vCenter Installation, and SSO Configuration
vCenter is a powerfull tool, and is critical in its role of clustering ESXi hosts, from VMware into one group allowing central management, SSO, permissions control, backups, and migrations along with much more functionality from a single web portal.
Before installing vCenter you will need to have your vCenter .iso file, or disk mounted to the system you use for management, on the same network as the device. Additionally you will want to make any DNS records you plan on using.
-
First Verify connection, and resolution to your AD controller, by pining it by name, and IP to verify it is working properly.
-
Now open the VSCA .iso directory, via cli, from your management device, and enter the /media/vsca-ui-installer/ directory, then move to the folder based on your guest OS.
- Now run the "Installer" file in that directory, to launch the Ui vCenter installer, where you will be greeted with this window.
- Click Install, Then next, Then accept the the EULA
- Once you reach the following page, enter the FQDN or IP of the ESXI server, then the login credentials for it, and click "Next", and Accept the Certificate warning. This is warning the user that the ESXI host selected is using a self signed cert. This is not an issue in most environments, but should be addressed for large production environments.
- Once those settings are validated, and the ESXI system has been connected to the installer, then you must configure a VM name, and root password for the vCenter "Vm", as it will act on the ESXI host.
- Next Pick the size of the deployment, this is entirely up to the size of the environment, and the resources available. Here I picked "Small".
- Then you must pick the datastore, on the host esxi server, that will hold the vCenter VM
- Finally configure the network settings to be used by the vCenter instance. Here I used a reserved address for the server, the gateway was my PFSense router IP, and the DNS server was my Domain Controller.
- Click next, to review your settings, and then finish to install vCenter, and complete Stage 1. This will take some time
Now that the server has been provisioned we must complete setup.
- First we will be greeted by that original start page for the UI. Stage 2 will no longer be greyed out, and Stage one should have a green check indicating completion. Click Next
-
Configure the NTP server settings to be used for the vCenter server. I recommend configuring a server, and not using system time, to prevent desync issues between ESXI Host's, vCenter, and the AD Controller once SSO is enabled. I used pool.ntp.org
-
Next use "Create a new SSO domain" for now to create a local domain, so that we can have multiple accounts, even if SSO stops working.
- Finally decline the CEIP setup, and make sure to uncheck the CEIP box;
- Finally Verify your settings, and hit finish, again this will take some time.
Here we now have a completed vCenter install, and we are going to add our ESXI host, and add our licensing information
- Connect the the vcenter server using the IP set in Stage 1, or a FQDN set on the AD server, and click Launch Vsphere Client.
- Sign in with the "administrator@vsphere.local" account created in stage 2 of the vCenter installation. After that you will be greeted with the dashboard.
- Now add your license by going to the 3 bars at the top left, Then click "administration"
- Now on the left, click "Licenses"
- Now click add, and enter each license key, one per line, then click next, set names, and then apply them.
-
Finally go to the assets tab, and apply the vCenter license.
-
Now we are going to add out host. To do this first we must go to our menu in the top left, then right click the vCenter domain, the New data center, and name it. Here i used SYS350
- Once the data-center is created, now we will right click it and select "add Host"
- Now enter the IP or FQDN of the device. Note: This IP/Name will dictate the name of the host in the inventory tab, and cannot be changed without orphaning and rejoining the host
- Click next, and enter the login information for the host, and click next
-
Now accept the Security alert, and click next, then next again for host settings.
-
Then assign a ESXI License, and click Next
-
Leave lock down disabled, then select your new cluster for the location, and then click Complete.\
- Now your host is joined to vCenter, and you should see it, and any VM's it was hosting on the left panel, under the data center.
Here we will connect our domain, to the vCenter server, to allow Domain admins to access the vCenter environment accordingly.
- First go to the menu at the top left again, and then click administration, then under "Single Sign On" select configuration
- Then select "Active Directory Domain"
-
Then click "join AD" and enter your domains information, including the credentials of a domain admin. once this in completed you must reboot vCenter
-
To reboot vCenter, login to the vCenter management page via "https://domainname.local:5480" Then enter your administrator@vsphere.local credentials. After login you will be greeted with the vCenter dash panel
-
Next at the top right, click "Actions" and then reboot. This will take some time, and this dash will recover before the main login will.
-
After the reboot, login to the VSphere client page, not the dashboard, and go to the SSO Users and Groups page
- Now navigate to "Groups", then click "Administrators"
- Now click "Add Members", switch the domain to your newly joined domain, and search "Domain Admins" adding it to the box below. Then click Save.
- Finally to make the domain you selected the default choice, click on "Identity Sources" then your domain entry, and click "Set as Default". This will make you only have to use the domain user's logon name, not the full domain string.
Now we are complete, you can logout of your administrator@vsphere.local user and log in using your domain admin account.