Most organizations rely on a single Identity Provider (IdP) such as Symantec VIP AuthHub, Okta, Microsoft Entra ID, or PingFederate to provide common identity and access management. However, for some organizations, managing multiple IdPs is just the reality, often due to organizational structure or mergers and acquisitions (M&A).
The new VCF 9.0 Single Sign-On (SSO) has a flexible architecture that can benefit organizations with either a single IdP or multiple IdPs, while still providing the SSO capability. The component that is responsible for providing VCF SSO is called the VCF Identity Broker (vIDB) and it has two deployment models, one of which can aide in the multi-IdP requirement.
VCF SSO is configured on a per-VCF Instance and by leveraging the built-in Embedded vIDB from within the vCenter Server Appliance (VCSA), we can configure VCF SSO using the VCSA within the VCF Management Domain to enable the different IdPs within each VCF Instance as illustrated in the diagram below:
While this may not be a common scenario for most customers, the good news is this just works out of the box without requiring any additional resources to be deployed.
For those with a single IdP and would like VCF SSO across multiple VCF Instances, you can streamline the configuration by deploying a single External vIDB instance which can then be used by multiple VCF Instances as illustrated in the diagram below:
Whether you have organizational requirements that mandate multiple IdPs or you would like to streamline a single IdP deployment, VCF 9.0 can support either or both!
Lastly, for those interested in playing with VCF SSO in a lab environment, but do not have access to an Enterprise IdP, you can check out this blog post using a self-hosted IdP called Keycloak.
In a multi instance fleet, can you point each instance to the same provider, adding a degree of resiliency in a multi region deployment? If you do, I’m assuming that you would have to configure your group import in each vIDB. Since it’s the same ops instance, would you still be able to do vCenter grouping? Then in a region failure, you are repointing Ops/Auto instead of restoring vIDB.
In this multiple IDB scenario, which IDB should I use for VCF OPS and Automation? Will I able to see the entire fleet from VCF OPS?
Amit - For your Fleet components (Ops & Automation), you'd use the IdB that is deployed automatically within the VCFMS Cluster for your initial VCF Instance that contains both your Ops/Automation instances. When you configure VCF SSO (which is what gives you the centralized visibility), you'll then pick those Fleet components. Hope that helps