VMware Cloud Foundation (VCF) 9.1 Single Sign-On (SSO) not only provides a unified login experience across all VCF components, but it also enables organizations to easily add multi-factor authentication (MFA) to protect their VCF infrastructure using modern identity providers that support OIDC or SAML 2.0.
Another benefit of configuring VCF SSO in 9.1 is the ability to create and use VCF SSO API Tokens for automation purposes. Rather than hardcoding passwords in scripts, API Tokens provide a more secure authentication mechanism and can be centrally managed and revoked whenever needed.
Once VCF SSO has been configured, you can easily generate a new VCF SSO API Token from the UI of any VCF component by right-clicking on your username and select Generate API Token.
You will be taken to the configured VCF Identity Broker UI that is running within your VCF Management Services (VCFMS) where you will be able to create and manage your VCF SSO API Tokens as shown in the screenshot below.
My colleague David Zhang has written a fantastic blog series that covers how to use VCF SSO API Tokens across the various VCF components, highly recommend a read:
- VCF SSO API Tokens with vCenter Server 9.1
- VCF SSO API Tokens with NSX Manager 9.1
- VCF SSO API Tokens with VCF Operations 9.1
- VCF SSO API Tokens with VCF Automation 9.1
Since vCenter Server is one of the most common VCF components that administrators automate, especially using PowerShell, I thought it would be useful to provide a single PowerShell script that demonstrates the complete authentication workflow, from a VCF SSO API Token > Identity Broker Access Token > vCenter Server SAML Token > vCenter Server Session Client that can be used to invoke the vCenter Server REST APIs.
You can download the vcenter91_idb_api_token_client.ps1 PowerShell script and update the three required variables: Identity Broker FQDN, VCF SSO API Token and vCenter Server FQDN and when successfully invoked, it will call the GET /vcenter/host API to list all ESX hosts to validate that VCF API Token is functional.
For PowerCLI users, consuming a VCF SSO API Token is even easier! The Connect-VIServer cmdlet now includes a -VcfApiToken parameter that accepts a VCF SSO API Token directly, automatically handling the backend token conversion and authenticating you to vCenter Server by running the following:
IDB_TOKEN="FILL_ME_IN" Connect-VIServer -Server vc01.vcf.lab -VcfApiToken $IDB_TOKEN
Thanks for the comment!