The Active Directory over LDAP identity source is preferred over the Active Directory (Integrated Windows Authentication) option. The OpenLDAP Server identity source is available for environments that use OpenLDAP.

If you are configuring an OpenLDAP identity source, see the VMware knowledge base article at https://kb.vmware.com/s/article/2064977 for additional requirements.

Important: Groups in AD-over-LDAP identity sources cannot use users in different domains even if you create an additional identity source for each domain.

Groups in LDAP identity sources only recognize those users that exist in the specified user base DN. This can lead to unexpected problems in large Active Directory environments with child domains. For example, consider the following scenario:

  1. An Active Directory forest with two child domains, ChildA and ChildB.
  2. A vCenter Server configured with two AD-over-LDAP identity sources, one for child domain ChildA and one for child domain ChildB.
  3. ChildA contains two users named UserA1 and UserA2.
  4. ChildB contains two users named UserB1 and UserB2.

The vCenter Server administrator creates a group in ChildA named TestGroup that contains UserA1, UserA2, UserB1, and UserB2. The vCenter Server administrator grants login (or any) privileges to TestGroup. Unfortunately, UserB1 and UserB2 cannot log in because they reside in a different domain than the group.

As a workaround, perform the following:

  1. Create another group named SecondTestGroup in ChildB.
  2. Remove UserB1 and UserB2 from TestGroup.
  3. Add UserB1 and UserB2 to SecondTestGroup.
  4. In vCenter Server, assign SecondTestGroup the same privileges that were granted to TestGroup.
Note: Microsoft Windows has changed the default behavior of Active Directory to require strong authentication and encryption. This change impacts how vCenter Server authenticates to Active Directory. If you use Active Directory as your identity source for vCenter Server, you must enable LDAPS. For more information about this Microsoft security update, see https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV190023 and https://blogs.vmware.com/vsphere/2020/01/microsoft-ldap-vsphere-channel-binding-signing-adv190023.html.
Table 1. Active Directory over LDAP and OpenLDAP Server Settings
Option Description
Name Name of the identity source.
Base DN for users Base Distinguished Name for users. Enter the DN from which to start user searches. For example, cn=Users,dc=myCorp,dc=com.
Base DN for groups The Base Distinguished Name for groups. Enter the DN from which to start group searches. For example, cn=Groups,dc=myCorp,dc=com.
Domain name The FQDN of the domain.
Domain alias For Active Directory identity sources, the domain's NetBIOS name. Add the NetBIOS name of the Active Directory domain as an alias of the identity source if you are using SSPI authentications.

For OpenLDAP identity sources, the domain name in capital letters is added if you do not specify an alias.

User name ID of a user in the domain who has a minimum of read-only access to Base DN for users and groups. The ID can be in any of these formats: The user name must be fully-qualified. An entry of "user" does not work.
Password Password of the user who is specified by Username.
Connect to Domain controller to connect to. Can be any domain controller in the domain, or specific controllers.
Primary Server URL Primary domain controller LDAP server for the domain. You can use either the host name or the IP address.

Use the format ldap://hostname_or_IPaddress:port or ldaps://hostname_or_IPaddress:port. The port is typically 389 for LDAP connections and 636 for LDAPS connections. For Active Directory multi-domain controller deployments, the port is typically 3268 for LDAP and 3269 for LDAPS.

A certificate that establishes trust for the LDAPS endpoint of the Active Directory server is required when you use ldaps:// in the primary or the secondary LDAP URL.

Secondary server URL Address of a secondary domain controller LDAP server that is used when the primary domain controller is unavailable. You can use either the host name or the IP address. For every LDAP operation, vCenter Server always tries the primary domain controller before falling back to the secondary domain controller. This can lead to Active Directory logins taking some time, and even failing, when the primary domain controller is unavailable.
Note: When the primary domain controller fails, the secondary domain controller might not take over automatically.
Certificates (for LDAPS) If you want to use LDAPS with your Active Directory LDAP Server or OpenLDAP Server identity source, click Browse to select a certificate that was exported from the domain controller specified in the LDAPS URL. (Note that the certificate used here is not a root CA certificate.) To export the certificate from Active Directory, consult the Microsoft documentation.

You can browse for and select multiple certificates.

Tip: When browsing for and selecting multiple certificates, they must be located in the same directory.

vCenter Server only trusts certificates directly signed by a registered and trusted certificate authority. vCenter Server does not trace a path up to a registered CA certificate and only checks if the certificate is signed by a registered and trusted certificate authority. As long as your certificate is signed by a publicly trusted certificate authority, or is self-signed, no further action is necessary. However, if you create your own internal certificates (that is, you use a private certificate authority), you might need to include those certificates. For example, if your organization uses Microsoft Enterprise Root Certificate Authority to generate the LDAPS certificate, you must also select the Enterprise Root Certificate to add it to vCenter Server. In addition, if you use intermediate certificate authorities between the LDAPS certificate and the Enterprise Root certificate, you must also select those intermediate certificates to add them to vCenter Server.