As a system administrator or virtual infrastructure administrator, you use single sign-on to enable SSO users to log in securely to your vRealize Operations Manager environment.

About this task

After the single sign-on source is configured, users are redirected to an SSO identity source for authentication. When logged in, users can access other vSphere components such as the vCenter Server without having to log in again.

Prerequisites

  • Verify that the server system time of the single sign-on source and vRealize Operations Manager are synchronized. If you need to configure the Network Time Protocol (NTP), see vRealize Operations Manager Cluster and Node Maintenance.

  • Verify that you have access to a Platform Services Controller through the vCenter Server. See the VMware vSphere Information Center for more details.

Procedure

  1. Log in to vRealize Operations Manager as an administrator.
  2. Select Administration > Authentication Sources, and click the Add icon on the toolbar.
  3. In the Add Source for User and Group Import dialog box, provide information for the single sign-on source.

    Option

    Action

    Source Display Name

    Type a name for the import source.

    Source Type

    Verify that SSO SAML is displayed.

    Host

    Enter the IP address or FQDN of the host machine where the single sign-on server resides. If you enter the FQDN of the host machine, verify that every non-remote collector node in the vRealize Operations Manager cluster can resolve the single sign-on host FQDN.

    Port

    Set the port to the single sign-on server listening port. By default, the port is set to 443.

    User Name

    Enter the user name that can log into the SSO server.

    Password

    Enter the password.

    Grant administrator role to vRealize Operations Manager for future configuration?

    Select Yes so that the SSO source is reregistered automatically if you make changes to the vRealize Operations Manager setup. If you select No, and the vRealize Operations Manager setup is changed, single sign-on users will not be able to log in until you manually reregister the single sign-on source.

    Automatically redirect to vRealize Operations single sign-on URL?

    Select Yes to direct users to the vCenter single-sign on log in page. If you select No, users are not redirected to SSO for authentication. This option can be changed in the vRealize Operations Manager Global Settings.

    Import single sign-on user groups after adding the current source?

    Select Yes so that the wizard directs you to the Import User Groups page when you have completed the SSO source setup. If you want to import user accounts, or user groups at a later stage, select No.

    Advanced options

    If your environment uses a load balancer, enter the IP address of the load balancer.

  4. Click Test to test the source connection, and then click OK.

    The certificate details are displayed.

  5. Select the Accept this Certificate check box, and click OK.
  6. In the Import User Groups dialog box, import user accounts from an SSO server on another machine.

    Option

    Action

    Import From

    Select the single sign-on server you specified when you configured the single sign-on source.

    Domain Name

    Select the domain name from which you want to import user groups. If Active Directory is configured as the integrated Windows Authentication (WA) source in the Platform Services Controller (PSC), and you are importing user groups from an Active Directory tree, verify that the groups are not domain local groups. Domain local groups are only visible within a single domain, unless the domain is the one in which the PSC is configured. If Active Directory is configured as the LDAP source in the PSC, you can only import universal groups and domain local groups if the vCenter Server resides in the same domain.

    Result Limit

    Enter the number of results that are displayed when the search is conducted.

    Search Prefix

    Enter a prefix to use when searching for user groups.

  7. In the list of user groups displayed, select at least one user group, and click Next.
  8. In the Roles and Objects pane, select a role from the Select Role drop-down menu, and select the Assign this role to the group check box.
  9. Select the objects users of the group can access when holding this role.

    To assign permissions so that users can access all the objects in vRealize Operations Manager, select the Allow access to all objects in the system check box.

  10. Click OK.
  11. Familiarize yourself with single-sign on and confirm that you have configured the single sign-on source correctly.
    1. Log out of vRealize Operations Manager.
    2. Log in to the vSphere Web Client as one of the users in the user group you imported from the single sign-on server.
    3. In a new browser tab, enter the IP address of your vRealize Operations Manager environment.
    4. If the single sign-on server is configured correctly, you are logged in to vRealize Operations Manager without having to enter your user credentials.