Single Sign-On in the
vSphere Environment
A vCenter Single Sign-On client connects to
the vCenter Single Sign-On server to obtain a security token that contains
authentication claims required for operations in the vSphere environment. The
vCenter Single Sign-On client API supports operations to acquire, renew, and
validate tokens.
vCenter Single Sign-On Overview To support the requirements for secure software environments, software components require authorization to perform operations on behalf of a user. In a single sign-on environment, a user provides credentials once, and components in the environment perform operations based on the original authentication. vCenter Single Sign-On authentication can use the following identity store technologies: vCenter Single Sign-On Client API The vCenter Single Sign-On client API is described in the WSDL (Web Service Definition Language) file that is included in the vCenter Single Sign-On SDK. This API defines a set of request operations that correspond to the WS-Trust 1.4 bindings. The set of operations includes Issue , Renew , Validate , and Challenge requests. Acquiring a SAML Token from a vCenter Single Sign-On Server To obtain a security token from a vCenter Single Sign-On server, the vCenter Single Sign-On client calls the Issue method, which sends a SOAP message that contains a token request and authentication data. This section describes a token request that uses a certificate to obtain a holder-of-key token. When the client creates the token request, it also inserts timestamp, signature, and certificate data into the SOAP security header.vCenter Single Sign-On SOAP Message Structure The requirements listed in the following table apply to the SOAP message structure in vCenter Single Sign-On message exchange.vCenter Single Sign-On SDK The vCenter Single Sign-On SDK is distributed as part of the VMware vSphere Management SDK. When you extract the contents of the distribution kit, the vCenter Single Sign-On SDK is located in the ssoclient sub-directory: