplicate is created. See the Microsoft documentation for information on setspn.

User Principal Name (UPN)

Password

Name and password of a user who can authenticate with this identity source. Use the email address format, for example, [email protected]. You can verify the User Principal Name with the Active Directory Service Interfaces Editor (ADSI Edit).