WilliamLam.com

vCenter Server Identity Federation with Pocket ID

by // Leave a Comment

Having explored various OIDC identity providers, including Authentik, KeyCloak and Synology SSO, I recently came across Pocket ID, a super basic OIDC provider. Instead of using traditional username and passwords, Pocket ID only supports passkeys authentication based on the WebAuthn standard, which means you can login to your vCenter Server or VMware Cloud Foundation (VCF) environment using a physical device like a Yubico YubiKey or Apple Face ID.


Disclaimer: Pocket ID is not an officially supported vCenter Server IdP, please use at your own risk.

[Read more...]

vCenter Server Identity Federation with Synology SSO

by // Leave a Comment

I recently found another cool use case for my Synology NAS, which is using the Synology SSO application to setup vCenter Server Identity Federation. I had not considered looking at Synology, but I was recently setting up some additional DNS entries and noticed there was SSO Server application, that supports both SAML2 and OIDC.


For those with a Synology, this is a super easy way to get hands on experience with configuring vCenter Server Identity Federation and this can all run locally within your environment, unlike some of the other external identity providers which typically will require direct/in-direction connection to your vCenter Server or require a SCIM (System for Cross-domain Identity Management) proxy server.

Disclaimer: Synology SSO is currently not an officially supported vCenter Server IdP, please use at your own risk.

[Read more...]

Quick Tip - Which vCenter Server Key Provider (KMS) is a VM using?

by // 2 Comments

vCenter Server requires a Key Management Service (KMS) for enabling VM Encryption, vTPM, or vSAN Encryption. Users have the choice of configuring the embedded Native Key Provider (NKP) built into vCenter Server and/or use an external KMS with the Standard Key Provider (SKP) option.


If you have more than one KMS configured in vCenter Server, you can specify one of the KMS key providers to be your default, which will automatically be used for any KMS-related activities. You can switch between the default KMS key provider and you can certainly specify a specific KMS key provider when using the vSphere API to provision a VM that will leverage VM encryption.

So how do you figure out which KMS key provider a VM is using?

[Read more...]