WilliamLam.com

  • About
    • About
    • Privacy
  • VMware Cloud
  • Tanzu
    • Application Modernization
    • Tanzu services
    • Tanzu Community Edition
    • Tanzu Kubernetes Grid
    • vSphere with Tanzu
  • Home Lab
  • Nested Virtualization
  • Apple
You are here: Home / Automation / Quick Tip - How to check password expiry for a specific vSphere SSO user?

Quick Tip - How to check password expiry for a specific vSphere SSO user?

06.04.2021 by William Lam // 1 Comment

The default password expiry for vSphere Single-Sign On (SSO) users within the vCenter Server Appliance (VCSA) is 90 days and this of course be changed to match your organizations policy. Although the vSphere UI can remind you right before your password expires, you may want to manually check or proactively inventory this information periodically.

To do so, you will need to SSH to the VCSA and use the dir-cli command with --level 2 option to get additional details for a given vSphere SSO user as shown in the example below:

/usr/lib/vmware-vmafd/bin/dir-cli user find-by-name --account william --level 2
Account: william
UPN: william[a]VSPHERE.LOCAL
Account disabled: FALSE
Account locked: FALSE
Password never expires: FALSE
Password expired: FALSE
Password expiry: 8916 day(s) 2 hour(s) 39 minute(s) 30 second(s)

In this particular environment, I have the vSphere SSO password expiry configured to 9000 days and as we can see for this user, there is ~8916 days left before the password expires.

For those looking to automate this, it looks like this is currently only possible using dir-cli but I have submitted a feature request to the recently released PowerCLI vSphere SSO Module to see if this information can also be included in the Get-SsoPersonUser cmdlet. If you need to retrieve the current configured vSphere SSO password expiry, you can use ldapsearch command within the VCSA or the Get-SsoPasswordPolicy cmdlet.

More from my site

  • vCenter Server 6.0 Tidbits Part 9: Creating & managing SSO users using dir-cli
  • PowerCLI Module for managing vCenter Single Sign-On (SSO)
  • Using PowerCLI to automate the retrieval of VCSA Password Policies
  • Enhanced vCenter Server Audit Event & Logging in vSphere 6.7 Update 2
  • Changing "Password will expire in X days" notification for Active Directory users in vSphere Web/H5 Client

Categories // Automation, vSphere Tags // dir-cli, sso

Comments

  1. *protectedSravan Gannarapu says

    04/07/2022 at 8:06 am

    this article helped me to check the sso user password expiry status, is there any possibility to view the current password for the sso user.

    Reply

Thanks for the comment!Cancel reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Search

Author

William Lam is a Senior Staff Solution Architect working in the VMware Cloud team within the Cloud Infrastructure Business Group (CIBG) at VMware. He focuses on Cloud Native, Automation, Integration and Operation for the VMware Cloud based Software Defined Datacenters (SDDC) across Private, Hybrid and Public Cloud

Connect

  • Email
  • GitHub
  • LinkedIn
  • RSS
  • Twitter
  • Vimeo

Recent

  • vSphere Code Capture is your ChatGPT for vSphere Automation 11/30/2023
  • ESXi 8.0 Update 2 not detecting Apple NVMe on Apple Mac Mini 2018 11/28/2023
  • Is there a vSphere REST API for ... 11/21/2023
  • Custom vSAN HCL JSON for VMware Cloud Foundation (VCF) 5.1 and vSAN ESA using Nested ESXi 11/20/2023
  • Heads Up - Performance Impact with VMware Workstation on Windows 11 with Intel Hybrid CPUs 11/19/2023

Advertisment

Privacy & Cookies: This site uses cookies. By continuing to use this website, you agree to their use.
To find out more, including how to control cookies, see here: Cookie Policy

Copyright WilliamLam.com © 2023