VMware is depreciating Integrated Windows Authentication in vSphere 7.0. The feature will be removed in a later release. Below is from the VMware KB.
Support for IWA continues to be available in vSphere 7.0 and will be phased out in a future release. Although IWA can still be configured, we highly recommend using AD over LDAP or Federated Identity (AD FS).
Deprecation of Integrated Windows Authentication (78506) (vmware.com)
In this post we will be going through changing over to using Active Directory over LDAP. We will also be using LDAPS as this is secured with certificates and is much better from a security side and Microsoft are requiring this on applications that use LDAP.
2020 LDAP channel binding and LDAP signing requirements for Windows (microsoft.com)
If you haven’t configured a certificate on your domain controller yet to allow LDAPS I would configure this first before proceeding with the swap over to Active directory over LDAP identity provider.
If we check the existing AD IWA we can see the warning that the feature is depreciated.
I usually create a new account for each applications LDAP connections just so I keep track of what account is used where.
For LDAP authentication in a Windows domain a standard account with just domain users right should have enough permission as it best to use least privilege for service accounts.
To confirm in an Windows AD domain is setup to use LDAPS we can use the ldp on a devices that has the active directory tools enabled to confirm LDAPS connection.
Open and click connect and add in the server name, set port to 636 and tick SSL.
If the configuration is retuned then LDAPS is working.
Once we have the account created and confirmed that LDAPS is working we can start setting up AD over LDAP in vCenter.
Since we will be using the same domain name as the IWA source we need to remove this first or it will cause error when trying add the LDAPS source.
Logon to vCenter web client > Menu > Administration > single sign on > configuration.
Under Identity sources select the IWA and click remove.
Click ok to confirm removal.
Once the IWA is removed we can now add the AD LDAP connection.
Click Add in the Identity source page and select Active Directory over LDAP
Add in the required details.
Name: Friendly name for the identity source.
Base DN: Is the level at which search in AD will start for user or groups to search all AD just use the top level or select sub OU to limit the searches.
Domain name: FQDN of the domain
Domain alias: this is the NetBIOS / pre windows 2000 domain name
When I select any domain controller I was getting the below.
Cannot configure identity source due to Failed to probe provider connectivity [URI: ldaps://domainl ]; tenantName [vsphere.local], userName [User] Caused by: Can’t contact LDAP server.
To work around this I had to specific my DC manually.
As I have a certificate issue from an internal certificate authority I will be selecting the CA cert for LDAPS as this should trust any cert issued by the CA on my domain controllers.
Click Add to complete the AD over LDAP identity source.
If we check the websso.log under /var/log/vmware/sso on the vCenter appliance, we can see the certificate being verified when we logon with a domain account.
We have now move from IWA to AD over LDAP all existing groups and roles should still work.
TheSleepyAdmins 