LDAPS Identity Source for VMware vCenter Single Sign On 5.1

Once you are done with installation of VMware vCenter 5.1; you will notice that vSphere 5.1 client wont let you login into your vCenter Server. Either you will need to configure a local admin ID on your vCenter Server or if you have an active directory (AD) running in your environment; you will need to link that to your vCenter Server i.e. by configuring an identity source.

During installation of vCenter Single Sign On 5.1; it tries to add the identity source but in my case resulted in error (Error 29155.Identity source discovery error). I then found out its the case with other users as well and also was pointed out in VMware in their KB articles. The workaround for the issue given was to add the identity source manually. Doing so I got the following errors.

[LDAP: error code 8 – 00002028: LdapErr: DSID-0C0901FC, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v1db1]

and

simple bind failed:yourdomain:636

These errors are due to the fact that your AD is configured to communicate over LDAPS SSL connection. Hence to register your identity source; you will need the X.509 certificate of your AD domain controller (DC). For that export the certificate of your AD but make sure its the Base-64 X509 Certificate.

Once imported; again add the identity source as demonstrated below.

Once you chose the certificate from Choose Certificate tab; make sure you get the following confirmation. If not there must be something wrong with your certificate.

You can click on Test Connection to verify your AD connectivity.

If you are still facing problems in adding the identity source; make sure of he following things:

• Your vCenter, vSphere, vSphere Web Client, vCenter SSO etc must all be installed in the same default directories.
• Do add the port 3269 with your FQDN.
• There must a proper forward and reverse pointer entry on your DNS for your vCenter Server.
• Enter the complete user name for authentication e.g. user@domain.com
• If your domain controller is behind a firewall; make sure you have configured a policy to allow vCenter traffic.

Tags: active directory, AD, AD LDAP, Base-64 X509 Certificate, certificate for vcenter, error 29155, identity source, Identity source discovery error, identity source error, LDAP identity source, LDAP: error code 8 - 00002028, LDAPS, LDAPS identity source, LDAPS SSL, Microsoft, Pakistan, simple bind failed, single sign on, SSO, vCenter, vCenter 5.1, vcenter single sign on 5.1, vcenter sso 5.1, Virtualization, VMware, Windows, windows server 2008 R2, X509, X509 Certificate