Short answer: In VCF 9.1 you configure VCF Single Sign-On from VCF Operations. The wizard covers identity broker mode, the OIDC identity provider, vCenter and NSX, role assignment, and VCF Operations and Automation. Behind it are VCF Operations calls under /suite-api/internal/vidb/, and a script can replay them to finish the setup in about a minute. Those endpoints are internal, so treat this as lab or test automation. For production, use the wizard or the public APIs.
What changed for VCF SSO in 9.1
- Generic OIDC and generic SAML 2.0. Besides Okta, Ping, Entra ID, ADFS and Symantec, VCF 9.1 accepts any OIDC or SAML 2.0 identity provider, for example Keycloak (supported IdPs and protocols). You still get one identity provider per identity broker.
- Two identity broker modes. Embedded runs in the management domain vCenter. Instance is deployed as a VCF management services component (Deployment Modes of the Identity Broker).
- User and group provisioning through SCIM 2.0, JIT (with pre-provisioned or JIT-created groups) or AD/LDAP.
- API clients and tokens for non-interactive logins, plus a break-glass emergency access client.
If you’re setting up Keycloak by hand on VCF 9.0, the IdP-side configuration is in VCF 9.0 Single Sign-On (SSO) with Keycloak IdP. This article covers only the automation in 9.1.
Inputs you need before you script it
| Input | Notes |
|---|---|
| VCF Operations FQDN and local admin credentials | Used to get an API token |
| Identity broker mode | Embedded (vCenter) or instance (VCF management services) |
| OIDC discovery URL | The IdP’s .well-known/openid-configuration address |
| IdP TLS certificate chain | Full chain in PEM format |
| Client ID and client secret | From the OIDC client you created in the IdP. The secret usually expires, and you then update it in VCF. |
| Login domain(s) | The domain users log in with |
| Admin group and group claim | Pre-provisioned JIT group that gets the VCF administrator role |
Configure the IdP to send these case-sensitive claims: preferred_username, email, family_name, given_name, groups and domain. If it can’t, map alternative claim names in VCF Operations under Identity & Access (Configure an Identity Provider using Generic OIDC).
The call sequence
The script follows the documented wizard steps in order. Every call goes to VCF Operations:
| Wizard step | Endpoint (under /suite-api) |
|---|---|
| Authenticate | POST /api/auth/token/acquire (public API) |
| Acknowledge prerequisites | PUT /internal/vidb/globalidpsettings |
| Step 1: deployment mode | POST /internal/vidb/ssodomains, POST /internal/vidb/ssoconfigstatus |
| Step 2: identity provider (generic OIDC) | POST /internal/vidb/identityproviders |
| Step 3: vCenter and NSX | POST /internal/vidb/authsources/query, POST /internal/vidb/authsources/manage |
| Step 4: VCF role to IdP group | POST /internal/vidb/ssodomains/{id}/assignments/bulk |
| Step 5: VCF Operations and Automation | POST /internal/vidb/authsources/manage |
| Finish | PUT /internal/vidb/ssoconfigstatus |
Authentication uses the public Suite API. The internal calls then need two extra headers:
curl -sk -X POST https://vcf-ops.example.com/suite-api/api/auth/token/acquire \
-H 'Content-Type: application/json' -H 'Accept: application/json' \
-d '{"username":"admin","password":"<password>","authSource":"local"}'
# every /suite-api/internal/vidb/* call afterwards:
# Authorization: OpsToken <token>
# X-Ops-API-use-unsupported: trueSupportability: read this first
The X-Ops-API-use-unsupported header is how VCF Operations marks internal endpoints. They aren’t a documented contract, and payloads can change in any patch. Use the script to rebuild labs and test environments quickly. In production, configure SSO with the wizard, or check whether the public Identity Broker API covers the step you want to automate. The script also has a reset option that deletes the SSO domain, so never point it at a shared environment by mistake.
After SSO: API clients and tokens for automation
Once VCF SSO is running, don’t let scripts log in as a human account. In VCF Operations go to Manage > Fleet Management Identity & Access > VCF SSO Overview > (identity broker) > API Access, create an API client, scope a role to it, and generate an API token (Create an API Client and Generate an API Token):
- API token TTL defaults to 30 days and access token TTL to 30 minutes. The maximums are set under Fleet Settings > IAM Setting.
- You see the token only once, when you generate it.
- The emergency access client gets the highest role. Its token defaults to 180 days, and only one exists at a time.
SSO touches certificates on every component. If logins break after the change, check vCenter STS signing certificate expiration first.
Further reading
- William Lam: VCF 9.1 – Automating VCF Single Sign-On (SSO) with OIDC-based Identity Provider (the original post) and his script configure_vcf_910_sso_with_oidc_idp.ps1
- Broadcom TechDocs: Configure a New VCF Single Sign-On for a VCF Instance
- Broadcom TechDocs: Create an Emergency Access Client
