Hello Communities,
Please bear with me on this one. I'm working on my first Horizon deployment. I have an existing VCSA that I recently upgraded from 6.0 to 6.5. In order to configure Horizon, I need some level of AD integration. I work in a large organization and I have some control over part of the AD domain tree that contains objects particular to my organizational unit. Prior to starting with Horizon I had configured one Identity Source being Active Directory as an LDAP Server with its base being OU=People,DC=myorg,DC=com because that's where the accounts for my vCenter users (a team of around 7 people) are found. I do not have control over this part of the AD domain tree. It works fine:
Identity source: MYORG AD LDAP ; OU=People,DC=myorg,DC=com ; myorg.com ; MYORG
I've added the AD users I want directly in to the Administrators group in vCenter using myorg.com\username so we can login using vSphere with our AD credentials and manage the system.
Now I need to create AD users specifically for Horizon, but I only have control over the part of the domain tree for my department, so I figure I'll need to add a second Identity Source. I'm not sure if the same AD can be added twice, but I couldn't find anywhere in the documentation that said it can't, so I gave it a try via the embedded PSC console:
Original Identity source: MYORG AD LDAP ; OU=People,DC=myorg,DC=com ; myorg.com ; MYORG
Second Identity source: 2000 MYORG AD LDAP ; OU=Local Accounts,OU=2000,OU=Business Units,DC=myorg,DC=com ; it.myorg.com ; IT
I found that my original Identity Source added to VCSA 6.0 using ldaps is still working, but the second Identity Source using ldaps to the same server with the same certificate won't work, perhaps due to this VMware Knowledge Base issue so I gave up and made it ldap, not ideal but moving on...
Now here's where I'm stuck. Back in vCenter I'm trying to Add Permission for my AD local account it.myorg.com\2000ua-vcenterserver, in the dialog window Select Users/Groups both myorg.com and it.myorg.com appear in the drop down list, I can find and Addit.myorg.com\2000ua-vcenterserver to the list of users and Check names returns Correct usernames it.myorg.com\2000ua-vcenterserver but when I say OK to close the Add Permission window I get: Provider method implementation threw unexpected exception: %s
If instead of trying to Add Permission, I try to add my new local account to a vCenter Group, it behaves the same, I can find it and Check names but when I OK to close the window I get: No principal with the specified name exists
Final piece of strangeness—just as a test, I tried to add a group from my second identity store with OU=Security Groups,OU=2000,OU=Business Units,DC=myorg,DC=com (the group is called 2000GG-DELETEME) to the vCenter Administrators group (maybe not the best group to use as a test but I thought it would fail). And it worked, sort of, only it's added the group with the original identity source domain. So if I look at Group Members for vCenter Group Administrators I have 2000GG-DELETEME from Domainmyorg.com but it actually exists in it.myorg.com. And of course, now I can't delete it. No error message, it just refreshes the group membership pane with 2000GG-DELETEME still there. Presumably it can't delete the group because it can't find it in the wrong domain.
Here are my questions:
1. Can I get rid of 2000GG-DELETEME somehow e.g. via the shell or directly from the VCSA database without restoring a backup?
2. Is having multiple identity sources from the same AD LDAP a supported configuration? Expected to work? Did I do something wrong?
3. If it's not supported, is the best way forward to add my Administrators users to vSphere.local and then delete myorg.com and use it.myorg.com as the sole AD Identity Source?
Hope that makes sense. I'm pretty stuck and I want to move on with Horizon but I need to the AD integration working, I'd really appreciate any advice from the Identity Sources experts!
Thanks,
Lucas