vCenter Single Sign-On
VMware vCenter™ Single Sign-On is a critical component of the vCenter Server environment because it provides
secure authentication services to many of the vSphere components. vCenter Single Sign-On constructs an
internal security domain (vsphere.local) where vSphere solutions and components are registered during
installation or upgrade, providing an infrastructure resource. vCenter Single Sign-On can authenticate users
from its own internal users and groups, or it can connect to trusted external directory services such as
Microsoft’s Active Directory. Authenticated users are then ready for assignment of registered solution-based
permissions and/or roles within a vSphere 5.5 environment.
In the past, vCenter Single Sign-On was complex to deploy and manage and this complexity was a key issue to
address with the latest release. vCenter Single Sign-On 5.5 offers greatly improved integration of external
directory services and is deployed with a simplified architecture. Multiple vCenter Single Sign-On instances can
be placed into the same vsphere.local security domain, which can span geographies and can be synchronized
automatically with built-in replication.
vCenter Single Sign-On is implemented as a Tomcat server container providing a Security Token Service for
successful authentications and an internal LDAP directory service for the storing and replication of its
configuration and embedded users and groups that have been defined. vCenter Single Sign-On uses Kerberos to
communicate and installs several technology dependencies to support this.