vCenter Server and Identity Management
The vCenter appliance
vCenter Server is deployed as the vCenter Server Appliance (VCSA) using the installer (GUI or CLI). You choose a deployment size based on inventory scale, a Single Sign-On domain (default vsphere.local), and a site name. The SSO domain name cannot be changed after deployment, and [email protected] is not the same account as an ESXi root user. The VAMI at port 5480 handles backup, networking, services and updates.
Identity and linking
Identity sources include Active Directory (integrated Windows authentication), AD over LDAP, OpenLDAP and local OS. The order of identity sources matters when usernames collide across domains. Multiple vCenters joined to the same SSO domain form Enhanced Linked Mode, giving a single pane of glass; they must be compatible versions and resolve each other by FQDN.
Concepts to review
- SSO users, groups, and the built-in administrator group (
[email protected]orSystemConfiguration.Administrators). - vCenter High Availability, PNID changes, and certificate replacement (covered further in the security domain).
- File-based backup targets: FTP/SFTP, HTTP(S), NFS, SMB.
- Update Planner and the reduced-downtime upgrade path.
Traps
Expect distractors around changing the SSO domain after install, using root to log into vCenter, assuming local OS users are visible to every vCenter, and assuming a backup captures everything without a matching restore procedure. Linked Mode is not the same as a single vCenter managing all hosts.
Rule of thumb
Before changing the PNID, certificates, or upgrading, take a file-based backup to an external target and verify you have the SSO administrator password.