When you log in to an ESXi host by using the VMware Host Client, you can check whether active directory and smart card authentication are enabled, and you can also join the host to a directory service domain.

Join an ESXi Host to a Directory Service Domain by Using the VMware Host Client

To use a directory service for your host, you must join the host to the directory service domain.

You can enter the domain name in one of two ways:

  • name.tld (for example, domain.com): The account is created under the default container.
  • name.tld/container/path (for example, domain.com/OU1/OU2): The account is created under a particular organizational unit (OU).

To use the vSphere Authentication Proxy service, see vSphere Security.

Procedure

  1. Click Manage in the VMware Host Client inventory and click Security & Users.
  2. Click Authentication and click Join domain.
  3. Enter a domain name.

    Use the form name.tld or name.tld/container/path.

  4. Enter the user name and password of a directory service user account that has permissions to join the host to the domain and click Join domain.
  5. (Optional) If you intend to use an authentication proxy, enter the proxy server IP address and click Join domain.

Using Active Directory to Manage ESXi Users

You can configure ESXi to use a directory service such as Active Directory to manage users.

Creating local user accounts on each host presents challenges with having to synchronize account names and passwords across multiple hosts. Join ESXi hosts to an Active Directory domain to eliminate the need to create and maintain local user accounts. Using Active Directory for user authentication simplifies the ESXi host configuration and reduces the risk for configuration issues that could lead to unauthorized access.

When you use Active Directory, users supply their Active Directory credentials and the domain name of the Active Directory server when adding a host to a domain.

Using vSphere Authentication Proxy

You can add ESXi hosts to an Active Directory domain by using vSphere Authentication Proxy instead of adding the hosts explicitly to the Active Directory domain.

You only have to set up the host so it knows about the domain name of the Active Directory server and about the IP address of vSphere Authentication Proxy. When vSphere Authentication Proxy is enabled, it automatically adds hosts that are being provisioned with Auto Deploy to the Active Directory domain. You can also use vSphere Authentication Proxy with hosts that are not provisioned by using Auto Deploy.

See the vSphere Security documentation for information about enabling vSphere Authentication Proxy and which vCenter Server ports vSphere Authentication Proxy requires.

Auto Deploy
If you are provisioning hosts with Auto Deploy, you can set up a reference host that points to Authentication Proxy. You then set up a rule that applies the reference host's profile to any ESXi host that is provisioned with Auto Deploy. vSphere Authentication Proxy stores the IP addresses of all hosts that Auto Deploy provisions using PXE in its access control list. When the host boots, it contacts vSphere Authentication Proxy, and vSphere Authentication Proxy joins those hosts, which are already in its access control list, to the Active Directory domain.
Even if you use vSphere Authentication Proxy in an environment that uses certificates that are provisioned by VMCA or third-party certificates, the process works seamlessly if you follow the instructions for using custom certificates with Auto Deploy.
Other ESXi Hosts
You can set up other hosts to use vSphere Authentication Proxy if you want to make it possible for the host to join the domain without using Active Directory credentials. That means you do not need to transmit Active Directory credentials to the host, and you do not save Active Directory credentials in the host profile.
In that case, you add the host's IP address to the vSphere Authentication Proxy access control list, and vSphere Authentication Proxy authorizes the host based on its IP address by default. You can enable client authentication to have vSphere Authentication Proxy check the host's certificate.
Note: You cannot use vSphere Authentication Proxy in an environment that supports only IPv6.