I recently wrote an article about vMA 4.1 and Active Directory Integration and today I noticed there were some confusion on the expected behavior of the two types of authentication policy: vi-fastpass authentication versus Active Directory authentication. There are actually a few things to consider:

  • What user context are you trying to execute a command against a target?
  • What authentication policy was used to add the target to vMA?
  • Is vMA host joined to an Active Directory Domain?
USER CONTEXT FPAUTH or ADAUTH vMA in AD DOMAIN
vi-admin fpauth no
DOMAIN\username adauth yes

I will try to explain the following two scenarios listed above.

In this example, vMA was not joined to an Active Directory Domain and we are adding a vCenter target to vMA using a local administrator account on vCenter server (by default, fpauth is assumed):

[vi-admin@tancredi ~]$ sudo vifp addserver manaslu.primp-industries.com
Enter username for manaslu.primp-industries.com: administrator
[email protected]’s password:
This will store username and password in credential store which is a security risk. Do you want to continue?(yes/no): yes

We can verify the target was added using fpauth by running the following command:

[vi-admin@tancredi ~]$ vifp listservers -l

esx4-1.primp-industries.com ESX fpauth
esxi4-3.primp-industries.com ESXi fpauth
manaslu.primp-industries.com vCenter fpauth

Next, we will set the fastpass target to the newly added vCenter server:

[vi-admin@tancredi ~]$ vifptarget -s manaslu.primp-industries.com

[vi-admin@tancredi ~][manaslu.primp-industries.com]$

If we run “esxcfg-nics -l” against an ESX(i) host that is being managed by this vCenter, we would do the following (note: user context is vi-admin):

[vi-admin@tancredi ~][manaslu.primp-industries.com]$ esxcfg-nics -l –vihost esxi4-3.primp-industries.com

Name PCI Driver Link Speed Duplex MAC Address MTU Description
vmnic0 02:00.0 e1000 Up 1000Mbps Full 00:50:56:ac:69:95 1500 Intel Corporation PRO/1000 MT Single Port Adapter

In this first example, we are relying solely on vi-fastpass authentication, where a vi-adminXX account is created on the target. The credentials to this account is generated by vMA and stored in the local credential store.

In this example, vMA has been joined to an Active Directory Domain and we are adding a vCenter target using Active Directory credentials:

[vi-admin@tancredi ~]$ sudo vifp addserver reflex.primp-industries.com –authpolicy adauth
Enter username for reflex.primp-industries.com: PRIMP-IND\primp

Note: As of writing this, there is a typo in vMA 4.1 documentation on the syntax to use when specifying the username when prompted. You will need to use DOMAIN\username, if you decide to use the –username, then you need to add a second “slash” to escape the first (e.g. DOMAIN\\username)

We can verify the target was added using adauth by running the following command:

[vi-admin@tancredi ~]$ vifp listservers -l

esx4-1.primp-industries.com ESX fpauth
esxi4-3.primp-industries.com ESXi fpauth
manaslu.primp-industries.com vCenter fpauth
reflex.primp-industries.com vCenter adauth

Next, we will set the fastpass target to the newly added vCenter server but before we do so, we need to login to vMA using a valid Active Directory account.

[primp@tancredi ~]$ vifptarget -s reflex.primp-industries.com

[primp@tancredi ~][reflex.primp-industries.com]$

Now if we run “esxcfg-nics -l” against an ESX(i) host that is being managed by this vCenter, we would do the following (note: user context is DOMAIN account):

[primp@tancredi ~][reflex.primp-industries.com]$ esxcfg-nics -l –vihost himalaya.primp-industries.com

Name PCI Driver Link Speed Duplex MAC Address MTU Description
vmnic0 06:00.0 e1000e Up 1000Mbps Full 00:30:48:d9:58:6a 1500 Intel Corporation 82574L Gigabit Network Connection
vmnic1 07:00.0 e1000e Down 0Mbps Half 00:30:48:d9:58:6b 1500 Intel Corporation 82574L Gigabit Network Connection

In this second example, we are relying solely on Active Directory authentication, where credentials of the user that is logged into vMA are being used. Unlike in the first example, if you were in the vi-admin context and tried to execute the same command, you will notice you are prompted for credentials. This is the intended and expected behavior of the two scenarios.

However, if you do not want to join vMA to an Active Directory Domain but would still like to perform an unattended authentication from vi-admin context, then you need to setup a Kerberos ticket for the target. The details on configuring this is outlined in vMA 4.1 user guide, please refer to the document for more details.

One thing to note which I actually ran into, is that when you join your vMA host to Active Directory Domain, you must reboot vMA after joining to the domain. If you do not, you will run into issues when trying to add a target using adauth authentication policy.

5 thoughts on “vMA 4.1 – Authentication Policy (fpauth vs adauth)

  1. “you must reboot vMA after joining to the domain”

    So this is no different then adding any Windows based server to AD Domain.
    Maybe with this new AD integration Vmware wanted to keep a familiar end user experience ;)

  2. Wlliam –
    “However, if you do not want to join vMA to an Active Directory Domain but would still like to perform an unattended authentication from vi-admin context, then you need to setup a Kerberos ticket for the target.”

    I have followed steps as given in the user guide. how do i test if all is fine?

  3. Any reason why this fails?

    [root@csl57 ~]# vifp listservers -l
    ovpesx10.ind.hp.com ESX fpauth
    csl7.proto.hp.com ESXi fpauth
    csl16.proto.hp.com ESXi adauth
    [root@csl57 ~]# /opt/vmware/vma/samples/perl/listTargets.pl
    Target Name Product Version
    ———– ——- ——-
    ovpesx10.ind.hp.com VMware ESX 4.0.0
    csl7.proto.hp.com VMware ESXi 4.0.0
    csl16.proto.hp.com
    [root@csl57 ~]#

    See the last line above – why does authentication fail to work? how to make this work?

  4. Hello William
    I installed vMA 5.1 and joined it to AD. You are writing that you have to login with a valid AD account on the vMA. My vMA unfortunately doesn’t still know my AD user. Do I really only have to make a “sudo domainjoin-cli join…” and after that I already should be able to login with an AD account on vMA using ssh?

    /var/log/messages shows following errors after ssh.

    Dec 10 15:48:10 vma sshd[17378]: Invalid user lasm4 from 192.168.100.1
    Dec 10 15:48:10 vma sshd[17378]: Failed none for invalid user lasm4 from 192.168.100.1 port 36759 ssh2
    Dec 10 15:48:13 vma sshd[17380]: pam_unix2(sshd:auth): Unknown option: `try_first_pass’
    Dec 10 15:48:13 vma sshd[17378]: error: PAM: User not known to the underlying authentication module for illegal user manuel from adminserver.domain.com
    Dec 10 15:48:13 vma sshd[17378]: Failed keyboard-interactive/pam for invalid user lasm4 from 192.168.100.1 port 36759 ssh2

    I don’t get the point.

    Regards Manuel

Thanks for the comment!