SSO – Euro * Brew

vCenter Orchestrator Install and Config

Posted on August 5, 2014August 8, 2018 by Josh De Jong

I have wanted to get started with vCO for awhile now, but I have not had much of use for it. Justifying the time to deploy and learn a new tool when you don’t have a glaring need for it proves tricky, but recently I was able to carve out some time to learn. One of the biggest hurdles was finding step-by-step deployment guide that worked so I decided to document this process.

The following documentation is for installing the vCenter Orchestrator (vCO) Appliance v5.5.1 with an already deployed vCenter 5.5 server (vCSA in my case). The appliance allows you to run vCO without installing it on a dedicated Windows Server.

1. Search for VMware-vCO-Appliance and download the latest version (VMware-vCO-Appliance-5.5.1.0-1617225_OVF10.ova for this writing)

2. Accept the license terms and save the file locally
3. Connect the vSphere client to your vCenter Server then choose File -> Deploy OVF Template

4. Click the “Browse” button, locate the .OVF downloaded previously and click “Open” then click “Next”

5. Review the template details and click “Next”

6. Accept the license agreement and click “Next”
7. Choose a name and location for this appliance and click “Next”

8. Choose a datastore for the appliance and click “Next”

9. Choose the appropriate disk format (I prefer thin provisioned) and click “Next”

10. Choose the appropriate Destination Network (VM Port Group) and click “Next”

11. Enter passwords for both the root user of the appliance and the password for the configuration interface (‘vmware’ is the username)

Enter the Hostname, gateway, DNS, IP and subnet mask for the appliance and click “Next”

12. Review the details of the configuration and then click “Finish”

13. Once the appliance has been deployed successfully, click “Close”

14. Right click on the appliance and choose “Open Console”

15. Click the Power button to turn on the VM

16. Boot to “VMware vCenter Orchestrator Appliance”

17. Note the URLs for each function

18. Open a web browser and connect to the URL for Orchestrator Configuration (Port 8283)
19. Login with the username “vmware” and the password entered for the vCO configuration during appliance deployment

20. Click on “Network”

21. Change the “IP address” to the IP used to access vCO and click “Apply changes” in the bottom right corner

22. Click the “SSL Trust Manager” tab, enter the IP or hostname of your vCenter server and click “Import”

23. Once the cert information is displayed, click the “import” link

24.Repeat this process again, this time importing the certificate for SSO. Enter the FQDN of the SSO server with port 7444 and click “Import” then “Import” again once the certificate details are displayed

25. Click on “Authentication” to configure user access

26. For this writing we will use the SSO Authentication method, so change Authentication mode to “SSO Authentication” and click “Advanced settings”

27. Enter the Token and Admin service URLs, the SSO admin username and passwords. Click “Register Orchestrator”

Token service URL: https://vCenterIPaddress:7444/ims/STSService
Admin service URL: https://vCenterIPaddress:7444/sso-adminserver/sdk
Admin user name: administrator@vsphere.local
Admin password: Password for admin account

28. Once registration completes, choose the vCO Admin – domain and group from the list (These are populated based on your SSO config). Click “Accept Orchestrator Configuration”

29. Click on “Startup Options”

30. Click “Restart the vCO configuration server”

31. Log back in once the server has finished restarting and click “Licenses”

32. Choose “Use vCenter Server license” and enter the host name of the vCenter server, port should be 443, path is /sdk, and for username and password I used the SSO admin. Click “Apply changes” towards the bottom right of the screen

33. Click on “vCenter Server (5.5.1)”

34. Click “New vCenter Server Host” and enter the hostname of the vCenter server, port is 443, path is /sdk, I chose “Session per user” and the username and password for the SSO admin account. Click “Apply changes”

35. Click on “Mail (5.5.1)”

36. Click the check box for “define default values” and enter in the following information and click “Apply changes”

SMTP host: The address for your mail server
SMTP Port: Usually 25
Username and password: If your mail server requires authentication
From name: Name that vCO emails will appear from
From address: Email address that vCO emails will appear from

37. Open a new browser window/tab and navigate to https://vCOIPaddress:8281/vco/client/client.jnlp to access the Java web client for vCO. Login as user that is a member of whatever group was chosen in step 27 as a vCO Admin

At first this did not work and kept reporting “No vCO license available” when I attempted to login. After restarting the service and configuration server through the web interface, I ended up restarting the vCO appliance within vCenter and then I was able to login without issue

38. At this point you’re all setup and ready to start creating workflows

vCenter Server 5.5 Custom Install

Posted on May 20, 2014August 8, 2018 by Josh De Jong

In order to install the 4 components of vCenter (SSO, Web Client, Inventory Service, and vCenter Server) onto a secondary drive on the same Server, you must perform a “Custom Install”. This guide will walk you through the process of installing each of these components as well as SQL 2008 Express to the secondary drive of a Server. This can also be used to install the individual components on separate servers. In total, this is just over 100 steps to walk through so it will take some time.

Prerequisites:

1. Create a new virtual machine and add it to the domain
2. Add a second hard disk to install vCenter on
3. Add the update manager and vCenter service domain users as a local admins (vudatemanager, vmwareservice for this writing)
4. Mount the ISO for vCenter 5.5
5. Ensure User Account Control is turned off and the server has been rebooted (SQL will fail without this)

Install:

1. Open computer, right click on the VMware VIM disk and choose “Open”

2. Navigate to \redist\SQLEXPR and double click “SQLEXPR_x64_ENU”

3. After files are extracted, choose “New installation or add features to an existing installation”

4. Check the box to accept the license terms and click “Next”

5. Uncheck “SQL Server Replication” and change the share feature directories to the “D:\” drive and click “Next”

6. Name the Instance and change the instance root directory to the D:\ drive. Click “Next”

7. SQL Database Engine can run as Network Service, but I prefer using a named account. Click “Next”

8. Click on the “Data Directories” tab to ensure all directories are pointed at the secondary drive

9. Click on the “Account Provisioning” tab and change the authentication to “Mixed Mode”. Enter an “sa” password (save it immediately), then add any SQL Admins that are required and click “Next”

10. Click “Next” through Error Reporting screen
11. Click “Close” once the installation finishes
12. Click Start, then type “cmd”, right-click on cmd.exe and choose “Run as administrator”

13. Ensure your current path is “C:\Windows\system32” and type “sqlcmd.exe -S DEN-vCenter01\VCENTERSQLEXPR” (This is to connect to the instance named “VCENTERSQLEXPR” on the server “DEN-vCenter01” which is the server I am currently connected to)

14. Run the following commands pressing “enter” after each line (this will create the vCenter Database, add domain\vmwareservice as a use and db_owner, then add as user and db_owner of the msdb database)
CREATE DATABASE [vCenterDB] GO ALTER DATABASE [vCenterDB] SET COMPATIBILITY_LEVEL = 100 GO ALTER DATABASE [vCenterDB] SET RECOVERY SIMPLE GO USE [vCenterDB] GO CREATE USER [domain\vmwareservice] FOR LOGIN [domain\vmwareservice] GO EXEC sp_addrolemember 'db_owner', 'domain\vmwareservice' GO USE msdb GO CREATE USER [domain\vmwareservice] FOR LOGIN [domain\vmwareservice] GO EXEC sp_addrolemember 'db_owner', 'domain\vmwareservice' GO

15. Type “exit” and then close CMD window
16. Login as the vCenter Service account which should be added as a local administrator
17. Go to start, administrative tools, and chooce “Data Source (ODBC)”

18. Click the “System DSN” tab and click “Add”

19. Choose “SQL Server Native Client 10.0” and click “Finish”

20. Enter a useful name, description and browse for the local Instance

21. Choose “With Integrated Windows authentication” and click “Next”

22. Change the default database to the newly created vCenterDB and click “Next”

23. Click “Finish”

24. Click “Test Data Source” to ensure connection then click “OK” and “OK”

(Running the vCenter Components install failed when logged in as the VMware Service account for me so the rest of these steps can be performed by another admin account for this server.)
25. Open computer and double-click on the VMware VIM disc

26. Click “vCenter Single Sign-On” under “Custom Install” and click “Install”

27. Click “Next” for vCenter Single Sign-On

28. Accept the license agreement and click “Next”

29. Review the SSO information and check the box for “Add [DOMAIN] as a Native Active Directory identity source” and click “Next”

30. Choose “vCenter Single Sign-On for your first vCenter Server” and click “Next”

31. Enter the password for the local account for SSO (this is not the domain admin or your own account, this is a local account to administer SSO in the event the domain is unavailable). Save the password immediately and click “Next”

32. Enter a site name (if needed) and click “Next”

33. Note the HTTPS port and click “Next”

34. Change the destination folder to the secondary drive (D: for this writing) and click “Next”

35. Review the options and click “Install”

36. Click “Finish” when it’s done installing

37. Now click on “vSphere Web Client” under “Custom Install” and click “Install”

38. Choose “English” and click “OK”

39. Click “Next”

40. Accept the license agreement and click “Next”

41. Change the install directory to the “D:\” drive and click “Next”

42. Note the web client ports and click “Next”

43. Enter the password for the administrator@vsphere.local account and click “Next”

44. Click “Yes” for the SSL fingerprint
45. Click “Install certificates” when you see the “Certificate Installation for Secure Connection”

46. Click “Install”

47. Click “Finish”

48. Click “OK” for this message about access time for the Web Client

49. Click on “vCenter Inventory Service” under “Custom Install” then click “Install”

50. Choose “English” and click “OK”

51. Click “Next” to begin the Inventory Service installation

52. Accept the license agreement and click “Next”

53. Change the install directory to the “D:\” drive and click “Next”

54. Ensure the FQDN is correct and click “Next”

55. Note the ports and click “Next”

56. Select the appropriate Inventory size and click “Next”

57. Enter the password for the administrator@vsphere.local account and click “Next”

58. Click “Yes” for the SSL fingerprint
59. Click “Install” to begin installation

60. Click “Finish” once the installation is complete

61. Click “vCenter Server” under “Custom Install” and then click “Install”

62. Choose “English” and click “OK”

63. Click “Next” to begin installation wizard

64. Accept the license agreement and click “Next”

65. Enter the license key (if available) and then click “Next”

66. Click “Use an existing supported database” and select the ODBC connection created earlier and click “Next”

67. Click “Next”

68. If the JDBC URL fails, restart the SQL Service (Administrative Tools -> Services and locate “SQL Server (InstanceName)”) on the local server and attempt the connection again

69. Enter your password to run the vCenter service (but we’ll change this after creation)

70. Select “Create a standalone VMware vCenter Server instance” and click “Next”

71. Note the provisioned ports and click “Next”

72. Select the appropriate inventory size and click “Next”

73. Enter the administrator@vsphere.local SSO password and click “Next”

74. Click “yes” for the SSL fingerprint
75. Click “Next” to register administrator@vsphere.local as an Administrator

76. Confirm the vCenter Inventory URL and click “Next”

77. Change the installation to the “D:\” drive and click “Next”

78. Click “Install”

79. Once installation completes, click “Finish”

80. Click Start, Administrative Tools, then choose “Services”

81. Locate “VMware VirtualCenter Server” service, right-click and choose “Properties”

82. Click on the “Log On” tab and then click on the “Browse” button

83. Change the “Location” to your domain then enter the name of the user account that will run the vCenter Service (vmwareservice for this writing) and click “OK”

84. Enter the password for this account and then click “OK”

85. Click “OK” to grant log on as a service rights then click “OK” about it not taking affect until a service restart

86. Locate the “VMware VirtualCenter Management Webservices” service and change it’s logon account to same account we just used for the VirtualCenter Server service (vmwareservice for this writing)

87. Right-click on “VMware VirtualCenter Server” service and choose “Restart”. You will be prompted that the “Vmware VirtualCenter Management Webservices” needs to be restarted as well. Click “Yes” for that prompt

88. After the services restart, open your browser and connect to https:// IPofvCenter:9443/vsphere-client and login as administrator@vsphere.local with the password assigned earlier
89. Once logged in, click on “Administrator” on the left pane

90. Click on “Users and Groups” under “Single Sign-On”

91. Click the “Groups” tab then click on”Administrators” under “Group Name”

92. Click the “Add Member” button under “Group Members”

93. Change the Domain to your domain, then search for the Active Directory user or group to be added as an Administrator. Click the user/group then click the “Add” button followed by “OK”

94. Click the “Home” button towards the top left corner

95. Click on “vCenter”

96. Click on “vCenter Servers”

97. Click on your vCenter server

98. Click the “Manage” tab followed by “Permissions”

99. Click the “Add Permission” button

100. Click the “Add” button towards the lower left then search for the Active Directory user/group to be added as a vCenter Administrator (ensure the Domain is set to your domain). Click the user/group, then click “Add” followed by “OK”

101. Changed “Assigned Role” to “Administrator” from the drop-down and then click “OK”

At this point your vCenter server is installed and configured with an Administrator account added for SSO as well as vCenter itself. To install the Update Manager service, click here to view the steps to install and configure. Your steps will differ as those instructions are for connecting to a mirrored database for Update Manager, but the rest of the steps are similar. You will just need to provision a database and grant the update manager user account db_owner to msdb and the Update Manager database. This can be done the same way as in step 14, just change the database name and the user name.

To complete the vCenter configuration (create a datacenter, add hosts), click here to open the step-by-step guide and scroll to step 44.

Install & Configure vCSA and vCenter 5.5

Posted on May 12, 2014August 7, 2018 by Josh De Jong

The steps below are to install and configure the vCenter Server Appliance, configure SSO to lookup users in a specific OU in Active Directory, add an Administrator, add your first host, and configure email server settings.

Prerequisites:

Download the latest version of the vCenter Server Appliance (5.5.0.5201 for this writing) and place it some where that is accessible by the client hosting the vSphere client
Have the vSphere Thick client installed
Have a datastore created for the appliance (VM_Appliances for this writing)
Identify the Fully Qualified Domain name and IP address of the server ahead of time

Steps

- 1. Login to the vSphere client, choose File then Deploy OVF Template

- 1. Click “Browse”, locate the OVF/OVA, and click “Open”, then click “Next”

- 1. Click “Next” after reviewing the template details

- 1. Name the vCSA, choose the inventory location, and click “Next”

- 1. Choose the datastore and click “Next”

- 1. Verify the datastore name and size and click “Next” (Size is not adjustable)

- 1. Select the appropriate “Destination Network” and click “Next”

- 1. Enter the following information and click “Next”
    1. Hostname = Name of Appliance
    1. Default Gateway = IP of the gateway of the Destination Network
    1. DNS = IP of the DNS Server (Separate each DNS server with commas, though it didn’t seem to apply these settings)
    1. Network 1 IP Address = IP address of the vCenter Server Appliance
    1. Network 1 Netmark = Subnet mask of the Destination Network

- 1. Verify the settings and click “Finish” to begin deployment of the vCSA

- 1. Once deployment is finished, click “Close”
- 1. Right click on the vCSA in the vSphere client and choose “Upgrade Virtual Hardware” then click “Yes” to upgrade the configuration

- 1. Right click on the vCSA and choose “Open Console”
- 1. Click the “Power On” button in the console

- 1. Once the appliance has finished booting, open a browser and connect to the web interface (https:// ipaddress:5480)

- 1. Click “Continue” to the security warning on your web browser
  2. Enter the default username and password for the vCSA (username: root, password: vmware)
- 1. After login, accept the licensing agreement and click “Next” (this part may take awhile)

- 1. Once you get to “Configure Options” press the “Cancel” button (After a few unsuccessful attempts to configure through the wizard, it is easier setting it up manually)

- 1. At the home page of the vCSA admin page, click on the “Database” tab
  - Change the “Database type” to “embedded” and click “Save Settings” (may take a minute or 2)

- 1. Click on the “SSO” tab
    - Change the “SSO deployment type” to “embedded”
    - Set the admin password for the “administrator@vsphere.local” account (Save this information immediately!)
    - Click “Save Settings” (will take a few minutes)
    - Once you see the message “Operation was successful” you can move on to the next step

- 1. Click on the “Network” tab
    - Ensure the Hostname (must be a FQDN if adding to a domain), IPv4 gateway, preferred & alternate DNS servers, and IPv4 static IP addressing is set. If any entries is missing, add them now
    - Once saved, click on the “System” tab and click on “Reboot”

- 1. Log back in (if necessary and continue with the next step)
- 1. Click on “Authentication” tab
    - Check the box for “Active Directory Enabled”
    - Enter the domain name
    - Enter a domain admin account for “Administrative user” (Domain admin)
    - Enter the password for this account and click “Save Settings” (This will add the appliance to the domain)

- 1. Click on the “Update” tab then click “Check Updates” to see if there are any available updates
    - Install any updates that are available
    - Click on “Settings” under “Update”
    - Choose “Automatic check for updates”
    - Set your frequency (usually once a week) and then click “Save Settings”

- 1. Click on the “Admin” tab
    - Enter the current administrator password (default is “vmware”)
    - Enter the new administrator password and immediately save it (I use keepass for my passwords)
    - Click “Yes” for administrator password expiration
    - Enter the password validity time in days
    - Enter a group account for email expiration warning
    - Click “Submit”

- 1. Once the settings are saved, click on “System” tab then choose “Reboot”
- 1. Once the vCSA is back up, you should be able to login to the vSphere Web Client (https:// IPofvCSA:9443)
  2. Download and install the “Client Integration Plug-in”
    - You’ll need to close your current browser to complete installation. Reopen and enable the Plugins after revisiting the URL above

- 1. Login using the username “administrator@vsphere.local” and the password setup in step 20
- 1. Click on “Administration”

- 1. Click on “Configuration”, then click the “Identity Sources” tab and press the “+” button

- 1. Choose the following for setting up Active Directory Auth for a specific group using a service account
    - Choose “Active Directory as a LDAP Server”
    - Enter the name (Just a reference name)
    - Enter the Distinguished name of the OU where users will be located
    - Enter the Domain name
    - Enter the Domain alias
    - Enter the Distinguished name for groups (for us, it’s the same as for users)
    - Enter the primary server URL (Format: ldap:\\Dcname.domainname.com:389)
    - Enter the secondary server URL (same format as above)
    - Username: A domain account in the OU above (do not use a users account, make it a service account)
    - Password: Password for domain account
    - Press “Test Connection” to ensure it all works and then click “OK”

- 1. Under “Single Sign-On” on the left, click on “Users and Groups”

- 1. Click the “Groups” tab, then click on “Administrators”

- 1. Click the “Add Members” button

- 1. Change the Domain to the Domain that was just added. Search for the Domain users/groups that need Administrator access, click on each one and click “Add” followed by “OK”

- 1. Once the users have been added, click on the “Home” button towards the top left

- 1. Click on “vCenter”

- 1. Under “Inventory Lists”, click on “vCenter Servers”

- 1. Click on the name of your vCenter Server

- 1. Click the “Manage” tab, followed by the “Permissions” button

- 1. Click the “+” button to add a new administrator.
    - When the “Add Permission” box appears, click the “Add” button at the bottom
    - Change the Domain to Domain added earlier
    - Search for the same users/groups added as vCSA admins, select each one and click “Add” followed by “OK” when completed
    - Under “Assigned Role” change from “No access” to “Administrator”. Ensure “Propogate to children” is selected and click “OK”

- 1. Once Domain permissions have been assigned, sign out of the web interface as “administrator@vsphere.local” and login with domain credentials (domain\username)
- 1. Once logged in as Domain account, click on “vCenter”

- 1. If you see the number “1” next to “vCenter Servers” under “Inventory Lists” then permissions were assigned correctly.
  2. Click on vCenter Servers, then click on the vCenter server and click the “Manage” button in the middle pane

- 1. Under the “Settings” tab click on “Advanced Settings”

- 1. Locate the key “config.registry.key_managedIP” and if the Value is “–“, click the “Edit” button towards the top right

- - Scroll down to that key and enter the IP address of the vCenter Server appliance and click “OK” (Without this entry, in the event of a DNS failure, the hosts will not be able to check in with the vCenter server and could become disconnected. Thanks to Virtual Barker for pointing this out)

- 1. Click on on the “vCenter” link towards the top left

- 1. Click on “Datacenters”

- 1. Click the “Create a new datacenter” button

- 1. Choose a name of the Datacenter (I usually use location), click on the vCenter server instance and click “OK”

- 1. Click on “vCenter” towards the top left

- 1. Click on “Hosts” under “Inventory Lists”

- 1. Click the “Add a host” button

- 1. Follow these steps to add a host to your newly created datacenter
    - Enter the fully qualified domain name of your host
    - Click on the destination datacenter and then click “Next”
    - Enter the username and password for the “root” account then click “Next” (Click “Yes” for the security alert)
    - Review the details of the Host then click “Next”
    - Assign a license key (if available) and click “Next”
    - Make sure “Enable lockdown mode” is unchecked and click “Next”
    - Click “Next” through “VM location” as we haven’t created a new tag yet
    - Click “Finish”

- 1. Click on “vCenter” button towards the top left
    - Click on “vCenter Servers” under “Inventory Lists”
    - Click on the name of the vCenter server
    - Click the “Manage” tab
    - Under “vCenter Server Settings” on the General page, click the “Edit” button
    - Click the “Mail” link and enter your mail server address and the mail sender address and then click “OK”

At this point you are ready to start adding more hosts, creating clusters and deploying virtual machines. Before you are ready for production, ensure that you create alerts for monitoring VM and Host health such as CPU and memory usage, CPU ready latency, storage latency and VM snapshot size. I’ll address the common alerts I create in each new build in a later post.