WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud
  • Tanzu
    • Application Modernization
    • Tanzu services
    • Tanzu Community Edition
    • Tanzu Kubernetes Grid
    • vSphere with Tanzu
  • Home Lab
  • Nested Virtualization
  • Apple
You are here: Home / Automation / Quick Tip - How to check password expiry for a specific vSphere SSO user?

Quick Tip - How to check password expiry for a specific vSphere SSO user?

06.04.2021 by William Lam // 1 Comment

The default password expiry for vSphere Single-Sign On (SSO) users within the vCenter Server Appliance (VCSA) is 90 days and this of course be changed to match your organizations policy. Although the vSphere UI can remind you right before your password expires, you may want to manually check or proactively inventory this information periodically.

To do so, you will need to SSH to the VCSA and use the dir-cli command with --level 2 option to get additional details for a given vSphere SSO user as shown in the example below:

/usr/lib/vmware-vmafd/bin/dir-cli user find-by-name --account william --level 2
Account: william
UPN: william[a]VSPHERE.LOCAL
Account disabled: FALSE
Account locked: FALSE
Password never expires: FALSE
Password expired: FALSE
Password expiry: 8916 day(s) 2 hour(s) 39 minute(s) 30 second(s)

In this particular environment, I have the vSphere SSO password expiry configured to 9000 days and as we can see for this user, there is ~8916 days left before the password expires.

For those looking to automate this, it looks like this is currently only possible using dir-cli but I have submitted a feature request to the recently released PowerCLI vSphere SSO Module to see if this information can also be included in the Get-SsoPersonUser cmdlet. If you need to retrieve the current configured vSphere SSO password expiry, you can use ldapsearch command within the VCSA or the Get-SsoPasswordPolicy cmdlet.

More from my site

  • vCenter Server 6.0 Tidbits Part 9: Creating & managing SSO users using dir-cli
  • PowerCLI Module for managing vCenter Single Sign-On (SSO)
  • Using PowerCLI to automate the retrieval of VCSA Password Policies
  • Enhanced vCenter Server Audit Event & Logging in vSphere 6.7 Update 2
  • Changing "Password will expire in X days" notification for Active Directory users in vSphere Web/H5 Client

Categories // Automation, vSphere Tags // dir-cli, sso

Comments

  1. Sravan Gannarapu says

    04/07/2022 at 8:06 am

    this article helped me to check the sso user password expiry status, is there any possibility to view the current password for the sso user.

    Reply

Thanks for the comment! Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search

Author

William Lam is a Senior Staff Solution Architect working in the VMware Cloud team within the Cloud Infrastructure Business Group (CIBG) at VMware. He focuses on Cloud Native, Automation, Integration and Operation for the VMware Cloud based Software Defined Datacenters (SDDC) across Private, Hybrid and Public Cloud

Connect

  • Email
  • GitHub
  • LinkedIn
  • RSS
  • Twitter
  • Vimeo

Recent

  • ESXi on ASUS PN64-E1 05/24/2023
  • vSphere Pods using VDS based Supervisor in vSphere with Tanzu? 05/23/2023
  • Frigate NVR with Coral TPU & iGPU passthrough using ESXi on Intel NUC 05/22/2023
  • 96GB SODIMM memory for DDR5 system with ESXi 05/18/2023
  • Refresher on Nested ESXi Networking Requirements 05/17/2023

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2023