WilliamLam.com

vCenter Server Identity Federation with Keycloak Identity Provider without SCIM

by // 3 Comments

After publishing my recent article about using Authentik as an Identity Provider (IdP) for vCenter Server, which I have recieved a lot of positive feedback both internally (including a small typo note from my VP 😅 ) and externally, I had several folks ask whether the same could also be accomplished with another popular open source IdP called Keycloak.

While I have not personally worked with Keycloak before, I know it is a popular identity provider solution for modern applications, especially within a Kubernetes environment. After getting Keycloak up and running, I found out that it does NOT have support for a System for Cross-domain Identity Management (SCIM) server, which is used to automatically synchronize your users and groups from your IdP to your clients, which would be vCenter Server in this case.

While there are a couple of 3rd party SCIM providers for Keycloak such as this one, they were either out of date or just did not work for me and after a few hours of troubleshooting, I eventually gave up. It certainly would have been nice to have SCIM server out of the box with a nice UX like Authentik.

I figured I was completely out of luck with using Keylock as an IdP for vCenter Server, because it needs to know about the users before you can assign vSphere Permissions. As a last resort, I pinged a few folks from our IdP team to see if there were any tricks I that I could leverage given the lack of SCIM server support. It turns out since vCenter Server uses the Identity Broker (vIDB) for Identity Federation, there is an option for manually publishing users into vIDB by leveraging its APIs! 🤩

Disclaimer: Keycloak is currently not an officially supported vCenter Server IdP, please use at your own risk.

[Read more...]

vCenter Server Identity Federation with Authentik Identity Provider

by // 1 Comment

While answering a recent question on the VMware Reddit Community, I came to learn about Authentik, an open source identity provider (IdP), which is pretty feature rich and best of all, you can self-host the Authentik IdP solution.

While Authentik is not one of the officially supported Identity Providers for vCenter Server Identity Federation such as Okta, Microsoft Entra ID, Microsoft ADFS or PingFederate, I was curious if it would to allow me to easily play with the Identity Federation feature in vCenter Server? 🤔

Hint: It works! 😁

Disclaimer: Authentik is currently not an officially supported vCenter Server IdP as mentioned earlier, please use at your own risk.

[Read more...]

VMware Cloud Foundation (VCF) Homelab Hardware Options

by // 7 Comments

I have been getting a ton of inquiries lately, both internally as well as externally for hardware recommendations for building a new or updating an existing homelab/test environment to be able to deploy the full VMware Cloud Foundation (VCF) solution. I typically receive at least half a dozen inquiries per week about general VMware Homelabs, but it has increased in volume lately, perhaps it was due to the recent US Black Friday and Cyber Monday Sales or perhaps some are preparing for VCF 9 already?

In any case, I normally point users to my crowdsourced VMware Community Homelab Project, where users can submit their hardware build-of-materials (BOM), overall cost and the VMware solutions they are currently using.


While the VMware Community Homelab Project has been running for several years now and has helped numerous users, the majority of the submissions typically focus on subset of the VMware portfolio and only handful of submissions have included VCF and more importantly, some of the submissions are several years old.

Internally, a number of folks have shared more recent BOMs for building an environment to run the latest VCF 5.x release and I have also found several folks outside of VMware doing the same, so I thought it would be useful and timely to aggregate some of their hardware configurations to help give users an idea of what works and options as they are looking to revamp their lab going into 2025.

[Read more...]