Stikkordarkiv: VMware Identity Manager

VMware vRealize og vCloud Suite kampanje

Fra 01.09.2020 startet VMware en kampanje med 50% rabatt på nykjøp og oppgradering til vRealize og vCloud Suite. Kampanjen varer til 22.01.2021 og er en gyllen mulighet til å få produktene i pakken til en rabattert pris.

Hva er i vRealize Suite standard pakken

vRealize Suite Standard inneholder fire tjenester. vRealize Suite Lifecycle Manager med VMware Identity Manager, vRealize Operations Manager og vRealize Log Insight.

Produktene i vRealize Suite Standard
Produktene i vRealize Suite Standard

vRealize Suite og vCloud Suite pakkene er helt lik med unntak av at vCloud Suite inneholder vSphere Enterprise plus.

vRealize Suite Standard VS vCloud Suite Standard
vRealize and vCloud Suite Pakkene
vRealize SuitevCloud Suite
vRealize Suite Lifecycle ManagervRealize Suite Lifecycle Manager
vRealize Operations ManagervRealize Operations Manager
vRealize Log InsightvRealize Log Insight
VMware Identity ManagerVMware Identity Manager
vSphere Enterprise Plus


Hva kan vRealize Suite brukes til

vRealize Suite inneholder verktøyene du trenger for å full oversikt og kontroll i datasenteret ditt, on-prem eller i sky. For mer info se VMware sine produktsider. Eller sjekk ut noen av VMware innleggene mine

VMware Identity Manager portal satt opp med SSO til alle tjenestene i vRealize Suite I tillegg til NSX og vRealize Network Insight
VMware Identity Manager portal satt opp med SSO til alle tjenestene i vRealize Suite I tillegg til NSX og vRealize Network Insight

Hvem kan utnytte rabatten?

De fleste kan utnytte denne rabatten da den gjelder på ny kjøp av vRealize Suite og oppgradering for dem med eksisterende vRealize Operations Standard lisenser (pr CPU)
Man kan også benytte rabatten ved oppgradering av vSphere lisenser til vCloud Suite, se listen under for detaljer.

ProduktnummerProdukt Beskrivelse
VR19-STD-PROVMware vRealize Suite 2019 Standard (Per PLU) Promo
CL19-STD-PROVMware vCloud Suite 2019 Standard Promo
CL19-STD7-STD-UG-PROUpgrade: VMware vSphere 7 Standard to vCloud Suite 2019 Standard Promo
CL19-ENT7-STD-UG-PROUpgrade: VMware vSphere 7 Enterprise to vCloud Suite 2019 Standard Promo
CL19-EPL7-STD-UG-PROUpgrade: VMware vSphere 7 Enterprise Plus to vCloud Suite 2019 Standard Promo
VR19-OSTC-STD-UG-PROUpgrade: VMware vRealize Operations 8 Standard (Per CPU) to VMware vRealize Suite 2019 Standard (Per PLU) Promo
vRealize og vCloud Suite oppgraderingsvalg

Referanser

https://www.vmware.com/se/promotions/2020-vrealize-suite.html
https://blogs.vmware.com/management/2020/08/vrealize-vcloud-suite-promo.html
https://www.vmware.com/products/vrealize-suite.html

Limitations when using Workspace One Access for “free” with vRSLCM?

Workspace One Access or vIDM “Content Catalog” vRealize shortcuts with SSO login

When you install vRealize Suite Lifecycle manager It comes with the Workspace One Access (VMware Identity Manager) And in this appliance you get a lot of options and no limitations in any way. So it is up to you to avoid using any features that you are not allowed to use. If you do then you might be in breach of the EULA.

So I went on a google search for answers to this question and boy I can tell you that it is not straight forward. I have also tried to get VMware to give me a statement or point me to the correct documentation where they say what I can and can’t do.

Why is this an issue?

As I said you are not limited in any way and you could use all its functionality. But if you do you would then be in breach og the EULA according to an VMware Product Manager. So a problem arises, you could easily be in a breach without knowingly doing so.

After some investigation I was pointed to the VMware Product Guide where the following is stated.

Official documentation

Workspace ONE Access feature. A license to use VMware NSX Data Center (any edition) or NSX Cloud (any edition) includes an entitlement to use the Workspace ONE Access feature, but only for the following functionalities:

  • directory integration functionality of Workspace ONE Access to authenticate users in a user directory such as Microsoft Active Directory or LDAP
  • conditional access policy
  • single-sign-on integration functionality with third party Identity providers to allow third party identityproviders’ users to single-sign-on into NSX
  • two-factor authentication solution through integration with third party systems. VMware Verify,VMware’s multi-factor authentication solution, received as part of Workspace ONE Access, may not beused as part of NSX, and
  • single-sign-on functionality to access VMware products that support single-sign-on capabilities.

A license to use VMware vRealize Log Insight includes an entitlement to use the Workspace ONE Access feature, but only for the following functionalities:

  • directory integration functionality of Workspace ONE Access Standard to authenticate users in a user directory such as Microsoft Active Directory or LDAP
  • conditional access policy
  • single-sign-on integration functionality with third party Identity providers to allow third party Identityproviders’ users to single-sign-on into vRealize Log Insight
  • two-factor authentication solution through integration with third party systems. VMware Verify,VMware’s multi-factor authentication solution, received as part of the Workspace ONE Access feature,may not be used as part of vRealize Log Insight, and
  • single-sign-on functionality to access VMware products that support single-sign-on capabilities.

So is this now solved?

The quick answer is NO, when you look at the text I would interpret it to only apply if I have NSX and or Log insight license. Not for vRA, vRops, vRNI, vRB and vRSLCM. I would also argue that there is a problem with the wording. If you look at point 4 and 5 and the inclusion of , and at the end, does it imply that point 5 is also not allowed?

And what about when they first saybut only for the following functionalities and then inside a point they say may not be used What may not be used?

That I may not use single sign on with anything else than NSX and vRLI?
single-sign-on functionality to access VMware products that support single-sign-on capabilities

I honestly don’t know that to get out of this other than it doesn’t apply to this use case and that it is a shoehorn attempt to make a text fit something it is not meant to fit.

Other Clues?

When you look at the VMware download page for Identity Manger 3.3.1 it clearly stated what it can be used for. But it doesn’t go into details.
Download VMware Identity Manager 3.3.1 (for vRA, vRops, vRLI, vRB, vRNI, NSX only)

If any of you have any insight on this please give me an update.

To be continued…..

How to configure SSO web links in VMware Identity Manager Catalog for vRealize Suite Lifecycle Manager imported products

When you deploy a product from vRSLCM its single sign-on link is automatically created in the Identity manager catalog. But if you import an existing vRealize product it will not. Bummer! Or that being said I have not tested importing solutions that already had vIDM configured for authentication without the catalog entry.

Anyways if you have imported an existing product into vRSLCM and you are missing the SSO link in your catalog. This is how I fixed it (don’t know if this is the official way)

First you need to enable login with identity manager for the product you want to configure SSO for. When that is done and working do the following for the different products.

vRealize Network Insight

Right click on the login button and copy the URL. You will get something like the url listed under. You just need to fix the URL in the end to be like mine but with your vRNI link.

https://YOUR.IDENTITYMANAGER.FQDN/SAAS/auth/oauth2/authorize?response_type=code&client_id=YOURID_auth_grant&scope=openid+user+email&redirect_uri=http://YOUR.VRNI.FQDN/#home

vRealize Operations Manager

For the vROPS I was not able to use get the correct URL in the same way, here I used F12 in Google Chrome and recorded my login. I found the correct URL on the first line “authorize?response_type=…………..” and It should look something like this.

https:/your.identitymanager.fqdn/SAAS/auth/oauth2/authorize?response_type=code&client_id=yourid&redirect_uri=https://your.vrops.fqdn/ui/vidmClient/vidm

Add SSO weblink to Identity Manager Catalog

When you got the URL go into your Identity managers Administrator Console and under Catalog and Web Apps create a new web link.
In the Configuration menu choose Authentication TypeWeb Application Link” and in Target URL insert the URL you copied from vRealize Network Insight login screen.

How to re-establish trust between vRealize Suite Lifecycle Manager and VMware Identity Manager after replacing self-signed certificate

Im currently working on a deployment of vRealize Suite Lifecycle Manager 8.0 It was deployed using Easy Installer method. And it has given me a few headaches to be honest. Here is the recipe on how to solve one of those issues.

Replace self-signed certificate

In vRSLCM you can easily replace the self-signed certificate on the vIDM appliance if you have previously imported it into the locker. Just go through the “Replace Certificate” prosess and do the included precheck.

Replace Certificate precheck
vIDM Replace Certificate precheck
LCMCOMMON30007

You will probably get the same warning as I did. If you click finish it will replace the certificate and everything looks fine until you try “Trigger Inventory Sync” from vRSLCM. It will fail with the following error:

Error message

com.vmware.vrealize.lcm.util.exception.SshAuthenticationFailureException: Cannot execute ssh commands. Please verify the ssh login credentials 
at com.vmware.vrealize.lcm.util.SshUtils.execute(SshUtils.java:393)
at com.vmware.vrealize.lcm.util.SshUtils.runCommand(SshUtils.java:307)
at com.vmware.vrealize.lcm.util.SshUtils.runCommand(SshUtils.java:290)
at com.vmware.vrealize.lcm.util.SshUtils.runCommand(SshUtils.java:333)
at com.vmware.vrealize.lcm.drivers.commonplugin.task.VerifySshConnectionTask.CheckForSshConnection(VerifySshConnectionTask.java:165)               
at com.vmware.vrealize.lcm.drivers.commonplugin.task.VerifySshConnectionTask.execute(VerifySshConnectionTask.java:125)               
at com.vmware.vrealize.lcm.drivers.commonplugin.task.VerifySshConnectionTask.retry(VerifySshConnectionTask.java:282)               
at com.vmware.vrealize.lcm.automata.core.TaskThread.run(TaskThread.java:43)           
at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)    
at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
at java.lang.Thread.run(Thread.java:748)
Caused by: java.lang.RuntimeException: Cannot create session for ssh://root@xx.xx.xx.xx
at com.vmware.vrealize.lcm.util.SessionHolder.newSession(SessionHolder.java:57)       
at com.vmware.vrealize.lcm.util.SessionHolder.<init>(SessionHolder.java:37)        
at com.vmware.vrealize.lcm.util.SshUtils.execute(SshUtils.java:346)      
… 10 more
Caused by: com.jcraft.jsch.JSchException: Auth fail at com.jcraft.jsch.Session.connect(Session.java:519)    
at com.vmware.vrealize.lcm.util.SessionHolder.newSession(SessionHolder.java:53)       
… 12 more

How to fix the issue

1. SSH to vIDM and log in as sshuser. Run the following command to become the root user.
su root
2. Edit the file /etc/ssh/sshd_config and change the value of PermitRootLogin to yes
PermitRootLogin yes
3. Run the following command to restart the sshd service.
service sshd restart

“Trigger Inventory Sync” and it will complete successfully