Configuring VRealize Automation 7.4 V Realize 74 Configuration

User Manual: Pdf vRealize Automation - 7.4 - Configuring User Guide for VMware vRealize Software, Free Instruction Manual

Open the PDF directly: View PDF .
Page Count: 621 [warning: Documents this large are best viewed by clicking the View PDF Link!]

Configuring vRealize Automation

Conﬁguring vRealize

Automation

12 April 2018

vRealize Automation 7.4

Configuring vRealize Automation

VMware, Inc. 2

You can find the most up-to-date technical documentation on the VMware website at:

https://docs.vmware.com/

If you have comments about this documentation, submit your feedback to

docfeedback@vmware.com

VMware, Inc.

3401 Hillview Ave.

Palo Alto, CA 94304

www.vmware.com

Contents

Configuring vRealize Automation 6

1External Preparations for Blueprint Provisioning 7

Preparing Your Environment for vRealize Automation Management 7

Checklist for Preparing NSX Network and Security Configuration 8

Checklist For Providing Third-Party IPAM Provider Support 12

Checklist for Configuring Containers for vRealize Automation 16

Preparing Your vCloud Director Environment for vRealize Automation 17

Preparing Your vCloud Air Environment for vRealize Automation 17

Preparing Your Amazon AWS Environment 18

Preparing Red Hat OpenStack Network and Security Features 24

Preparing Your SCVMM Environment 25

Configure Network-to-Azure VPC Connectivity 26

Preparing for Machine Provisioning 27

Choosing a Machine Provisioning Method to Prepare 28

Checklist for Running Visual Basic Scripts During Provisioning 30

Using vRealize Automation Guest Agent in Provisioning 31

Checklist for Preparing to Provision by Cloning 39

Preparing for vCloud Air and vCloud Director Provisioning 52

Preparing for Linux Kickstart Provisioning 53

Preparing for SCCM Provisioning 56

Preparing for WIM Provisioning 57

Preparing for Virtual Machine Image Provisioning 64

Preparing for Amazon Machine Image Provisioning 65

Scenario: Prepare vSphere Resources for Machine Provisioning in Rainpole 67

Preparing for Software Provisioning 70

Preparing to Provision Machines with Software 71

Scenario: Prepare a vSphere CentOS Template for Clone Machine and Software Component

Blueprints 74

Scenario: Prepare for Importing the Dukes Bank for vSphere Sample Application Blueprint 78

2Tenant and Resource Preparations for Blueprint Provisioning 83

Configuring Tenant Settings 83

Choosing Directories Management Configuration Options 84

Upgrading External Connectors for Directories Management 144

Scenario: Configure an Active Directory Link for a Highly Available vRealize Automation 152

Configure External Connectors for Smart Card and Third-party Identity Provider Authentication

in vRealize Automation 154

VMware, Inc. 3

Create a Multi Domain or Multi Forest Active Directory Link 161

Configuring Groups and User Roles 163

Create Additional Tenants 169

Delete a Tenant 171

Configuring Security Settings for Multi-tenancy 172

Configuring Custom Branding 172

Checklist for Configuring Notifications 174

Create a Custom RDP File to Support RDP Connections for Provisioned Machines 185

Scenario: Add Datacenter Locations for Cross Region Deployments 185

Configuring vRealize Orchestrator 187

Configuring Resources 191

Checklist for Configuring IaaS Resources 191

Configuring XaaS Resources 310

Creating and Configuring Containers 322

Installing Additional Plug-Ins on the Default vRealize Orchestrator Server 340

Working With Active Directory Policies 340

User Preferences for Notifications and Delegates 343

3Providing Service Blueprints to Users 345

Designing Blueprints 345

Building Your Design Library 347

Designing Machine Blueprints 349

Designing Software Components 435

Designing XaaS Blueprints and Resource Actions 447

Publishing a Blueprint 506

Working with Blueprints Programmatically 507

Exporting and Importing Blueprints and Content 507

Downloading and Configuring the Supplied Standalone Blueprint 513

Assembling Composite Blueprints 513

Understanding Nested Blueprint Behavior 515

Using Machine Components and Software Components When Assembling a Blueprint 518

Creating Property Bindings Between Blueprint Components 519

Creating Dependencies and Controlling the Order of Provisioning 520

Customizing Blueprint Request Forms 521

Create a Custom Request Form with Active Directory Options 524

Custom Form Designer Field Properties 532

Using vRealize Orchestrator Actions in the Custom Forms Designer 537

Using the Data Grid Element in the Custom Forms Designer 539

Using External Validation in the Custom Forms Designer 542

Managing the Service Catalog 546

Checklist for Configuring the Service Catalog 547

Creating a Service 548

Configuring vRealize Automation

VMware, Inc. 4

Working with Catalog Items and Actions 550

Creating Entitlements 553

Working with Approval Policies 560

Request Machine Provisioning By Using a Parameterized Blueprint 585

Scenario: Make the CentOS with MySQL Application Blueprint Available in the Service Catalog 586

Managing Deployed Catalog Items 590

Running Actions for Provisioned Resources 590

Specify Machine Reconfiguration Settings and Considerations for Reconfiguration 610

Reconfigure a Load Balancer in a Deployment 617

Change NAT Rules in a Deployment 618

Add or Remove Security Items in a Deployment 620

Display All NAT Rules for an Existing NSX Edge 621

Configuring vRealize Automation

VMware, Inc. 5

Conﬁguring vRealize Automation

Configuring vRealize Automation provides information about configuring vRealize Automation and your

external environments to prepare for vRealize Automation provisioning and catalog management.

Intended Audience

This information is intended for IT professionals who are responsible for configuring vRealize Automation

environment, and for infrastructure administrators who are responsible for preparing elements in their

existing infrastructure for use in vRealize Automation provisioning. The information is written for

experienced Windows and Linux system administrators who are familiar with virtual machine technology

and datacenter operations.

VMware Technical Publications Glossary

VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For

definitions of terms as they are used in VMware technical documentation, go to

http://www.vmware.com/support/pubs.

VMware, Inc. 6

External Preparations for

Blueprint Provisioning 1

You may need to create or prepare some elements outside of vRealize Automation to support catalog

item provisioning. For example, if you want to provide a catalog item for provisioning a clone machine,

you need to create a template on your hypervisor to clone from.

This chapter includes the following topics:

nPreparing Your Environment for vRealize Automation Management

nConfigure Network-to-Azure VPC Connectivity

nPreparing for Machine Provisioning

nPreparing for Software Provisioning

Preparing Your Environment for vRealize Automation

Management

Depending on your integration platform, you might have to make some configuration changes before you

can bring your environment under vRealize Automation management, or before you can leverage certain

features.

Table 1‑1. Preparing Your Environment for vRealize Automation Integration

Environment Preparations

NSX

If you want to leverage NSX to manage

networking and security features of machines

provisioned with vRealize Automation, prepare

your NSX instance for integration. See

Checklist for Preparing NSX Network and

Security Configuration.

vCloud Director Install and configure your vCloud Director

instance, set up your vSphere and cloud

resources, and identify or create appropriate

credentials to provide vRealize Automation with

access to your vCloud Director environment.

See Preparing Your vCloud Director

Environment for vRealize Automation.

VMware, Inc. 7

Table 1‑1. Preparing Your Environment for vRealize Automation Integration (Continued)

Environment Preparations

vCloud Air Register for your vCloud Air account, set up

your vCloud Air environment, and identify or

create appropriate credentials to provide

vRealize Automation with access to your

environment. See Preparing for vCloud Air and

vCloud Director Provisioning.

Amazon AWS Prepare elements and user roles in your

Amazon AWS environment for use in

vRealize Automation, and understand how

Amazon AWS features map to

vRealize Automation features. See Preparing

Your Amazon AWS Environment.

Microsoft Azure Configure networking to use VPN tunneling to

support Software components on Azure

blueprints. See Configure Network-to-Azure

VPC Connectivity.

Red Hat OpenStack If you want to leverage Red Hat OpenStack to

manage networking and security features of

machines provisioned with

vRealize Automation, prepare your

Red Hat OpenStack instance for integration.

See Preparing Red Hat OpenStack Network

and Security Features.

SCVMM Configure storage, networking, and understand

template and hardware profile naming

restrictions. See Preparing Your SCVMM

Environment.

External IPAM Providers Register an external IPAM provider package or

plug-in, run the configuration workflows, and

vRealize Automation endpoint. See Checklist

For Providing Third-Party IPAM Provider

Support.

All other environments You do not need to make changes to your

environment. You can begin preparing for

machine provisioning by creating templates,

boot environments, or machine images. See

Preparing for Machine Provisioning.

Checklist for Preparing NSX Network and Security Conﬁguration

Before you can use NSX network and security options in vRealize Automation, you must configure the

external NSX network and security environment that you intend to use.

Configuring vRealize Automation

VMware, Inc. 8

Beginning in vRealize Automation 7.3, you no longer need to install the NSX plug-in to obtain integrated

NSX functionality. All integrated NSX functionality is now sourced directly from the NSX APIs, rather than

from the NSX plug-in. However, if you want to use XaaS to extend your vRealize Automation and NSX

integration, you must install the NSX plug-in in vRealize Orchestrator as described here.

In preparation for using NSX network, security, and load balancing capabilities in vRealize Automation,

when using NSX Manager credentials you must use the NSX Manager administrator account.

For related information about NSX, see NSX documentation at

https://www.vmware.com/support/pubs/nsx_pubs.html and public blogs and articles such as Integrating

NSX with vRealize Automation.

Much of the vRealize Automation support for network and security configuration that you specify in

blueprints and reservations is configured externally and made available to vRealize Automation after data

collection is run on the compute resources.

For more information about NSX settings that you can configure for vRealize Automation blueprints, see

Configuring Network and Security Component Settings.

Table 1‑2. Preparing NSX Networking and Security Checklist

Task Location Details

Configure NSX

network settings,

including gateway

and transport zone

settings.

Configure network settings in NSX. See the NSX Administration Guide.

Create NSX

security policies,

tags, and groups.

Configure security settings in NSX. See the NSX Administration Guide.

Configure NSX

load balancer

settings.

Configure an NSX load balancer to work with

vRealize Automation.

See the NSX Administration Guide.

Also see Custom Properties for

Networking in Custom Properties

Reference.

For cross-virtual

center

deployments, verify

that the compute

NSX manager has

the primary NSX

manager role.

vRealize Automation provisioning requires that the compute

NSX manager for the region in which the machines reside has

the primary NSX manager role.

See Administrator Requirements for

Provisioning NSX Universal Objects.

See the NSX Installation Guide and NSX

Administration Guide for information about

cross-virtual center deployment, universal

objects, and the primary NSX manager

role.

Install the NSX Plug-In on vRealize Orchestrator

Installing the NSX plug-in requires that you download the vRealize Orchestrator installer file, use the

vRealize Orchestrator Configuration interface to upload the plug-in file, and install the plug-in on a

vRealize Orchestrator server.

For general plug-in update and troubleshooting information, see vRealize Orchestrator documentation.

Configuring vRealize Automation

VMware, Inc. 9

Prerequisites

Beginning in vRealize Automation 7.3, you no longer need to install the NSX plug-in to obtain integrated

NSX functionality. All integrated NSX functionality is now sourced directly from the NSX APIs, rather than

from the NSX plug-in. However, if you want to use XaaS to extend your vRealize Automation and NSX

integration, you must install the NSX plug-in in vRealize Orchestrator as described here.

If you are using an embedded vRealize Orchestrator that already contains an installed NSX plug-in, you

can skip this procedure.

nVerify that you are running a supported vRealize Orchestrator instance.

For information about setting up vRealize Orchestrator, see Installing and Configuring VMware

vRealize Orchestrator.

nVerify that you have credentials for an account with permission to install vRealize Orchestrator plug-

ins and to authenticate through vCenter Single Sign-On.

nVerify that you installed the vRealize Orchestrator client and that you can log in with Administrator

credentials.

nConfirm the correct version of the NSX plug-in in the vRealize Automation support matrix.

Procedure

1Download the plug-in file to a location accessible from the vRealize Orchestrator server.

The plug-in installer file name format, with appropriate version values, is o11nplugin-

nsx-1.n.n.vmoapp. Plug-in installation files for the NSX networking and security product are

available from the VMware product download site at http://vmware.com/web/vmware/downloads.

2Open a browser and start the vRealize Orchestrator configuration interface.

An example of the URL format is https://orchestrator_server.com:8283.

3Click Plug-Ins in the left pane and scroll down to the Install new plug-in section.

4In the Plug-In file text box, browse to the plug-in installer file and click Upload and install.

The file must be in .vmoapp format.

5At the prompt, accept the license agreement in the Install a plug-in pane.

6In the Enabled plug-ins installation status section, confirm that the correct NSX plug-in name is

specified.

See vRealize Automation Support Matrix for version information.

The status Plug-in will be installed at next server startup, appears.

7Restart the vRealize Orchestrator server service.

8Restart the vRealize Orchestrator configuration interface.

9Click Plug-Ins and verify that the status changed to Installation OK.

Configuring vRealize Automation

VMware, Inc. 10

10 Start the vRealize Orchestrator client application, log in, and use the Workflow tab to navigate

through the library to the NSX folder.

You can browse through the workflows that the NSX plug-in provides.

What to do next

Create a vRealize Orchestrator endpoint in vRealize Automation to use for running workflows. See Create

a vRealize Orchestrator Endpoint.

Run a vRealize Orchestrator and NSX Security Workﬂow

Before you use the NSX security policy features from vRealize Automation, an administrator must run the

Enable security policy support for overlapping subnets workflow in vRealize Orchestrator.

Security policy support for the overlapping subnets workflow is applicable to an NSX 6.1 and later

endpoint. Run this workflow only once to enable this support.

Prerequisites

nVerify that a vSphere endpoint is registered with an NSX endpoint. See Create a vSphere Endpoint.

nLog in to the vRealize Orchestrator client as an administrator.

nVerify that you ran the Create NSX endpoint vRO work flow.

Procedure

1Click the Workflow tab and select NSX > NSX workflows for VCAC.

2Run the Create NSX endpoint workflow and respond to prompts.

3Run the Enable security policy support for overlapping subnets workflow.

4Select the NSX endpoint as the input parameter for the workflow.

Use the IP address you specified when you created the vSphere endpoint to register an NSX

instance.

After you run this workflow, the distributed firewall rules defined in the security policy are applied only on

the vNICs of the security group members to which this security policy is applied.

What to do next

Apply the applicable security features for the blueprint.

Administrator Requirements for Provisioning NSX Universal Objects

To provision machines in a cross vCenter NSX environment when using NSX universal objects, you must

provision to a vCenter in which the NSX compute manager has the primary role.

In a cross vCenter NSX environment, you can have multiple vCenter servers, each of which must be

paired with its own NSX manager. One NSX manager is assigned the role of primary NSX manager, and

the others are assigned the role of secondary NSX manager.

Configuring vRealize Automation

VMware, Inc. 11

The primary NSX manager can create universal objects, such as universal logical switches. These

objects are synchronized to the secondary NSX managers. You can view these objects from the

secondary NSX managers, but you cannot edit them there. You must use the primary NSX manager to

manage universal objects. The primary NSX manager can be used to configure any of the secondary

NSX managers in the environment.

For more information about the NSX cross-vCenter environment, see Overview of Cross-vCenter

Networking and Security in the NSX Administration Guide in the NSX product documentation.

For a vSphere (vCenter) endpoint that is associated to the NSX endpoint of a primary NSX manager,

vRealize Automation supports NSX local objects, such as local logical switches, local edge gateways,

and local load balancers, security groups, and security tags. It also supports NAT one-to-one and one-to-

many networks with universal transport zone, routed networks with universal transport zone and universal

distributed logical routers (DLRs), and a load balancer with any type of network.

vRealize Automation does not support NSX existing and on-demand universal security groups or tags.

To provision local on-demand networks as the primary NSX manager, use a vCenter-specific local

transport zone. You can configure vRealize Automation reservations to use the local transport zone and

virtual wires for deployments in that local vCenter.

If you connect a vSphere (vCenter) endpoint to a corresponding secondary NSX manager endpoint, you

can only provision and use local objects.

You can only associate an NSX endpoint to one vSphere endpoint. This association constraint means that

you cannot provision a universal on-demand network and attach it to vSphere machines that are

provisioned on different vCenters.

vRealize Automation can consume an NSX universal logical switch as an external network. If a universal

switch exists, it is data-collected and then attached to or consumed by each machine in the deployment.

nProvisioning an on-demand network to a universal transport zone can create a new universal logical

switch.

nProvisioning an on-demand network to a universal transport zone on the primary NSX manager

creates a universal logical switch.

nProvisioning an on-demand network to a universal transport zone on a secondary NSX manager fails,

as NSX cannot create a universal logical switch on a secondary NSX manager.

See the VMware Knowledge Base article Deployment of vRealize Automation blueprints with NSX objects

fail (2147240) at http://kb.vmware.com/kb/2147240 for more information about NSX universal objects.

Checklist For Providing Third-Party IPAM Provider Support

You can obtain IP addresses and ranges for use in network profile definition from a supported third-party

IPAM provider, such as Infoblox.

Before you can create and use an external IPAM provider endpoint in a vRealize Automation network

profile, you must download or otherwise obtain a vRealize Orchestrator IPAM provider plug-in or package,

import the plug-in or package and run required workflows in vRealize Orchestrator, and register the IPAM

solution as a vRealize Automation endpoint.

Configuring vRealize Automation

VMware, Inc. 12

For an overview of the provisioning process for using an external IPAM provider to supply a range of

possible IP addresses, see Provisioning a vRealize Automation Deployment Using a Third-Party IPAM

Provider.

Table 1‑3. Preparing for External IPAM Provider Support Checklist

Task Description Details

Obtain and

import the

supported external

IPAM Provider

vRealize

Orchestrator plug-

in.

Download the IPAM provider plug-in or package, for example

The Infoblox IPAM Plug-in for vRealize Orchestrator plug-in

and supporting documentation, from the VMware Solution

Exchange

(https://solutionexchange.vmware.com/store/category_group

s/cloud-management) and import the plug-in or package to

vRealize Orchestrator.

If the VMware Solution Exchange does not contain the IPAM

provider package that you need, you can create your own by

using a third-party IPAM Solution Provider SDK and supporting

documentation.

A vRealize Automation version-specific third-party IPAM

Solution Provider SDK, supporting documentation, and

associated starter package for vRealize Orchestrator and

vRealize Automation is available at

https://code.vmware.com/sdks or

https://code.vmware.com/samples.

See Obtain and Import a Third-Party IPAM

Provider Package in vRealize

Orchestrator.

Run the required

configuration

workflows and

IPAM solution as a

vRealize

Automation

endpoint.

Run the vRealize Orchestrator configuration workflows and

vRealize Orchestrator.

See Run Workflow to Register Third-Party

IPAM Endpoint Type in vRealize

Orchestrator.

Obtain and Import a Third-Party IPAM Provider Package in

vRealize Orchestrator

To prepare to define and use an third-party IPAM provider endpoint, you must first obtain the third-party

IPAM provider package and import the package in vRealize Orchestrator.

You can download and use an existing third-party IP Address Management provider plug-in, such as

Infoblox IPAM. You can also create your own third-party IPAM plug-in or package by using a VMware-

supplied starter package and accompanying SDK documentation for use with another third-party IPAM

solution provider, such as Bluecat.

nObtain the existing Infoblox IPAM Plug-in for vRealize Orchestrator plug-in and supporting

documentation from marketplace.vmware.com. The download also contains documentation for

installing and using the plug-in.

Configuring vRealize Automation

VMware, Inc. 13

nCreate your own third-party IPAM solution by obtaining and using a third-party IPAM Solution Provider

SDK, supporting documentation, and an associated starter package for vRealize Orchestrator and

vRealize Automation from code.vmware.com/web/sdk on the vRealize Automation Third-Party IPAM

Integration SDK 7.3 page.

After you import the third-party IPAM provider plug-in or package in vRealize Orchestrator, you must run

the required workflows, and register the IPAM endpoint type in vRealize Orchestrator.

For more information about importing plug-ins and packages and running vRealize Orchestrator

workflows, see Using the VMware vRealize Orchestrator Client. For more information about extending

vRealize Automation with vRealize Orchestrator plug-ins, packages, and workflows, see Life Cycle

Extensibility.

This step sequence uses the Infoblox IPAM plug-in as an example. Your step sequence may differ

depending on your vRealize Automation or plug-in version.

Prerequisites

nDownload the package or plug-in from marketplace.vmware.com.

nLog in to vRealize Orchestrator with administrator privileges for importing, configuring, and registering

a vRealize Orchestrator plug-in or package.

Procedure

1Open the marketplace.vmware.com site.

2Locate and download the plug-in or package.

For example, import the Infoblox plug-in that supports the Infoblox third-party IPAM endpoint in

vRealize Orchestrator and vRealize Automation 7.1 and later.

a In the Publisher category, select Infoblox and click Apply.

b Select The Infoblox Plug-in for vRealize Orchestrator.

c Click Tech Specs and review the prerequisites.

d Click Try for additional information and to receive an email that contains a link to the download.

e Download the zip file as specified in the emailed instructions.

Version 4.0 and greater of the plug-in supports vRealize Automation 7.1 and greater. The zip file

also contains documentation about the plug-in.

3In vRealize Orchestrator, click the Administrator tab and click Import package.

4Select the package to import.

5Select all workflows and artifacts and click Import selected elements.

What to do next

Run Workflow to Register Third-Party IPAM Endpoint Type in vRealize Orchestrator.

Configuring vRealize Automation

VMware, Inc. 14

Run Workﬂow to Register Third-Party IPAM Endpoint Type in

vRealize Orchestrator

Run the registration workflow in vRealize Orchestrator to support vRealize Automation use of the third-

party IPAM provider and register the IPAM endpoint type for use in vRealize Automation.

Prerequisites

nObtain and Import a Third-Party IPAM Provider Package in vRealize Orchestrator

nVerify that you are logged in to vRealize Orchestrator with the authority to run registration workflows.

nBe prepared to enter the vRealize Automation administrator credentials when prompted by the

registration workflow. When you register IPAM endpoint types in vRealize Orchestrator, you are

prompted to enter vRealize Automation administrator credentials.

Procedure

1In vRealize Orchestrator, click the Design tab, select Administrator > Library, and select IPAM

Service Package SDK.

Each IPAM provider package is uniquely named and contains unique workflows. Each provider

supplies their own registration workflow. While the workflow names might be similar between provider

packages, the location of the workflows in vRealize Orchestrator can be different and is provider-

specific.

2For this example, run the Register IPAM Endpoint registration workflow and specify the IPAM

Infloblox endpoint type.

3At the prompt for vRealize Automation credentials, enter your vRealize Automation administrator

credentials, for example fabric administrator credentials.

You must supply the registration workflow with vRealize Automation system administrator credentials.

Even if a non-system administrator user is logged in to the vRealize Orchestrator client, if the

vRealize Automation system administrator credentials are provided to the workflow the registration

will succeed.

In this example, the package registers Infoblox as a new IPAM endpoint type in the vRealize Automation

endpoint service and makes the endpoint type available when you create or edit endpoints in

vRealize Automation.

Note If the Infoblox IPAM connection disappears from the vRealize Orchestrator Inventory tab after you

restart the vRealize Orchestrator server in the vRealize Orchestrator Control Center. To resolve this issue,

run the Create IPAM Connection workflow from the vRO admin > Library > Infoblox > vRA > Helpers

menu sequence. You can then the vRealize Orchestrator Inventory tab, select Infoblox IPAM, and

refresh the page to display the Infoblox IPAM connection.

Configuring vRealize Automation

VMware, Inc. 15

What to do next

You can now create an IPAM Infloblox type endpoint, or and endpoint for whatever third-party package or

plug-in you have just registered, in vRealize Automation. See Create a Third-Party IPAM Provider

Endpoint.

Checklist for Conﬁguring Containers for vRealize Automation

To get started with Containers, you must configure the feature to support vRealize Automation user roles.

After you configure container definitions in Containers you can add and configure container components

in a blueprint.

Table 1‑4. Checklist for Conﬁguring Containers for vRealize Automation

Task Details

Assign the container administrator and container architect roles. See Container roles information in Foundations and

Concepts.

Define container definitions in the Containers tab in vRealize Automation. See Configuring vRealize Automation.

Add container components and container networking components to

blueprints in the Design tab in vRealize Automation.

See Configuring vRealize Automation.

Conﬁguring Containers Using the vRealize Automation Appliance

Xenon service information is accessible in the vRealize Automation vRealize Automation appliance (vRA

Settings > Xenon.

It contains information about the Xenon host VM, listening port, and service status. It also displays

information about clustered Xenon nodes.

You can manage the Xenon Linux service with the following CLI commands in the vRealize Automation

appliance.

Command Description

service xenon-service status Shows the status of the service as either running or stopped.

service xenon-service start Starts the service.

service xenon-service stop Stops the service.

service xenon-service restart Restarts the service.

service xenon-service get_host Shows the hostname on which the service is running.

service xenon-service get_port Shows the service port.

service xenon-service status_cluster Shows information about all clustered nodes in JSON format.

service xenon-service reset Deletes the directory where Xenon keeps all configuration files and restarts the

service.

Clustering Containers

You can use the Xenon service in conjunction with Containers for vRealize Automation to join nodes to a

cluster. If the nodes are clustered, the Xenon service connects other nodes automatically when it starts.

Configuring vRealize Automation

VMware, Inc. 16

You can monitor the cluster status on the Xenon tab in the vRealize Automation appliance or by running

the following command in a CLI:

service xenon-service status_cluster

Xenon works on quorum-based clustering. The quorum is calculated by using the (number of nodes /

2) + 1 formula.

Preparing Your vCloud Director Environment for

vRealize Automation

Before you can integrate vCloud Director with vRealize Automation, you must install and configure your

vCloud Director instance, set up your vSphere and cloud resources, and identify or create appropriate

credentials to provide vRealize Automation with access to your vCloud Director environment.

Conﬁgure Your Environment

Configure your vSphere resources and cloud resources, including virtual datacenters and networks. For

more information, see the vCloud Director documentation.

Required Credentials for Integration

Create or identify either organization administrator or system administrator credentials that your

vRealize Automation IaaS administrators can use to bring your vCloud Director environment under

vRealize Automation management as an endpoint.

User Role Considerations

vCloud Director user roles in an organization do not need to correspond with roles in vRealize Automation

business groups. If the user account does not exist in vCloud Director, vCloud Director performs a lookup

in the associated LDAP or Active Directory and creates the user account if the user exists in the identity

store. If it cannot create the user account, it logs a warning but does not fail the provisioning process. The

provisioned machine is then assigned to the account that was used to configure the vCloud Director

endpoint.

For related information about vCloud Director user management, see the vCloud Director documentation.

Preparing Your vCloud Air Environment for vRealize Automation

Before you integrate vCloud Air with vRealize Automation, you must register for your vCloud Air account,

set up your vCloud Air environment, and identify or create appropriate credentials to provide

vRealize Automation with access to your environment.

Conﬁgure Your Environment

Configure your environment as instructed in the vCloud Air documentation.

Configuring vRealize Automation

VMware, Inc. 17

Required Credentials for Integration

Create or identify either virtual infrastructure administrator or account administrator credentials that your

vRealize Automation IaaS administrators can use to bring your vCloud Air environment under

vRealize Automation management as an endpoint.

User Role Considerations

vCloud Air user roles in an organization do not need to correspond with roles in vRealize Automation

business groups. For related information about vCloud Air user management, see the vCloud Air

documentation.

Preparing Your Amazon AWS Environment

Prepare elements and user roles in your Amazon AWS environment, prepare Amazon AWS to

communicate with the guest agent and Software bootstrap agent, and understand how Amazon AWS

features map to vRealize Automation features.

Amazon AWS User Roles and Credentials Required for vRealize Automation

You must configure credentials in Amazon AWS with the permissions required for vRealize Automation to

manage your environment.

vRealize Automation requires access keys for endpoint credentials and does not support user names and

passwords.

nRole and Permission Authorization in Amazon Web Services

While the Power User role in AWS provides an AWS Directory Service user or group with full access

to AWS services and resources, it is not required. Lower privileged user roles are also supported. The

AWS security policy that meets the needs of vRealize Automation functionality is:

{

"Version": "2012-10-17",

"Statement": [{

"Effect": "Allow",

"Action": [

"ec2:DescribeInstances",

"ec2:DescribeImages",

"ec2:DescribeKeyPairs",

"ec2:DescribeVpcs",

"ec2:DescribeSubnets",

"ec2:DescribeSecurityGroups",

"ec2:DescribeVolumes",

"ec2:DescribeVpcAttribute",

"ec2:DescribeAddresses",

"ec2:DescribeAvailabilityZones",

"ec2:DescribeImageAttribute",

"ec2:DescribeInstanceAttribute",

"ec2:DescribeVolumeStatus",

Configuring vRealize Automation

VMware, Inc. 18

"ec2:DescribeVpnConnections",

"ec2:DescribeRegions",

"ec2:DescribeTags",

"ec2:DescribeVolumeAttribute",

"ec2:DescribeNetworkInterfaces",

"ec2:DescribeNetworkInterfaceAttribute",

"ec2:DisassociateAddress",

"ec2:GetPasswordData",

"ec2:ImportKeyPair",

"ec2:ImportVolume",

"ec2:CreateVolume",

"ec2:DeleteVolume",

"ec2:AttachVolume",

"ec2:ModifyVolumeAttribute",

"ec2:DetachVolume",

"ec2:AssignPrivateIpAddresses",

"ec2:UnassignPrivateIpAddresses",

"ec2:CreateKeyPair",

"ec2:DeleteKeyPair",

"ec2:CreateTags",

"ec2:AssociateAddress",

"ec2:ReportInstanceStatus",

"ec2:StartInstances",

"ec2:StopInstances",

"ec2:ModifyInstanceAttribute",

"ec2:MonitorInstances",

"ec2:RebootInstances",

"ec2:RunInstances",

"ec2:TerminateInstances",

"elasticloadbalancing:RegisterInstancesWithLoadBalancer",

"elasticloadbalancing:DeregisterInstancesFromLoadBalancer",

"elasticloadbalancing:DescribeLoadBalancerAttributes",

"elasticloadbalancing:DescribeLoadBalancers",

"elasticloadbalancing:DescribeInstanceHealth"

"Resource": "*"

}

]}

nAuthentication Credentials in Amazon Web Services

For management of Amazon Identity and Access Management (IAM) users and groups, you must be

configured with AWS Full Access Administrator credentials.

Configuring vRealize Automation

VMware, Inc. 19

When you create an AWS endpoint in vRA, you're prompted to enter a key and secret key. To obtain the

access key needed to create the Amazon endpoint, the administrator must either request a key from a

user who has AWS Full Access Administrator credentials or be additionally configured with the AWS Full

Access Administrator policy. See Create an Amazon Endpoint.

For information about enabling policies and roles, see the AWS Identity and Access Management (IAM)

section of Amazon Web Services product documentation.

Allow Amazon AWS to Communicate with the Software Bootstrap Agent and

Guest Agent

If you intend to provision application blueprints that contain Software, or if you want the ability to further

customize provisioned machines by using the guest agent, you must enable connectivity between your

Amazon AWS environment, where your machines are provisioned, and your vRealize Automation

environment, where the agents download packages and receive instructions.

When you use vRealize Automation to provision Amazon AWS machines with the vRealize Automation

guest agent and Software bootstrap agent, you must set up network-to-Amazon VPC connectivity so your

provisioned machines can communicate back to vRealize Automation to customize your machines.

For more information about Amazon AWS VPC connectivity options, see the Amazon AWS

documentation.

Using Optional Amazon Features

vRealize Automation supports several Amazon features, including Amazon Virtual Private Cloud, elastic

load balancers, elastic IP addresses, and elastic block storage.

Using Amazon Security Groups

Specify at least one security group when creating an Amazon reservation. Each available region requires

at least one specified security group.

A security group acts as a firewall to control access to a machine. Every region includes at least the

default security group. Administrators can use the Amazon Web Services Management Console to create

additional security groups, configure ports for Microsoft Remote Desktop Protocol or SSH, and set up a

virtual private network for an Amazon VPN.

When you create an Amazon reservation or configure a machine component in the blueprint, you can

choose from the list of security groups that are available to the specified Amazon account region. Security

groups are imported during data collection.

For information about creating and using security groups in Amazon Web Services, see Amazon

documentation.

Understanding Amazon Web Service Regions

Each Amazon Web Services account is represented by a cloud endpoint. When you create an

Amazon Elastic Cloud Computing endpoint in vRealize Automation, regions are collected as compute

resources. After the IaaS administrator selects compute resources for a business group, inventory and

state data collections occur automatically.

Configuring vRealize Automation

VMware, Inc. 20

Inventory data collection, which occurs automatically once a day, collects data about what is on a

compute resource, such as the following data:

nElastic IP addresses

nElastic load balancers

nElastic block storage volumes

State data collection occurs automatically every 15 minutes by default. It gathers information about the

state of managed instances, which are instances that vRealize Automation creates. The following are

examples of state data:

nWindows passwords

nState of machines in load balancers

nElastic IP addresses

A fabric administrator can initiate inventory and state data collection and disable or change the frequency

of inventory and state data collection.

Using Amazon Virtual Private Cloud

Amazon Virtual Private Cloud allows you to provision Amazon machine instances in a private section of

the Amazon Web Services cloud.

Amazon Web Services users can use Amazon VPC to design a virtual network topology according to your

specifications. You can assign an Amazon VPC in vRealize Automation. However, vRealize Automation

does not track the cost of using the Amazon VPC.

When you provision using Amazon VPC, vRealize Automation expects there to be a VPC subnet from

which Amazon obtains a primary IP address. This address is static until the instance is terminated. You

can also use the elastic IP pool to also attach an elastic IP address to an instance in

vRealize Automation. That would allow the user to keep the same IP if they are continually provisioning

and tearing down an instance in Amazon Web Services.

Use the AWS Management Console to create the following elements:

nAn Amazon VPC, which includes Internet gateways, routing table, security groups and subnets, and

available IP addresses.

nAn Amazon Virtual Private Network if users need to log in to Amazon machines instances outside of

the AWS Management Console.

vRealize Automation users can perform the following tasks when working with an Amazon VPC:

nA fabric administrator can assign an Amazon VPC to a cloud reservation. See Create an Amazon

EC2 Reservation.

nA machine owner can assign an Amazon machine instance to an Amazon VPC.

For more information about creating an Amazon VPC, see Amazon Web Services documentation.

Configuring vRealize Automation

VMware, Inc. 21

Using Elastic Load Balancers for Amazon Web Services

Elastic load balancers distribute incoming application traffic across Amazon Web Services instances.

Amazon load balancing enables improved fault tolerance and performance.

Amazon makes elastic load balancing available for machines provisioned using Amazon EC2 blueprints.

The elastic load balancer must be available in the Amazon Web Services,

Amazon Virtual Private Network and at the provisioning location. For example, if a load balancer is

available in us-east1c and a machine location is us-east1b, the machine cannot use the available load

balancer.

vRealize Automation does not create, manage, or monitor the elastic load balancers.

For information about creating Amazon elastic load balancers by using the

Amazon Web Services Management Console, see Amazon Web Services documentation.

Using Elastic IP Addresses for Amazon Web Services

Using an elastic IP address allows you to rapidly fail over to another machine in a dynamic

Amazon Web Services cloud environment. In vRealize Automation, the elastic IP address is available to

all business groups that have rights to the region.

An administrator can allocate elastic IP addresses to your Amazon Web Services account by using the

AWS Management Console. There are two groups of elastic IP addresses in any given a region, one

range is allocated for non-Amazon VPC instances and another range is for Amazon VPCs. If you allocate

addresses in a non-Amazon VPC region only, the addresses are not available in an Amazon VPC. The

reverse is also true. If you allocate addresses in an Amazon VPC only, the addresses are not available in

a non-Amazon VPC region.

The elastic IP address is associated with your Amazon Web Services account, not a particular machine,

but only one machine at a time can use the address. The address remains associated with your

Amazon Web Services account until you choose to release it. You can release it to map it to a specific

machine instance.

An IaaS architect can add a custom property to a blueprint to assign an elastic IP address to machines

during provisioning. Machine owners and administrators can view the elastic IP addresses assigned to

machines, and machine owners or administrators with rights to edit machines can assign an elastic IP

addresses after provisioning. However, if the address is already associated to a machine instance, and

the instance is part of the Amazon Virtual Private Cloud deployment, Amazon does not assign the

address.

For more information about creating and using Amazon elastic IP addresses, see Amazon Web Services

documentation.

Using Elastic Block Storage for Amazon Web Services

Amazon elastic block storage provides block level storage volumes to use with an Amazon machine

instance and Amazon Virtual Private Cloud. The storage volume can persist past the life of its associated

Amazon machine instance in the Amazon Web Services cloud environment.

Configuring vRealize Automation

VMware, Inc. 22

When you use an Amazon elastic block storage volume in conjunction with vRealize Automation, the

following caveats apply:

nYou cannot attach an existing elastic block storage volume when you provision a machine instance.

However, if you create a new volume and request more than one machine at a time, the volume is

created and attached to each instance. For example, if you create one volume named volume_1 and

request three machines, a volume is created for each machine. Three volumes named volume_1 are

created and attached to each machine. Each volume has a unique volume ID. Each volume is the

same size and in the same location.

nThe volume must be of the same operating system and in the same location as the machine to which

you attach it.

nvRealize Automation does not manage the primary volume of an elastic block storage-backed

instance.

For more information about Amazon elastic block storage, and details on how to enable it by using

Amazon Web Services Management Console, see Amazon Web Services documentation.

Scenario: Conﬁgure Network-to-Amazon VPC Connectivity for a Proof of

Concept Environment

As the IT professional setting up a proof of concept environment to evaluate vRealize Automation, you

want to temporarily configure network-to-Amazon VPC connectivity to support the vRealize Automation

Software feature.

Network-to-Amazon VPC connectivity is only required if you want to use the guest agent to customize

provisioned machines, or if you want to include Software components in your blueprints. For a production

environment, you would configure this connectivity officially through Amazon Web Services, but because

you are working in a proof of concept environment, you want to create temporary network-to-Amazon

VPC connectivity. You establish the SSH tunnel and then configure an Amazon reservation in

vRealize Automation to route through your tunnel.

Prerequisites

nInstall and fully configure vRealize Automation. See Installing and Configuring vRealize Automation

for the Rainpole Scenario.

nCreate an Amazon AWS security group called TunnelGroup and configure it to allow access on port

22.

nCreate or identify a CentOS machine in your Amazon AWS TunnelGroup security group and note the

following configurations:

nAdministrative user credentials, for example root.

nPublic IP address.

nPrivate IP address.

nCreate or identify a CentOS machine on the same local network as your vRealize Automation

installation.

Configuring vRealize Automation

VMware, Inc. 23

nInstall OpenSSH SSHD Server on both tunnel machines.

Procedure

1Log in to your Amazon AWS tunnel machine as the root user or similar.

2Disable iptables.

# service iptables save

# service iptables stop

# chkconfig iptables off

3Edit /etc/ssh/sshd_config to enable AllowTCPForwarding and GatewayPorts.

4Restart the service.

/etc/init.d/sshd restart

5Log in to the CentOS machine on the same local network as your vRealize Automation installation as

the root user.

6Invoke the SSH Tunnel from the local network machine to the Amazon AWS tunnel machine.

ssh -N -v -o "ServerAliveInterval 30" -o "ServerAliveCountMax 40" -o "TCPKeepAlive yes” \

-R 1442:vRealize_automation_appliance_fqdn:5480 \

-R 1443:vRealize_automation_appliance_fqdn:443 \

-R 1444:manager_service_fqdn:443 \

User of Amazon tunnel machine@Public IP Address of Amazon tunnel machine

You configured port forwarding to allow your Amazon AWS tunnel machine to access

vRealize Automation resources, but your SSH tunnel does not function until you configure an Amazon

reservation to route through the tunnel.

What to do next

1 Install the software bootstrap agent and the guest agent on a Windows or Linux reference machine to

create an Amazon Machine Image that your IaaS architects can use to create blueprints. See

Preparing for Software Provisioning.

2 Configure your Amazon reservation in vRealize Automation to route through your SSH tunnel. See

Scenario: Create an Amazon Reservation for a Proof of Concept Environment.

Preparing Red Hat OpenStack Network and Security Features

vRealize Automation supports several features in OpenStack including security groups and floating IP

addresses. Understand how these features work with vRealize Automation and configure them in your

environment.

Using OpenStack Security Groups

Security groups allow you to specify rules to control network traffic over specific ports.

Configuring vRealize Automation

VMware, Inc. 24

You can specify security groups in a reservation when requesting a machine. You can also specify an

existing or on-demand NSX security group in the design canvas.

Security groups are imported during data collection.

Each available region requires at least one specified security group. When you create a reservation, the

available security groups that are available to you in that region are displayed. Every region includes at

least the default security group.

Additional security groups must be managed in the source resource. For more information about

managing security groups for the various machines, see the OpenStack documentation.

Using Floating IP Addresses with OpenStack

You can assign floating IP addresses to a running virtual instance in OpenStack.

To enable assignment of floating IP addresses, you must configure IP forwarding and create a floating IP

pool in Red Hat OpenStack. For more information, see the Red Hat OpenStack documentation.

You must entitle the Associate Floating IP and Disassociate Floating IP actions to machine owners. The

entitled users can then associate a floating IP address to a provisioned machine from the external

networks attached to the machine by selecting an available address from the floating IP address pool.

After a floating IP address has been associated with a machine, a vRealize Automation user can select a

Disassociate Floating IP option to view the currently assigned floating IP addresses and disassociate an

address from a machine.

Preparing Your SCVMM Environment

Before you begin creating SCVMM templates and hardware profiles for use in vRealize Automation

machine provisioning, you must understand the naming restrictions on template and hardware profile

names, and configure SCVMM network and storage settings.

For related information about preparing your environment, see SCVMM requirements information in

Installing vRealize Automation.

For related information about machine provisioning, see Create a Hyper-V (SCVMM) Endpoint.

vRealize Automation does not support a deployment environment that uses an SCVMM private cloud

configuration. vRealize Automation cannot currently collect from, allocate to, or provision based on

SCVMM private clouds.

Template and Hardware Proﬁle Naming

Because of naming conventions that SCVMM and vRealize Automation use for templates and hardware

profiles, do not start your template or hardware profile names with the words temporary or profile. For

example, the following terms are ignored during data collection:

nTemporaryTemplate

nTemporary Template

nTemporaryProfile

Configuring vRealize Automation

VMware, Inc. 25

nTemporary Profile

nProfile

Required Network Conﬁguration for SCVMM Clusters

SCVMM clusters only expose virtual networks to vRealize Automation, so you must have a 1:1

relationship between your virtual and logical networks. Using the SCVMM console, map each logical

network to a virtual network and configure your SCVMM cluster to access machines through the virtual

network.

Required Storage Conﬁguration for SCVMM Clusters

On SCVMM Hyper-V clusters, vRealize Automation collects data and provisions on shared volumes only.

Using the SCVMM console, configure your clusters to use shared resource volumes for storage.

Required Storage Conﬁguration for Standalone SCVMM Hosts

For standalone SCVMM hosts, vRealize Automation collects data and provisions on the default virtual

machine path. Using the SCVMM console, configure default virtual machine paths for your standalone

hosts.

Conﬁgure Network-to-Azure VPC Connectivity

You must configure network-to-Azure connectivity if you want to use Software components in Azure

blueprints.

Prerequisites

nInstall and fully configure vRealize Automation. See Installing and Configuring vRealize Automation

for the Rainpole Scenario.

nCreate an Azure security group called TunnelGroup and configure it to allow access on port 22.

nCreate or identify a CentOS machine in your Azure TunnelGroup security group and note the

following configurations:

nAdministrative user credentials, for example root.

nPublic IP address.

nPrivate IP address.

nCreate or identify a CentOS machine on the same local network as your vRealize Automation

installation.

nInstall OpenSSH SSHD Server on both tunnel machines.

Procedure

1Log in to your Azure tunnel machine as the root user or similar.

Configuring vRealize Automation

VMware, Inc. 26

2Disable iptables.

# service iptables save

# service iptables stop

# chkconfig iptables off

3Edit /etc/ssh/sshd_config to enable AllowTCPForwarding and GatewayPorts.

4Restart the service.

/etc/init.d/sshd restart

5Log in to the CentOS machine on the same local network as your vRealize Automation installation as

the root user.

6Invoke the SSH Tunnel from the local network machine to the Azure tunnel machine.

ssh -N -v -o "ServerAliveInterval 30" -o "ServerAliveCountMax 40" -o "TCPKeepAlive yes” \

-R 1442:vRealize_automation_appliance_fqdn:5480 \

-R 1443:vRealize_automation_appliance_fqdn:443 \

-R 1444:manager_service_fqdn:443 \

User of Azure tunnel machine@Public IP Address of Azure tunnel machine

You configured port forwarding to allow your Azure tunnel machine to access vRealize Automation

resources, but your SSH tunnel does not function until you configure an Azure reservation to route

through the tunnel.

What to do next

1 Install the software bootstrap agent and the guest agent on a Windows or Linux reference machine to

create an Azure Machine Image that your IaaS architects can use to create blueprints. See Preparing

for Software Provisioning.

2 Configure your Azure reservation in vRealize Automation to route through your SSH tunnel. See

Create a Reservation for Microsoft Azure.

Preparing for Machine Provisioning

Depending on your environment and your method of machine provisioning, you might need to configure

elements outside of vRealize Automation.

For example, you might need to configure machine templates or machine images. You might also need to

configure NSX settings or run vRealize Orchestrator workflows.

For related information about specifying ports when preparing to provision machines, see Secure

Configuration Guide and Reference Architecture at VMware vRealize Automation Information.

Configuring vRealize Automation

VMware, Inc. 27

Choosing a Machine Provisioning Method to Prepare

For most machine provisioning methods, you must prepare some elements outside of

vRealize Automation.

Table 1‑5. Choosing a Machine Provisioning Method to Prepare

Scenario

Supported

Endpoint Agent Support Provisioning Method Pre-provisioning Preparations

Configure

vRealize Automation to run

custom Visual Basic scripts

as additional steps in the

machine life cycle, either

before or after machine

provisioning. For example,

you could use a pre-

provisioning script to

generate certificates or

security tokens before

provisioning, and then a

post-provisioning script to

use the certificates and

tokens after machine

provisioning.

You can run

Visual Basic

scripts with

any

supported

endpoint

except

Amazon

AWS.

Depends on the

provisioning

method you

choose.

Supported as an

additional step in any

provisioning method,

but you cannot use

Visual Basic scripts

with Amazon AWS

machines.

Checklist for Running Visual Basic

Scripts During Provisioning

Provision application

blueprints that automate

the installation,

configuration, and life cycle

management of

middleware and application

deployment components

such as Oracle, MySQL,

WAR, and database

Schemas.

nvSphere

nvCloud

Air

nvCloud

Director

nAmazon

AWS

n(Required)

Guest agent

n(Required)

Software

bootstrap agent

and guest

agent

nClone

nClone (for

vCloud Air or

vCloud Director)

nLinked clone

nAmazon Machine

Image

If you want the ability to use Software

components in your blueprints,

prepare a provisioning method that

supports the guest agent and

Software bootstrap agent. For more

information about preparing for

Software, see Preparing for Software

Provisioning.

Further customize

machines after provisioning

by using the guest agent.

All virtual

endpoints

and

Amazon

AWS.

n(Required)

Guest agent

n(Optional)

Software

bootstrap agent

and guest

agent

Supported for all

provisioning methods

except Virtual

Machine Image.

If you want the ability to customize

machines after provisioning, select a

provisioning method that supports

the guest agent. For more

information about the guest agent,

see Using vRealize Automation

Guest Agent in Provisioning.

Provision machines with no

guest operating system.

You can install an

operating system after

provisioning.

All virtual

machine

endpoints.

Not supported Basic No required pre-provisioning

preparations outside of

vRealize Automation.

Configuring vRealize Automation

VMware, Inc. 28

Table 1‑5. Choosing a Machine Provisioning Method to Prepare (Continued)

Scenario

Supported

Endpoint Agent Support Provisioning Method Pre-provisioning Preparations

Provision a space-efficient

copy of a virtual machine

called a linked clone.

Linked clones are based

on a snapshot of a VM and

use a chain of delta disks

to track differences from a

parent machine.

vSphere n(Optional)

Guest agent

n(Optional)

Software

bootstrap agent

and guest

agent

Linked Clone You must have an existing vSphere

virtual machine.

If you want to support Software, you

must install the guest agent and

software bootstrap agent on the

machine you intend to clone.

The VM snapshot identified in the

blueprint should be powered off

before you provision the linked clone

VMs.

Provision a space-efficient

copy of a virtual machine

by using

Net App FlexClone

technology.

vSphere (Optional) Guest

agent

NetApp FlexClone Checklist for Preparing to Provision

by Cloning

Provision machines by

cloning from a template

object created from an

existing Windows or Linux

machine, called the

reference machine, and a

customization object.

nvSphere

nKVM

(RHEV)

nSCVMM

n(Optional)

Guest agent

n(Optional for

vSphere only)

Software

bootstrap agent

and guest

agent

Clone See Checklist for Preparing to

Provision by Cloning.

If you want to support Software, you

must install the guest agent and

software bootstrap agent on the

vSpheremachine you intend to clone.

Provision vCloud Air or

vCloud Director machines

by cloning from a template

and customization object.

nvCloud

Air

nvCloud

Director

n(Optional)

Guest agent

n(Optional)

Software

bootstrap agent

and guest

agent

vCloud Air or

vCloud Director

Cloning

See Preparing for vCloud Air and

vCloud Director Provisioning.

If you want to support Software,

create a template that contains the

guest agent and software bootstrap

agent. For vCloud Air, configure

network connectivity between your

vRealize Automation environment

and your vCloud Air environment.

Provision a machine by

booting from an ISO

image, using a kickstart or

autoYaSt configuration file

and a Linux distribution

image to install the

operating system on the

machine.

nAll

virtual

endpoint

nRed Hat

OpenSt

ack

Guest agent is

installed as part of

the preparation

instructions.

Linux Kickstart Preparing for Linux Kickstart

Provisioning

Configuring vRealize Automation

VMware, Inc. 29

Table 1‑5. Choosing a Machine Provisioning Method to Prepare (Continued)

Scenario

Supported

Endpoint Agent Support Provisioning Method Pre-provisioning Preparations

Provision a machine and

pass control to an SCCM

task sequence to boot from

an ISO image, deploy a

Windows operating

system, and install the

vRealize Automation guest

agent.

All virtual

machine

endpoints.

Guest agent is

installed as part of

the preparation

instructions.

SCCM Preparing for SCCM Provisioning

Provision a machine by

booting into a WinPE

environment and installing

an operating system using

a Windows Imaging File

Format (WIM) image of an

existing Windows

reference machine.

nAll

virtual

endpoint

nRed Hat

OpenSt

ack

Guest agent is

required. When you

create the WinPE

image, you must

manually insert the

guest agent.

WIM Preparing for WIM Provisioning

Launch an instance from a

virtual machine image.

Red Hat

OpenStack

Not supported Virtual Machine Image See Preparing for Virtual Machine

Image Provisioning.

Launch an instance from

an Amazon Machine

Image.

Amazon

AWS

n(Optional)

Guest agent

n(Optional)

Software

bootstrap agent

and guest

agent

Amazon Machine

Image

Associate Amazon machine images

and instance types with your

Amazon AWS account.

If you want to support Software,

create an Amazon Machine Image

that contains the guest agent and

software bootstrap agent, and

configure network-to-VPC

connectivity between your

Amazon AWS and

vRealize Automation environments.

Checklist for Running Visual Basic Scripts During Provisioning

You can configure vRealize Automation to run your custom Visual Basic scripts as additional steps in the

machine life cycle, either before or after machine provisioning. For example, you could use a pre-

provisioning script to generate certificates or security tokens before provisioning, and then a post-

provisioning script to use the certificates and tokens after machine provisioning. You can run Visual Basic

scripts with any provisioning method, but you cannot use Visual Basic scripts with Amazon AWS

machines.

Configuring vRealize Automation

VMware, Inc. 30

Table 1‑6. Running Visual Basic Scripts During Provisioning Checklist

Task Location Details

Install and configure the EPI agent for

Visual Basic scripts.

Typically the Manager Service host See Installing vRealize Automation.

Create your visual basic scripts. Machine where EPI agent is installed vRealize Automation includes a sample

Visual Basic script

PrePostProvisioningExample.vbs in

the Scripts subdirectory of the EPI agent

installation directory. This script contains a

header to load all arguments into a

dictionary, a body in which you can

include your functions, and a footer to

return updated custom properties to

vRealize Automation.

When executing a Visual Basic script, the

EPI agent passes all machine custom

properties as arguments to the script. To

return updated property values to

vRealize Automation, place these

properties in a dictionary and call a

function provided by vRealize Automation.

Gather the information required to

include your scripts in blueprints.

Capture information and transfer to your

infrastructure architects

Note A fabric administrator can create

a property group by using the property

sets ExternalPreProvisioningVbScript

and ExternalPostProvisioningVbScript to

provide this required information. Doing

so makes it easier for blueprint architects

to include this information correctly in

their blueprints.

nThe complete path to the Visual Basic

script, including the filename and

extension. For example, %System

Drive%Program Files

(x86)\VMware\vCAC

Agents\EPI_Agents\Scripts\Send

Email.vbs.

nTo run a script before provisioning,

instruct infrastructure architects to

enter the complete path to the script

as the value of the custom property

ExternalPreProvisioningVbScrip

t. To run a script after provisioning,

they need to use the custom property

ExternalPostProvisioningVbScri

pt.

Using vRealize Automation Guest Agent in Provisioning

You can install the guest agent on reference machines to further customize a machine after deployment.

You can use the reserved guest agent custom properties to perform basic customizations such as adding

and formatting disks, or you can create your own custom scripts for the guest agent to run within the

guest operating system of a provisioned machine.

After the deployment is completed and the customization specification is run (if you provided one), the

guest agent creates an XML file that contains all of the deployed machine's custom properties

c:\VRMGuestAgent\site\workitem.xml, completes any tasks assigned to it with the guest agent

custom properties, and then deletes itself from the provisioned machine.

Configuring vRealize Automation

VMware, Inc. 31

You can write your own custom scripts for the guest agent to run on deployed machines, and use custom

properties on the machine blueprint to specify the location of those scripts and the order in which to run

them. You can also use custom properties on the machine blueprint to pass custom property values to

your scripts as parameters.

For example, you could use the guest agent to make the following customizations on deployed machines:

nChange the IP address

nAdd or format drives

nRun security scripts

nInitialize another agent, for example Puppet or Chef

You can also provide an encrypted string as a custom property in a command line argument. This allows

you to store encrypted information that the guest agent can decrypt and understand as a valid command

line argument.

Note The Linux guest agent assigns static IPs during the create and cloning actions for Linux Kickstart

and PXE provisioning relative to vRealize Automation custom properties in work items. The guest agent is

unable to accommodate the newer consistent network naming scheme, such as in Ubuntu 16.x, when it

assigns static IPs.

Your custom scripts do not have to be locally installed on the machine. As long as the provisioned

machine has network access to the script location, the guest agent can access and run the scripts. This

lowers maintenance costs because you can update your scripts without having to rebuild all of your

templates.

You can configure security settings for the virtual machines to be provisioned by specifying information in

a reservation, blueprint, or guest agent script. If the machines to be provisioned requires a guest agent,

you must add a security rule that contains that requirement to the reservation or the blueprint. For

example, if you use a default security policy that denies communication between all machines, and rely

on a separate security policy to allow communication between specific machines, the guest agent might

be unable to communicate with vRealize Automation during the customization phase. To avoid this

problem during machine provisioning, use a default security policy that allows communication during the

customization phase.

If you choose to install the guest agent to run custom scripts on provisioned machines, your blueprints

must include the appropriate guest agent custom properties. For example, if you install the guest agent

on a template for cloning, create a custom script that changes the provisioned machine's IP address, and

place the script in a shared location, you need to include a number of custom properties in your blueprint.

Configuring vRealize Automation

VMware, Inc. 32

Table 1‑7. Custom Properties for Changing IP Address of a Provisioned Machine with a Guest

Agent

Custom Property Description

VirtualMachine.Admin.UseGuestAgent Set to true to initialize the guest agent when the provisioned

machine is started.

VirtualMachine.Customize.WaitComplete Set to True to prevent the provisioning workflow from sending

work items to the guest agent until all customizations are

complete.

Configuring vRealize Automation

VMware, Inc. 33

Table 1‑7. Custom Properties for Changing IP Address of a Provisioned Machine with a Guest

Agent (Continued)

Custom Property Description

VirtualMachine.SoftwareN.ScriptPath Specifies the full path to an application's install script. The path

must be a valid absolute path as seen by the guest operating

system and must include the name of the script filename.

You can pass custom property values as parameters to the

script by inserting {CustomPropertyName} in the path string. For

example, if you have a custom property named ActivationKey

whose value is 1234, the script path is D:\InstallApp.bat –

key {ActivationKey}. The guest agent runs the command

D:\InstallApp.bat –key 1234. Your script file can then be

programmed to accept and use this value.

Insert {Owner} to pass the machine owner name to the script.

You can also pass custom property values as parameters to the

script by inserting {YourCustomProperty} in the path string. For

example, entering the

value \\vra-

scripts.mycompany.com\scripts\changeIP.bat runs the

changeIP.bat script from a shared location, but entering the

value \\vra-

scripts.mycompany.com\scripts\changeIP.bat

{VirtualMachine.Network0.Address} runs the changeIP

script but also passes the value of the

VirtualMachine.Network0.Address property to the script as

a parameter.

VirtualMachine.ScriptPath.Decrypt Allows vRealize Automation to obtain an encrypted string that is

passed as a properly formatted

VirtualMachine.SoftwareN.ScriptPath custom property

statement to the gugent command line.

You can provide an encrypted string, such as your password, as

a custom property in a command-line argument. This allows you

to store encrypted information that the guest agent can decrypt

and understand as a valid command-line argument. For

example, the VirtualMachine.Software0.ScriptPath =

c:\dosomething.bat password custom property string is not

secure as it contains an actual password.

To encrypt the password, you can create a vRealize Automation

custom property, for example MyPassword = password, and

enable encryption by selecting the available check box. The

guest agent decrypts the [MyPassword] entry to the value in the

custom property MyPassword and runs the script as

c:\dosomething.bat password.

nCreate custom property MyPassword = password where

password is the value of your actual password. Enable

encryption by selecting the available check box.

nSet custom property

VirtualMachine.ScriptPath.Decrypt as

VirtualMachine.ScriptPath.Decrypt = true.

Configuring vRealize Automation

VMware, Inc. 34

Table 1‑7. Custom Properties for Changing IP Address of a Provisioned Machine with a Guest

Agent (Continued)

Custom Property Description

nSet custom property

VirtualMachine.Software0.ScriptPath as

VirtualMachine.Software0.ScriptPath =

c:\dosomething.bat [MyPassword].

If you set VirtualMachine.ScriptPath.Decrypt to false, or

do not create the VirtualMachine.ScriptPath.Decrypt

custom property, then the string inside the square brackets

( [ and ]) is not decrypted.

For more information about custom properties you can use with the guest agent, see Custom Properties

Reference.

Conﬁguring the Guest Agent to Trust a Server

Installing the public key PEM file for the vRealize Automation Manager Service Host in the correct guest

agent folder is the most secure approach to configuring the guest agent to trust a server.

Locate the guest agent folder on each template for the cert.pem PEM file for the Manager Service Host

to trust a server:

nWindows guest agent folder on each template that uses the gugent

C:\VRMGuestAgent\cert.pem

nLinux guest agent folder on each template that uses the gugent

/usr/share/gugent/cert.pem

If you do not put the cert.pem file in this location, the template reference machine cannot use the

guest agent. For example, if you try to collect the public key information after the VM is started for by

altering scripts, you break the security condition.

Additional considerations apply, depending on your configured environment:

nFor WIM installations, you must add the public key PEM file contents to the console executable and

user interface. The console flag is /cert filename.

nFor RedHat kickstart installations, you must cut and paste the public key into the sample file,

otherwise the guest agent fails to execute.

nFor SCCM installation, the cert.pem file must reside in the VRMGuestAgent folder.

Configuring vRealize Automation

VMware, Inc. 35

nFor Linux vSphere installs, the cert.pem file must reside in the /usr/share/gugent folder.

Note You can optionally install software and guest agents together by downloading the following script

from https://APPLIANCE/software/index.html. The script allows you to handle acceptance of SSL

certificate fingerprints as you create the templates.

nLinux

prepare_vra_template.sh

nWindows

prepare_vra_template.ps1

If you install the software and guest agent together, you do not need to use the instructions in Install the

Guest Agent on a Linux Reference Machine or Install the Guest Agent on a Windows Reference Machine.

Install the Guest Agent on a Linux Reference Machine

Install the Linux guest agent on your reference machines to further customize machines after deployment.

Prerequisites

nIdentify or create the reference machine.

nThe guest agent files you download contain both tar.gz and RPM package formats. If your operating

system cannot install tar.gz or RPM files, use a conversion tool to convert the installation files to your

preferred package format.

nEstablish secure trust between the guest agent and your Manager Service machine. See Configuring

the Guest Agent to Trust a Server.

Procedure

1Navigate to the vRealize Automation appliance management console page.

For example: https://va-hostname.domain.com.

2Click Guest and software agents page in the vRealize Automation component installation section of

the page.

For example: https://va-hostname.domain.com/software/index.html.

The Guest and Software Agent Installers page opens, displaying links to available downloads.

3Click Linux guest agent packages in the guest agent installers section of the page to download and

save the LinuxGuestAgentPkgs.zip file.

4Unpack the downloaded LinuxGuestAgentPkgs.zip file to create the VraLinuxGuestAgent folder.

Configuring vRealize Automation

VMware, Inc. 36

5Install the guest agent package that corresponds to the guest operating system you are deploying

during provisioning.

a Navigate to the VraLinuxGuestAgent subdirectory that corresponds to the guest operating

system to deploy during provisioning, for example rhel32.

b Locate your preferred package format or convert a package to your preferred package format.

c Install the guest agent package on your reference machine.

For example, to install the files from the RPM package, run rpm -i gugent-

gugent-7.1.0-4201531.i386.rpm.

6Configure the guest agent to communicate with the Manager Service by running installgugent.sh

Manager_Service_Hostname_fdqn:portnumber ssl platform.

The default port number for the Manager Service is 443. Accepted platform values are ec2, vcd, vca,

and vsphere.

Option Description

If you are using a load balancer Enter the fully qualified domain name and port number of your Manager Service

load balancer. For example:

cd /usr/share/gugent

./installgugent.sh load_balancer_manager_service.mycompany.com:

443 ssl ec2

With no load balancer Enter the fully qualified domain name and port number of your Manager Service

machine. For example:

cd /usr/share/gugent

./installgugent.sh manager_service_machine.mycompany.com:443

ssl vsphere

7If deployed machines are not already configured to trust the Manager Service SSL certificate, you

must install the cert.pem file on your reference machine to establish trust.

nFor the most secure approach, obtain the cert.pem certificate and manually install the file on the

reference machine.

nFor a more convenient approach, you can connect to the manager service load balancer or

manager service machine and download the cert.pem certificate.

Option Description

If you are using a load balancer As the root user on the reference machine, run the following command:

echo | openssl s_client -connect

manager_service_load_balancer.mycompany.com:443 | sed -ne '/-

BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.pem

With no load balancer As the root user on the reference machine, run the following command:

echo | openssl s_client -connect

manager_service_machine.mycompany.com:443 | sed -ne '/-BEGIN

CERTIFICATE-/,/-END CERTIFICATE-/p' > cert.pem

Configuring vRealize Automation

VMware, Inc. 37

8If you are installing the guest agent on a Ubuntu operating system, create symbolic links for shared

objects by running one of the following command sets.

Option Description

64-bit systems cd /lib/x86_64-linux-gnu

sudo ln -s libssl.so.1.0.0 libssl.so.10

sudo ln -s libcrypto.so.1.0.0 libcrypto.so.10

32-bit systems cd /lib/i386-linux-gnu

sudo ln -s libssl.so.1.0.0 libssl.so.10

sudo ln -s libcrypto.so.1.0.0 libcrypto.so.10

What to do next

Convert your reference machine into a template for cloning, an Amazon Machine Image, or a snapshot

that your IaaS architects can use when creating blueprints.

Install the Guest Agent on a Windows Reference Machine

Install the vRealize Automation Windows guest agent on a Windows reference machine to run as a

Windows service and enable further customization of machines.

Prerequisites

nIdentify or create the reference machine.

nEstablish secure trust between the guest agent and your Manager Service machine. See Configuring

the Guest Agent to Trust a Server.

Procedure

1Navigate to the vRealize Automation appliance Guest and Software Agent Installers page:

https://vrealize-automation-appliance-FQDN/software

2Under Guest Agent Installers, download and save the 32-bit or 64-bit executable to the root of the

C: drive.

Note There is a command-line alternative to this procedure for guest agent installation. Instead of

downloading the executables, you may go to Windows Software Installers on the Guest and

Software Agent Installers page. There, you can download and run the prepare_vra_template.ps1

PowerShell script:

PowerShell -NoProfile -ExecutionPolicy Bypass -Command prepare_vra_template.ps1

3Extract the Windows guest agent files by running the executable.

Extraction creates C:\VRMGuestAgent and adds the files.

Do not rename C:\VRMGuestAgent.

Configuring vRealize Automation

VMware, Inc. 38

4Configure the guest agent to communicate with the Manager Service.

a Open an elevated command prompt.

b Navigate to C:\VRMGuestAgent.

c Put the trusted Manager Service PEM file in the C:\VRMGuestAgent\ directory to configure the

guest agent to trust your Manager Service machine.

d Run winservice -i -h Manager_Service_Hostname_fdqn:portnumber -p ssl.

The default port number for the Manager Service is 443.

Option Description

If you are using a load balancer Enter the fully qualified domain name and port number of your Manager

Service load balancer. For example, winservice -i -h

load_balancer_manager_service.mycompany.com:443 -p ssl.

With no load balancer Enter the fully qualified domain name and port number of your Manager

Service machine. For example, winservice -i -h

manager_service_machine.mycompany.com:443 -p ssl.

If you are preparing an Amazon

machine image

You need to specify that you are using Amazon. For example, winservice -i

-h manager_service_machine.mycompany.com:443:443 -p ssl -c ec2

The name of the Windows service is VCACGuestAgentService. You can find the installation log VCAC-

GuestAgentService.log in C:\VRMGuestAgent.

What to do next

Convert your reference machine into a template for cloning, an Amazon machine image, or a snapshot so

your IaaS architects can use your template when creating blueprints.

Checklist for Preparing to Provision by Cloning

You must perform some preparation outside of vRealize Automation to create the template and the

customization objects used to clone Linux and Windows virtual machines.

Cloning requires a template to clone from, created from a reference machine.

Configuring vRealize Automation

VMware, Inc. 39

TEMPLATE

Identify or create

a reference machine.

Yes

Convert your reference

machine to a template.

Install the guest agent and

the software bootstrap

agent.

Install the guest agent.

Install VMware Tools.

Yes

Are you working in

vCenter Server?

Do you want

to support software

components in

your blueprints?

Do you want

the ability to

customize

machines after

deployment?

Yes

If you are provisioning a Windows machine by cloning, the only way to join the provisioned machine to an

Active Directory domain is by using the customization specification from vCenter Server or by including a

guest operating system profile with your SCVMM template. Machines provisioned by cloning cannot be

placed in an Active Directory container during provisioning. You must do this manually after provisioning.

Configuring vRealize Automation

VMware, Inc. 40

Table 1‑8. Checklist for Preparing to Provision by Cloning

Task Location Details

Identify or create the reference machine. Hypervisor See the documentation provided by your

hypervisor.

(Optional) If you want your clone template to

support Software components, install the

vRealize Automation guest agent and software

bootstrap agent on your reference machine.

Reference machine For Windows reference machines, see Prepare

a Windows Reference Machine to Support

Software.

For Linux reference machines, see Prepare a

Linux Reference Machine to Support Software.

(Optional) If you do not need your clone template

to support Software components, but you do want

the ability to customize deployed machines, install

the vRealize Automation guest agent on your

reference machine.

Reference machine See Using vRealize Automation Guest Agent in

Provisioning.

If you are working in a vCenter Server

environment, install VMware Tools on the reference

machine.

vCenter Server See the VMware Tools documentation.

Use the reference machine to create a template

for cloning.

Hypervisor The reference machine may be powered on or

off. If you are cloning in vCenter Server, you can

use a reference machine directly without

creating a template.

See the documentation provided by your

hypervisor.

Create the customization object to configure

cloned machines by applying System Preparation

Utility information or a Linux customization.

Hypervisor If you are cloning for Linux you can install the

Linux guest agent and provide external

customization scripts instead of creating a

customization object. If you are cloning with

vCenter Server, you must provide the

customization specification as the customization

object.

See the documentation provided by your

hypervisor.

Gather the information required to create

blueprints that clone your template.

Capture information and

transfer to your IaaS

architects.

See Worksheet for Virtual Provisioning by

Cloning.

Worksheet for Virtual Provisioning by Cloning

Complete the knowledge transfer worksheet to capture information about the template, customizations,

and custom properties required to create clone blueprints for the templates you prepared in your

environment. Not all of this information is required for every implementation. Use this worksheet as a

guide, or copy and paste the worksheet tables into a word processing tool for editing.

Configuring vRealize Automation

VMware, Inc. 41

Required Template and Reservation Information

Table 1‑9. Template and Reservation Information Worksheet

Required Information My Value Details

Template name

Reservations on which the template

is available, or reservation policy to

apply

To avoid errors during provisioning, ensure that

the template is available on all reservations or

create reservation policies that architects can

use to restrict the blueprint to reservations

where the template is available.

(vSphere only) Type of cloning

requested for this template

nClone

nLinked Clone

nNetApp FlexClone

Customization specification name

(Required for cloning with static IP

addresses)

You cannot perform customizations of Windows

machines without a customization specification

object.

(SCVMM only) ISO name

(SCVMM only) Virtual hard disk

(SCVMM only) Hardware profile to

attach to provisioned machines

Required Property Groups

You can complete the custom property information sections of the worksheet, or you can create property

groups and ask architects to add your property groups to their blueprints instead of numerous individual

custom properties.

Required vCenter Server Operating System

You must supply the guest operating system custom property for vCenter Server provisioning.

Table 1‑10. vCenter Server Operating System

Custom Property My Value Description

VMware.VirtualCenter.OperatingSy

stem

Specifies the vCenter Server guest

operating system version

(VirtualMachineGuestOsIdentifier)

with which vCenter Server creates the

machine. This operating system version

must match the operating system version

to be installed on the provisioned machine.

Administrators can create property groups

using one of several property sets, for

example,

VMware[OS_Version]Properties, that

are predefined to include the correct

VMware.VirtualCenter.OperatingSyst

em values. This property is for virtual

provisioning.

Configuring vRealize Automation

VMware, Inc. 42

Visual Basic Script Information

If you configured vRealize Automation to run your custom Visual Basic scripts as additional steps in the

machine life cycle, you must include information about the scripts in the blueprint.

Note A fabric administrator can create a property group by using the property sets

ExternalPreProvisioningVbScript and ExternalPostProvisioningVbScript to provide this required

information. Doing so makes it easier for blueprint architects to include this information correctly in their

blueprints.

Table 1‑11. Visual Basic Script Information

Custom Property My Value Description

ExternalPreProvisioningVbScript Run a script before provisioning. Enter the

complete path to the script including the

filename and extension. %System Drive

%Program Files (x86)\VMware\vCAC

Agents\EPI_Agents\Scripts\SendEmai

l.vbs.

ExternalPostProvisioningVbScript Run a script after provisioning. Enter the

complete path to the script including the

filename and extension. %System Drive

%Program Files (x86)\VMware\vCAC

Agents\EPI_Agents\Scripts\SendEmai

l.vbs

Linux Guest Agent Customization Script Information

If you configured your Linux template to use the guest agent for running customization scripts, you must

include information about the scripts in the blueprint.

Configuring vRealize Automation

VMware, Inc. 43

Table 1‑12. Linux Guest Agent Customization Script Information Worksheet

Custom Property My Value Description

Linux.ExternalScript.Name Specifies the name of an optional

customization script, for example

config.sh, that the Linux guest agent

runs after the operating system is

installed. This property is available for

Linux machines cloned from templates on

which the Linux agent is installed.

If you specify an external script, you must

also define its location by using the

Linux.ExternalScript.LocationType

and Linux.ExternalScript.Path

properties.

Linux.ExternalScript.LocationTy

Specifies the location type of the

customization script named in the

Linux.ExternalScript.Name property.

This can be either local or nfs.

You must also specify the script location

using the Linux.ExternalScript.Path

property. If the location type is nfs, also

use the Linux.ExternalScript.Server

property.

Linux.ExternalScript.Server Specifies the name of the NFS server, for

example lab-ad.lab.local, on which the

Linux external customization script

named in Linux.ExternalScript.Name

is located.

Linux.ExternalScript.Path Specifies the local path to the Linux

customization script or the export path to

the Linux customization on the NFS

server. The value must begin with a

forward slash and not include the file

name, for

example /scripts/linux/config.sh.

Other Guest Agent Custom Properties

If you installed the guest agent on your reference machine, you can use custom properties to further

customize machines after deployment.

Configuring vRealize Automation

VMware, Inc. 44

Table 1‑13. Custom Properties for Customizing Cloned Machines with a Guest Agent

Worksheet

Custom Property My Value Description

VirtualMachine.Admin.AddOwnerToAd

mins

Set to True (default) to add the machine’s

owner, as specified by the

VirtualMachine.Admin.Owner property, to

the local administrators group on the

machine.

VirtualMachine.Admin.AllowLogin Set to True (default) to add the machine

owner to the local remote desktop users

group, as specified by the

VirtualMachine.Admin.Owner property.

VirtualMachine.Admin.UseGuestAgen

If the guest agent is installed as a service on

a template for cloning, set to True on the

machine blueprint to enable the guest agent

service on machines cloned from that

template. When the machine is started, the

guest agent service is started. Set to False

to disable the guest agent. If set to False,

the enhanced clone workfow will not use the

guest agent for guest operating system

tasks, reducing its functionality to

VMwareCloneWorkflow. If not specified or

set to anything other than False, the

enhanced clone workflow sends work items

to the guest agent.

VirtualMachine.DiskN.Active Set to True (default) to specify that the

machine's disk N is active. Set to False to

specify that the machine's disk N is not

active.

VirtualMachine.DiskN.Label Specifies the label for a machine’s disk N.

The disk label maximum is 32 characters.

Disk numbering must be sequential. When

used with a guest agent, specifies the label

of a machine's disk N inside the guest

operating system.

VirtualMachine.DiskN.Letter Specifies the drive letter or mount point of a

machine’s disk N. The default is C. For

example, to specify the letter D for Disk 1,

define the custom property as

VirtualMachine.Disk1.Letter and enter

the value D. Disk numbering must be

sequential. When used in conjunction with a

guest agent, this value specifies the drive

letter or mount point under which an

additional disk N is mounted by the guest

agent in the guest operating system.

Configuring vRealize Automation

VMware, Inc. 45

Table 1‑13. Custom Properties for Customizing Cloned Machines with a Guest Agent

Worksheet (Continued)

Custom Property My Value Description

VirtualMachine.Admin.CustomizeGue

stOSDelay

Specifies the time to wait after customization

is complete and before starting the guest

operating system customization. The value

must be in HH:MM:SS format. If the value is

not set, the default value is one minute

(00:01:00). If you choose not to include this

custom property, provisioning can fail if the

virtual machine reboots before guest agent

work items are completed, causing

provisioning to fail.

VirtualMachine.Customize.WaitComp

lete

Set to True to prevent the provisioning

workflow from sending work items to the

guest agent until all customizations are

complete.

VirtualMachine.SoftwareN.Name Specifies the descriptive name of a software

application N or script to install or run during

provisioning. This is an optional and

information-only property. It serves no real

function for the enhanced clone workflow or

the guest agent but it is useful for a custom

software selection in a user interface or for

software use reporting.

VirtualMachine.SoftwareN.ScriptPa

Specifies the full path to an application's

install script. The path must be a valid

absolute path as seen by the guest

operating system and must include the

name of the script filename.

You can pass custom property values as

parameters to the script by inserting

{CustomPropertyName} in the path string.

For example, if you have a custom property

named ActivationKey whose value is

1234, the script path is

D:\InstallApp.bat –key

{ActivationKey}. The guest agent runs

the command D:\InstallApp.bat –key

1234. Your script file can then be

programmed to accept and use this value.

Configuring vRealize Automation

VMware, Inc. 46

Table 1‑13. Custom Properties for Customizing Cloned Machines with a Guest Agent

Worksheet (Continued)

Custom Property My Value Description

VirtualMachine.SoftwareN.ISOName Specifies the path and filename of the ISO

file relative to the datastore root. The format

is /folder_name/subfolder_name/file_

name.iso. If a value is not specified, the

ISO is not mounted.

VirtualMachine.SoftwareN.ISOLocat

ion

Specifies the storage path that contains the

ISO image file to be used by the application

or script. Format the path as it appears on

the host reservation, for example

netapp-1:it_nfs_1. If a value is not

specified, the ISO is not mounted.

Networking Custom Properties

You can specify configuration for specific network devices on a machine by using custom properties.

Common networking-related custom properties are listed in the following table. For additional and related

custom properties, see Custom Properties for Clone Blueprints and Custom Properties for Networking in

Custom Properties Reference.

Table 1‑14. Custom Properties for Networking Conﬁguration

Custom Property My Value Description

VirtualMachine.NetworkN.Address Specifies the IP address of network

device N in a machine provisioned with a

static IP address.

VirtualMachine.NetworkN.MacAddr

essType

Indicates whether the MAC address of

network device N is generated or user-

defined (static). This property is available

for cloning.

The default value is generated. If the

value is static, you must also use

VirtualMachine.NetworkN.MacAddres

s to specify the MAC address.

VirtualMachine.NetworkN custom

properties are specific to individual

blueprints and machines. When a

machine is requested, network and IP

address allocation is performed before

the machine is assigned to a reservation.

Because blueprints are not guaranteed to

be allocated to a specific reservation, do

not use this property on a reservation.

This property is not supported for on-

demand NAT or on-demand routed

networks.

Configuring vRealize Automation

VMware, Inc. 47

Table 1‑14. Custom Properties for Networking Conﬁguration (Continued)

Custom Property My Value Description

VirtualMachine.NetworkN.MacAddr

ess

Specifies the MAC address of a network

device N. This property is available for

cloning.

If the value of

VirtualMachine.NetworkN.MacAddres

sType is generated, this property contains

the generated address.

If the value of

VirtualMachine.NetworkN.MacAddres

sType is static, this property specifies the

MAC address. For virtual machines

provisioned on ESX server hosts, the

address must be in the range specified by

VMware. For details, see vSphere

documentation.

VirtualMachine.NetworkN custom

properties are specific to individual

blueprints and machines. When a

machine is requested, network and IP

address allocation is performed before

the machine is assigned to a reservation.

Because blueprints are not guaranteed to

be allocated to a specific reservation, do

not use this property on a reservation.

This property is not supported for on-

demand NAT or on-demand routed

networks.

Configuring vRealize Automation

VMware, Inc. 48

Table 1‑14. Custom Properties for Networking Conﬁguration (Continued)

Custom Property My Value Description

VirtualMachine.NetworkN.Name Specifies the name of the network to

connect to, for example the network

device N to which a machine is attached.

This is equivalent to a network interface

card (NIC).

By default, a network is assigned from the

network paths available on the

reservation on which the machine is

provisioned. Also see

VirtualMachine.NetworkN.AddressTy

pe and

VirtualMachine.NetworkN.ProfileNa

me.

You can ensure that a network device is

connected to a specific network by setting

the value of this property to the name of a

network on an available reservation. For

example, if you give properties for N= 0

and 1, you get 2 NICs and their assigned

value, provided the network is selected in

the associated reservation.

VirtualMachine.NetworkN custom

properties are specific to blueprints and

machines. When a machine is requested,

network and IP address allocation is

performed before the machine is

assigned to a reservation. Because

blueprints are not guaranteed to be

allocated to a specific reservation, do not

use this property on a reservation. This

property is not supported for on-demand

NAT or on-demand routed networks.

For an example of how to use this custom

property to dynamically set

VirtualMachine.Network0.Name based

on a consumer's selection from a list of

predefined available networks, see the

Adding a Network Selection Drop-Down

in vRA 7 blog post.

Configuring vRealize Automation

VMware, Inc. 49

Table 1‑14. Custom Properties for Networking Conﬁguration (Continued)

Custom Property My Value Description

VirtualMachine.NetworkN.PortID Specifies the port ID to use for network

device N when using a dvPort group with

a vSphere distributed switch.

VirtualMachine.NetworkN custom

properties are specific to individual

blueprints and machines. When a

machine is requested, network and IP

address allocation is performed before

the machine is assigned to a reservation.

Because blueprints are not guaranteed to

be allocated to a specific reservation, do

not use this property on a reservation.

This property is not supported for on-

demand NAT or on-demand routed

networks.

VirtualMachine.NetworkN.Profile

Name and

VirtualMachine.NetworkN.Network

ProfileName

Specifies the name of a network profile

from which to assign a static IP address

to network device N or from which to

obtain the range of static IP addresses

that can be assigned to network device N

of a cloned machine, where N=0 for the

first device, 1 for the second, and so on.

nUse

VirtualMachine.NetworkN.Profil

eName to select any network from the

reservation regardless of whether it

has a corresponding network profile.

nUse

VirtualMachine.NetworkN.Networ

kProfileName to only select

networks that have a corresponding

network profile with the same name.

The network profile that the property

points to is used to allocate an IP

address. However, the provisioned

machine is attached to any network that is

selected in the reservation using a round-

robin fashion model.

Configuring vRealize Automation

VMware, Inc. 50

Table 1‑14. Custom Properties for Networking Conﬁguration (Continued)

Custom Property My Value Description

nVirtualMachine.NetworkN.Subn

etMask

nVirtualMachine.NetworkN.Gate

way

nVirtualMachine.NetworkN.Prim

aryDns

nVirtualMachine.NetworkN.Seco

ndaryDns

nVirtualMachine.NetworkN.Prim

aryWins

nVirtualMachine.NetworkN.Seco

ndaryWins

nVirtualMachine.NetworkN.DnsS

uffix

nVirtualMachine.NetworkN.DnsS

earchSuffixes

Appending a name allows you to create

multiple versions of a custom property.

For example, the following properties

might list load balancing pools set up for

general use and machines with high,

moderate, and low performance

requirements:

nVCNS.LoadBalancerEdgePool.Name

s.moderate

nVCNS.LoadBalancerEdgePool.Name

s.high

nVCNS.LoadBalancerEdgePool.Name

s.low

Configures attributes of the network

profile specified in

VirtualMachine.NetworkN.ProfileNa

me.

VCNS.LoadBalancerEdgePool.Names.

name

Specifies the NSX load balancing pools to

which the virtual machine is assigned

during provisioning. The virtual machine

is assigned to all service ports of all

specified pools. The value is an edge/pool

name or a list of edge/pool names

separated by commas. Names are case-

sensitive.

Appending a name allows you to create

multiple versions of a custom property.

For example, the following properties

might list load balancing pools set up for

general use and machines with high,

moderate, and low performance

requirements:

nVCNS.LoadBalancerEdgePool.Name

s.moderate

nVCNS.LoadBalancerEdgePool.Name

s.high

nVCNS.LoadBalancerEdgePool.Name

s.low

Configuring vRealize Automation

VMware, Inc. 51

Table 1‑14. Custom Properties for Networking Conﬁguration (Continued)

Custom Property My Value Description

VCNS.SecurityGroup.Names.name Specifies the NSX security group or

groups to which the virtual machine is

assigned during provisioning. The value is

a security group name or a list of names

separated by commas. Names are case-

sensitive.

Appending a name allows you to create

multiple versions of the property, which

can be used separately or in combination.

For example, the following properties can

list security groups intended for general

use, for the sales force, and for support:

nVCNS.SecurityGroup.Names

nVCNS.SecurityGroup.Names.sales

nVCNS.SecurityGroup.Names.suppo

VCNS.SecurityTag.Names.name Specifies the NSX security tag or tags to

which the virtual machine is associated

during provisioning. The value is a

security tag name or a list of names

separated by commas. Names are case-

sensitive.

Appending a name allows you to create

multiple versions of the property, which

can be used separately or in combination.

For example, the following properties can

list security tags intended for general use,

for the sales force, and for support:

nVCNS.SecurityTag.Names

nVCNS.SecurityTag.Names.sales

nVCNS.SecurityTag.Names.support

Preparing for vCloud Air and vCloud Director Provisioning

To prepare for provisioning vCloud Air and vCloud Director machines by using vRealize Automation, you

must configure the organization virtual data center with templates and customization objects.

To provision vCloud Air and vCloud Director resources using vRealize Automation, the organization

requires a template to clone from that consists of one or more machine resources.

Configuring vRealize Automation

VMware, Inc. 52

Templates that are to be shared across organizations must be public. Only reserved templates are

available to vRealize Automation as a cloning source.

Note When you create a blueprint by cloning from a template, that template's unique identifier becomes

associated with the blueprint. When the blueprint is published to the vRealize Automation catalog and

used in the provisioning and data collection processes, the associated template is recognized. If you

delete the template in vCloud Air or vCloud Director, subsequent vRealize Automation provisioning and

data collection fails because the associated template no longer exists. Instead of deleting and recreating

a template, for example to upload an updated version, replace the template using the vCloud Air

vCloud Director template replacement process. Using vCloud Air or vCloud Director to replace the

template, rather than deleting and recreating the template, keeps the template's unique ID intact and

allows provisioning and data collection to continue functioning.

The following overview illustrates the steps you need to perform before you use vRealize Automation to

create endpoints and define reservations and blueprints. For more information about these administrative

tasks, see vCloud Air and vCloud Director product documentation.

1 In vCloud Air or vCloud Director, create a template for cloning and add it to the organization catalog.

2 In vCloud Air or vCloud Director, use the template to specify custom settings such as passwords,

domain, and scripts for the guest operating system on each machine.

You can use vRealize Automation to override some of these settings.

Customization can vary depending on the guest operating system of the resource.

3 In vCloud Air or vCloud Director, configure the catalog to be shared with everyone in the organization.

In vCloud Air or vCloud Director, configure account administrator access to applicable organizations

to allow all users and groups in the organization to have access to the catalog. Without this sharing

designation, the catalog templates are not be visible to endpoint or blueprint architects in

vRealize Automation.

4 Gather the following information so that you can include it in blueprints:

nName of the vCloud Air or vCloud Director template.

nAmount of total storage specified for the template.

Preparing for Linux Kickstart Provisioning

Linux Kickstart provisioning uses a configuration file to automate a Linux installation on a newly

provisioned machine. To prepare for provisioning you must create a bootable ISO image and a Kickstart

or autoYaST configuration file.

The following is a high-level overview of the steps required to prepare for Linux Kickstart provisioning:

1 Verify that a DHCP server is available on the network. vRealize Automation cannot provision

machines by using Linux Kickstart provisioning unless DHCP is available.

2 Prepare the configuration file. In the configuration file, you must specify the locations of the

vRealize Automation server and the Linux agent installation package. See Prepare the Linux Kickstart

Configuration Sample File.

Configuring vRealize Automation

VMware, Inc. 53

3 Edit the isolinux/isolinux.cfg or loader/isolinux.cfg to specify the name and location of the

configuration file and the appropriate Linux distribution source.

4 Create the boot ISO image and save it to the location required by your virtualization platform. See the

documentation provided by your hypervisor for information about the required location.

5 (Optional) Add customization scripts.

a To specify post-installation customization scripts in the configuration file, see Specify Custom

Scripts in a kickstart/autoYaST Configuration File.

b To call Visual Basic scripts in blueprint, see Checklist for Running Visual Basic Scripts During

Provisioning.

6 Gather the following information so that blueprint architects can include it in their blueprints:

a The name and location of the ISO image.

b For vCenter Server integrations, the vCenter Server guest operating system version with which

vCenter Server is to create the machine.

Note You can create a property group with the property set BootIsoProperties to include the required

ISO information. This makes it easier to include this information correctly on blueprints.

Prepare the Linux Kickstart Conﬁguration Sample File

vRealize Automation provides sample configuration files that you can modify and edit to suit your needs.

There are several changes required to make the files usable.

Procedure

1Navigate to the vRealize Automation appliance management console page.

For example: https://va-hostname.domain.com.

2Click Guest and software agents page in the vRealize Automation component installation section of

the page.

For example: https://va-hostname.domain.com/software/index.html.

The Guest and Software Agent Installers page opens, displaying links to available downloads.

3Click Linux guest agent packages in the guest agent installers section of the page to download and

save the LinuxGuestAgentPkgs.zip file.

4Unpack the downloaded LinuxGuestAgentPkgs.zip file to create the VraLinuxGuestAgent folder.

5Navigate to the VraLinuxGuestAgent subdirectory that corresponds to the guest operating system to

deploy during provisioning.

For example: rhel32.

6Open a file in the samples subdirectory that corresponds to your target system.

For example, samples/sample-https-rhel6-x86.cfg.

Configuring vRealize Automation

VMware, Inc. 54

7Replace all instances of the string host=dcac.example.net with the IP address or fully qualified

domain name and port number for the Manager Service or the load balancer for the Manager Service.

Platform Required Format

vSphere ESXi IP Address, for example: --host=172.20.9.59

vSphere ESX IP Address, for example: --host=172.20.9.58

SUSE 10 IP Address, for example: --host=172.20.9.57

All others FQDN, for example: --host=mycompany-host1.mycompany.local:443

8Locate each instance of gugent.rpm or gugent.tar.gz and replace the URL rpm.example.net

with the location of the guest agent package.

For example:

rpm -i nfs:172.20.9.59/suseagent/gugent.rpm

9Save the file to a location accessible to newly provisioned machines.

Specify Custom Scripts in a kickstart/autoYaST Conﬁguration File

You can modify the configuration file to copy or install custom scripts onto newly provisioned machines.

The Linux agent runs the scripts at the specified point in the workflow.

Your script can reference any of the ./properties.xml files in

the /usr/share/gugent/site/workitem directories.

Prerequisites

nPrepare a kickstart or autoYaST configuration file. See Prepare the Linux Kickstart Configuration

Sample File.

nYour script must return a non-zero value on failure to prevent machine provisioning failure.

Procedure

1Create or identify the script you want to use.

2Save the script as NN_scriptname.

NN is a two digit number. Scripts are executed in order from lowest to highest. If two scripts have the

same number, the order is alphabetical based on scriptname.

3Make your script executable.

4Locate the post-installation section of your kickstart or autoYaST configuration file.

In kickstart, this is indicated by %post. In autoYaST, this is indicated by post-scripts.

Configuring vRealize Automation

VMware, Inc. 55

5Modify the post-installation section of the configuration file to copy or install your script into

the /usr/share/gugent/site/workitem directory of your choice.

Custom scripts are most commonly run for virtual kickstart/autoYaST with the work items SetupOS

(for create provisioning) and CustomizeOS (for clone provisioning), but you can run scripts at any

point in the workflow.

For example, you can modify the configuration file to copy the script 11_addusers.sh to

the /usr/share/gugent/site/SetupOS directory on a newly provisioned machine by using the

following command:

cp nfs:172.20.9.59/linuxscripts/11_addusers.sh /usr/share/gugent/site/SetupOS

The Linux agent runs the script in the order specified by the work item directory and the script file name.

Preparing for SCCM Provisioning

vRealize Automation boots a newly provisioned machine from an ISO image, and then passes control to

the specified SCCM task sequence.

SCCM provisioning is supported for the deployment of Windows operating systems. Linux is not

supported. Software distribution and updates are not supported.

The following is a high-level overview of the steps required to prepare for SCCM provisioning:

1 Consult with your network administrator to ensure that the following network requirements are met:

nCommunication with SCCM requires the NetBios name of the SCCM server. At least one

Distributed Execution Manager (DEM) must be able to resolve the fully qualified name of the

SCCM server to its NetBios name.

nThe SCCM server and the vRealize Automation server must be on the same network and

available to each other.

2 Create a software package that includes the vRealize Automation guest agent. See Create a

Software Package for SCCM Provisioning.

3 In SCCM, create the desired task sequence for provisioning the machine. The final step must be to

install the software package you created that contains the vRealize Automation guest agent. For

information about creating task sequences and installing software packages, see SCCM

documentation.

4 Create a zero touch boot ISO image for the task sequence. By default, SCCM creates a light touch

boot ISO image. For information about configuring SCCM for zero touch ISO images, see SCCM

documentation.

5 Copy the ISO image to the location required by your virtualization platform. If you do not know the

appropriate location, refer to the documentation provided by your hypervisor.

6 Gather the following information so that blueprint architects can include it on blueprints:

a The name of the collection containing the task sequence.

Configuring vRealize Automation

VMware, Inc. 56

b The fully qualified domain name of the SCCM server on which the collection containing the

sequence resides.

c The site code of the SCCM server.

d Administrator-level credentials for the SCCM server.

e (Optional) For SCVMM integrations, the ISO, virtual hard disk, or hardware profile to attach to

provisioned machines.

Create a Software Package for SCCM Provisioning

The final step in your SCCM task sequence must be to install a software package that includes the

vRealize Automation guest agent.

Procedure

1Navigate to the vRealize Automation appliance management console page.

For example: https://va-hostname.domain.com.

2Click Guest and software agents page in the vRealize Automation component installation section of

the page.

For example: https://va-hostname.domain.com/software/index.html.

The Guest and Software Agent Installers page opens, displaying links to available downloads.

3Click Windows guest agent files (32-bit) or (64-bit) in the component installation section of the page

to download and save the GuestAgentInstaller.exe or GuestAgentInstaller_x64.exe file.

4Extract the Windows guest agent files to a location available to SCCM.

This produces the directory C:\VRMGuestAgent. Do not rename this directory.

5Create a software package from the definition file SCCMPackageDefinitionFile.sms.

6Make the software package available to your distribution point.

7Select the contents of the extracted Windows guest agent files as your source files.

Preparing for WIM Provisioning

Provision a machine by booting into a WinPE environment and then install an operating system using a

Windows Imaging File Format (WIM) image of an existing Windows reference machine.

The following is a high-level overview of the steps required to prepare for WIM provisioning:

1 Identify or create the staging area. The staging area should be a network directory that can be

specified as a UNC path or mounted as a network drive by

nThe reference machine.

nThe system where you build the WinPE image.

nThe virtualization host where you provision the machines.

Configuring vRealize Automation

VMware, Inc. 57

2 Ensure that the network has a DHCP server. vRealize Automation cannot provision machines with a

WIM image unless DHCP is available.

3 Identify or create the reference machine in the virtualization platform you intend to use for

provisioning. For vRealize Automation requirements, see Reference Machine Requirements for WIM

Provisioning. For information about creating a reference machine, see the documentation provided by

your hypervisor.

4 Using the System Preparation Utility for Windows, prepare the reference machine's operating system

for deployment. See SysPrep Requirements for the Reference Machine.

5 Create the WIM image of the reference machine. Do not include any spaces in the WIM image file

name or provisioning fails.

6 Create a WinPE image that contains the vRealize Automation guest agent.

n(Optional) Create any custom scripts you want to use to customize provisioned machines and

place them in the appropriate work item directory.

nIf you are using VirtIO for network or storage interfaces, you must ensure that the necessary

drivers are included in your WinPE image and WIM image. See Preparing for WIM Provisioning

with VirtIO Drivers.

When you create the WinPE image, you must manually insert the vRealize Automation guest agent.

See Manually Insert the Guest Agent into a WinPE Image.

7 Place the WinPE image in the location required by your virtualization platform. If you do not know the

location, see your hypervisor documentation.

8 Gather the following information to include in the blueprint:

a The name and location of the WinPE ISO image.

b The name of the WIM file, the UNC path to the WIM file, and the index used to extract the desired

image from the WIM file.

c The user name and password under which to map the WIM image path to a network drive on the

provisioned machine.

d (Optional) If you do not want to accept the default, K, the drive letter to which the WIM image path

is mapped on the provisioned machine.

e For vCenter Server integrations, the vCenter Server guest operating system version with which

vCenter Server is to create the machine.

f (Optional) For SCVMM integrations, the ISO, virtual hard disk, or hardware profile to attach to

provisioned machines.

Note You can create a property group to include all of this required information. Using a property

group makes it easier to include all the information correctly in blueprints.

1Reference Machine Requirements for WIM Provisioning

WIM provisioning involves creating a WIM image from a reference machine. The reference machine

must meet basic requirements for the WIM image to work for provisioning in vRealize Automation.

Configuring vRealize Automation

VMware, Inc. 58

2SysPrep Requirements for the Reference Machine

A SysPrep answer file contains several required settings that are used for WIM provisioning.

3Preparing for WIM Provisioning with VirtIO Drivers

If you are using VirtIO for network or storage interfaces, you must ensure that the necessary drivers

are included in your WinPE image and WIM image. VirtIO generally offers better performance when

provisioning with KVM (RHEV).

4Manually Insert the Guest Agent into a WinPE Image

You must manually insert the vRealize Automation guest agent into your WinPE image.

Reference Machine Requirements for WIM Provisioning

WIM provisioning involves creating a WIM image from a reference machine. The reference machine must

meet basic requirements for the WIM image to work for provisioning in vRealize Automation.

The following is a high-level overview of the steps to prepare a reference machine:

1 If the operating system on your reference machine is Windows Server 2008 R2, Windows Server

2012, Windows 7, or Windows 8, the default installation creates a small partition on the system's hard

disk in addition to the main partition. vRealize Automation does not support the use of WIM images

created on such multi-partitioned reference machines. You must delete this partition during the

installation process.

2 Install NET 4.5 and Windows Automated Installation Kit (AIK) for Windows 7 (including WinPE 3.0) on

the reference machine.

3 If the reference machine operating system is Windows Server 2003 or Windows XP, reset the

administrator password to be blank. (There is no password.)

4 (Optional) If you want to enable XenDesktop integration, install and configure a

Citrix Virtual Desktop Agent.

5 (Optional) A Windows Management Instrumentation (WMI) agent is required to collect certain data

from a Windows machine managed by vRealize Automation, for example the Active Directory status

of a machine’s owner. To ensure successful management of Windows machines, you must install a

WMI agent (typically on the Manager Service host) and enable the agent to collect data from

Windows machines. See Installing vRealize Automation.

SysPrep Requirements for the Reference Machine

A SysPrep answer file contains several required settings that are used for WIM provisioning.

Table 1‑15. Windows Server or Windows XP reference machine SysPrep required settings

GuiUnattended Settings Value

AutoLogon Yes

AutoLogonCount 1

Configuring vRealize Automation

VMware, Inc. 59

Table 1‑15. Windows Server or Windows XP reference machine SysPrep required settings

(Continued)

GuiUnattended Settings Value

AutoLogonUsername username

(username and password are the credentials used for auto

logon when the newly provisioned machine boots into the guest

operating system. Administrator is typically used.)

AutoLogonPassword password corresponding to the AutoLogonUsername.

Table 1‑16. Required SysPrep Settings for reference machine that are not using Windows

Server 2003 or Windows XP:

AutoLogon Settings Value

Enabled Yes

LogonCount 1

Username username

(username and password are the credentials used for auto

logon when the newly provisioned machine boots into the guest

operating system. Administrator is typically used.)

Password password

(username andpassword are the credentials used for auto logon

when the newly provisioned machine boots into the guest

operating system. Administrator is typically used.)

Note For reference machines that use a Windows platform

newer than Windows Server 2003/Windows XP, you must set

the autologon password by using the custom property

Sysprep.GuiUnattended.AdminPassword. A convenient way

to ensure this is done is to create a property group that includes

this custom property so that tenant administrators and business

group managers can include this information correctly in their

blueprints.

Preparing for WIM Provisioning with VirtIO Drivers

If you are using VirtIO for network or storage interfaces, you must ensure that the necessary drivers are

included in your WinPE image and WIM image. VirtIO generally offers better performance when

provisioning with KVM (RHEV).

Windows drivers for VirtIO are included as part of the Red Hat Enterprise Virtualization and are located in

the /usr/share/virtio-win directory on the file system of the Red Hat Enterprise Virtualization

Manager. The drivers are also included in the Red Hat Enterprise Virtualization Guest Tools

located /usr/share/rhev-guest-tools-iso/rhev-tools-setup.iso.

The high-level process for enabling WIM-based provisioning with VirtIO drivers is as follows:

1 Create a WIM image from a Windows reference machine with the VirtIO drivers installed or insert the

drivers into an existing WIM image.

2 Copy the VirtIO driver files and insert the drivers into a WinPE image.

Configuring vRealize Automation

VMware, Inc. 60

3 Upload the WinPE image ISO to the Red Hat Enterprise Virtualization ISO storage domains using the

rhevm-iso-uploader command. For more information about managing ISO images in RHEV refer

to the Red Hat documentation.

4 Create a KVM (RHEV) blueprint for WIM provisioning and select the WinPE ISO option. The custom

property VirtualMachine.Admin.DiskInterfaceType must be included with the value VirtIO. A

fabric administrator can include this information in a property group for inclusion on blueprints.

The custom properties Image.ISO.Location and Image.ISO.Name are not used for KVM (RHEV)

blueprints.

Manually Insert the Guest Agent into a WinPE Image

You must manually insert the vRealize Automation guest agent into your WinPE image.

Prerequisites

nSelect a Windows system from which the staging area you prepared is accessible and on which .NET

4.5 and Windows Automated Installation Kit (AIK) for Windows 7 (including WinPE 3.0) are installed.

nCreate a WinPE.

Procedure

1Install the Guest Agent in a WinPE

You must manually copy the guest agent files to your WinPE image.

2Configure the doagent.bat File

You must manually configure the doagent.bat file.

3Configure the doagentc.bat File

You must manually configure the doagentc.bat file.

4Configure the Guest Agent Properties Files

You must manually configure the guest agent properties files.

Procedure

1Install the Guest Agent in a WinPE.

2Configure the doagent.bat File.

3Configure the doagentc.bat File.

4Configure the Guest Agent Properties Files.

Install the Guest Agent in a WinPE

You must manually copy the guest agent files to your WinPE image.

Prerequisites

nSelect a Windows system from which the staging area you prepared is accessible and on which .NET

4.5 and Windows Automated Installation Kit (AIK) for Windows 7 (including WinPE 3.0) are installed.

Configuring vRealize Automation

VMware, Inc. 61

nCreate a WinPE.

Procedure

uDownload and install the vRealize Automation guest agent from

https://vRealize_VA_Hostname_fqdn/software/index.html.

a Download GugentZip_version to the C drive on the reference machine.

Select either GuestAgentInstaller.exe (32-bit) or GuestAgentInstaller_x64.exe (64-bit)

depending on which is appropriate for your operating system.

b Right-click the file and select Properties.

c Click General.

d Click Unblock.

e Extract the files to C:\.

This produces the directory C:\VRMGuestAgent. Do not rename this directory.

What to do next

Configure the doagent.bat File.

Conﬁgure the doagent.bat File

You must manually configure the doagent.bat file.

Prerequisites

Install the Guest Agent in a WinPE.

Procedure

1Navigate to the VRMGuestAgent directory within your WinPE Image.

For example: C:\Program Files (x86)\VMware\Plugins\VRM Agent\VRMGuestAgent.

2Make a copy of the file doagent-template.bat and name it doagent.bat.

3Open doagent.bat in a text editor.

4Replace all instances of the string #Dcac Hostname# with the fully qualified domain name and port

number of the IaaS Manager Service host.

Option Description

If you are using a load balancer Enter the fully qualified domain name and port of the load balancer for the IaaS

Manager Service. For example,

manager_service_LB.mycompany.com:443

With no load balancer Enter the fully qualified domain name and port of the machine on which the IaaS

Manager Service is installed. For example,

manager_service.mycompany.com:443

Configuring vRealize Automation

VMware, Inc. 62

5Replace all instances of the string #Protocol# with the string /ssl.

6Replace all instances of the string #Comment# with REM (REM must be followed by a trailing space).

7(Optional) If you are using self-signed certificates, uncomment the openSSL command.

echo QUIT | c:\VRMGuestAgent\bin\openssl s_client –connect

8Save and close the file.

9Edit the Startnet.cmd script for your WinPE to include the doagent.bat as a custom script.

What to do next

Configure the doagentc.bat File.

Conﬁgure the doagentc.bat File

You must manually configure the doagentc.bat file.

Prerequisites

Configure the doagent.bat File.

Procedure

1Navigate to the VRMGuestAgent directory within your WinPE Image.

For example: C:\Program Files (x86)\VMware\Plugins\VRM Agent\VRMGuestAgent.

2Make a copy of the file doagentsvc-template.bat and name it doagentc.bat.

3Open doagentc.bat in a text editor.

4Remove all instance of the string #Comment#.

5Replace all instances of the string #Dcac Hostname# with the fully qualified domain name and port

number of the Manager Service host.

The default port for the Manager Service is 443.

Option Description

If you are using a load balancer Enter the fully qualified domain name and port of the load balancer for the

Manager Service. For example,

load_balancer_manager_service.mycompany.com:443

With no load balancer Enter the fully qualified domain name and port of the Manager Service. For

example,

manager_service.mycompany.com:443

6Replace all instances of the string #errorlevel# with the character 1.

7Replace all instances of the string #Protocol# with the string /ssl.

8Save and close the file.

Configuring vRealize Automation

VMware, Inc. 63

What to do next

Configure the Guest Agent Properties Files.

Conﬁgure the Guest Agent Properties Files

You must manually configure the guest agent properties files.

Prerequisites

Configure the doagentc.bat File.

Procedure

1Navigate to the VRMGuestAgent directory within your WinPE Image.

For example: C:\Program Files (x86)\VMware\Plugins\VRM Agent\VRMGuestAgent.

2Make a copy of the file gugent.properties and name it gugent.properties.template.

3Make a copy of the file gugent.properties.template and name it gugentc.properties.

4Open gugent.properties in a text editor.

5Replace all instances of the string GuestAgent.log the string

X:/VRMGuestAgent/GuestAgent.log.

6Save and close the file.

7Open gugentc.properties in a text editor.

8Replace all instances of the string GuestAgent.log the string

C:/VRMGuestAgent/GuestAgent.log.

9Save and close the file.

Preparing for Virtual Machine Image Provisioning

Before you provision instances with OpenStack, you must have virtual machine images and flavors

configured in the OpenStack provider.

Virtual Machine Images

You can select an virtual machine image from a list of available images when creating blueprints for

OpenStack resources.

A virtual machine image is a template that contains a software configuration, including an operating

system. Virtual machine images are managed by the OpenStack provider and are imported during data

collection.

If an image that is used in a blueprint is later deleted from the OpenStack provider, it is also removed from

the blueprint. If all the images have been removed from a blueprint, the blueprint is disabled and cannot

be used for machine requests until it is edited to add at least one image.

Configuring vRealize Automation

VMware, Inc. 64

OpenStack Flavors

You can select one or more flavors when creating OpenStack blueprints.

OpenStack flavors are virtual hardware templates that define the machine resource specifications for

instances provisioned in OpenStack. Flavors are managed by the OpenStack provider and are imported

during data collection.

vRealize Automation supports several flavors of OpenStack. For the most current information about

OpenStack flavor support, see the vRealize Automation Support Matrix at

https://www.vmware.com/support/pubs/vcac-pubs.html.

Preparing for Amazon Machine Image Provisioning

Prepare your Amazon Machine Images and instance types for provisioning in vRealize Automation.

Understanding Amazon Machine Images

You can select an Amazon machine image from a list of available images when creating Amazon

machine blueprints.

An Amazon machine image is a template that contains a software configuration, including an operating

system. They are managed by Amazon Web Services accounts. vRealize Automation manages the

instance types that are available for provisioning.

The Amazon machine image and instance type must be available in an Amazon region. Not all instance

types are available in all regions.

You can select an Amazon machine image provided by Amazon Web Services, a user community, or the

AWS Marketplace site. You can also create and optionally share your own Amazon machine images. A

single Amazon machine image can be used to launch one or many instances.

The following considerations apply to Amazon machine images in the Amazon Web Services accounts

from which you provision cloud machines:

nEach blueprint must specify an Amazon machine image.

A private Amazon machine image is available to a specific account and all its regions. A public

Amazon machine image is available to all accounts, but only to a specific region in each account.

nWhen the blueprint is created, the specified Amazon machine image is selected from regions that

have been data-collected. If multiple Amazon Web Services accounts are available, the business

group manager must have rights to any private Amazon machine images. The Amazon machine

image region and the specified user location restrict provisioning request to reservations that match

the corresponding region and location.

nUse reservations and policies to distribute Amazon machine images in your Amazon Web Services

accounts. Use policies to restrict provisioning from a blueprint to a particular set of reservations.

Configuring vRealize Automation

VMware, Inc. 65

nvRealize Automation cannot create user accounts on a cloud machine. The first time a machine

owner connects to a cloud machine, she must log in as an administrator and add her

vRealize Automation user credentials or an administrator must do that for her. She can then log in

using her vRealize Automation user credentials.

If the Amazon machine image generates the administrator password on every boot, the Edit Machine

Record page displays the password. If it does not, you can find the password in the Amazon Web

Services account. You can configure all Amazon machine images to generate the administrator

password on every boot. You can also provide administrator password information to support users

who provision machines for other users.

nTo allow remote Microsoft Windows Management Instrumentation (WMI) requests on cloud machines

provisioned in Amazon Web Services accounts, enable a Microsoft Windows Remote Management

(WinRM) agent to collect data from Windows machines managed by vRealize Automation. See

Installing vRealize Automation.

nA private Amazon machine image can be seen across tenants.

For related information, see Amazon Machine Images (AMI) topics in Amazon documentation.

Understanding Amazon Instance Types

An IaaS architect selects one or more Amazon instance types when creating Amazon EC2 blueprints. An

IaaS administrator can add or remove instance types to control the choices available to the architects.

An Amazon EC2 instance is a virtual server that can run applications in Amazon Web Services. Instances

are created from an Amazon machine image and by choosing an appropriate instance type.

To provision a machine in an Amazon Web Services account, an instance type is applied to the specified

Amazon machine image. The available instance types are listed when architects create the Amazon EC2

blueprint. Architects select one or more instance types, and those instance types become choices

available to the user when they request to provision a machine. The instance types must be supported in

the designated region.

For related information, see Selecting Instance Types and Amazon EC2 Instance Details topics in

Amazon documentation.

Add an Amazon Instance Type

Several instance types are supplied with vRealize Automation for use with Amazon blueprints. An

administrator can add and remove instance types.

The machine instance types managed by IaaS administrators are available to blueprint architects when

they create or edit an Amazon blueprint. Amazon machine images and instance types are made available

through the Amazon Web Services product.

Prerequisites

Configuring vRealize Automation

VMware, Inc. 66

Procedure

1Click Infrastructure > Administration > Instance Types.

2Click New.

3Add a new instance type, specifying the following parameters.

Information about the available Amazon instances types and the setting values that you can specify

for these parameters is available from Amazon Web Services documentation in EC2 Instance Types -

Amazon Web Services (AWS) at aws.amazon.com/ec2 and Instance Types at

docs.aws.amazon.com.

nName

nAPI name

nType Name

nIO Performance Name

nCPUs

nMemory (GB)

nStorage (GB)

nCompute Units

4Click the Save icon ( ).

When IaaS architects create Amazon Web Services blueprints, they can use your custom instance types.

What to do next

Add the compute resources from your endpoint to a fabric group. See Create a Fabric Group.

Scenario: Prepare vSphere Resources for Machine Provisioning in

Rainpole

As the vSphere administrator creating templates for vRealize Automation, you want to use the vSphere

Web Client to prepare for cloning CentOS machines in vRealize Automation.

TEMPLATE

You are here

Prepare

Installation Install Prepare

Template

Request Initial

Content

Configuring vRealize Automation

VMware, Inc. 67

You want to convert an existing CentOS reference machine into a vSphere template so you and your

Rainpole architects can create blueprints for cloning CentOS machines in vRealize Automation. To

prevent any conflicts that might arise from deploying multiple virtual machines with identical settings, you

also want to create a general customization specification that you and your architects can use to create

clone blueprints for Linux templates.

Procedure

1Scenario: Convert Your CentOS Reference Machine into a Template for Rainpole

Using the vSphere Client, you convert your existing CentOS reference machine into a vSphere

template for your vRealize Automation IaaS architects to reference as the base for their clone

blueprints.

2Scenario: Create a Customization Specification for Cloning Linux Machines in Rainpole

Using the vSphere Client, you create a standard customization specification for your

vRealize Automation IaaS architects to use when they create clone blueprints for Linux machines.

Scenario: Convert Your CentOS Reference Machine into a Template for

Rainpole

Using the vSphere Client, you convert your existing CentOS reference machine into a vSphere template

for your vRealize Automation IaaS architects to reference as the base for their clone blueprints.

Procedure

1Log in to your reference machine as the root user and prepare the machine for conversion.

a Remove udev persistence rules.

/bin/rm -f /etc/udev/rules.d/70*

b Enable machines cloned from this template to have their own unique identifiers.

/bin/sed -i '/^\(HWADDR\|UUID\)=/d'

/etc/sysconfig/network-scripts/ifcfg-eth0

c Power down the machine.

shutdown -h now

2Log in to the vSphere Web Client as an administrator.

3Click the VM Options tab.

4Right-click your reference machine and select Edit Settings.

5Enter Rainpole_centos_63_x86 in the VM Name text box.

6Even though your reference machine has a CentOS guest operating system, select Red Hat

Enterprise Linux 6 (64-bit) from the Guest OS Version drop-down menu.

If you select CentOS, your template and customization specification might not work as expected.

Configuring vRealize Automation

VMware, Inc. 68

7Right-click your Rainpole_centos_63_x86 reference machine in the vSphere Web Client and select

Template > Convert to Template.

vCenter Server marks your Rainpole_centos_63_x86 reference machine as a template and displays the

task in the Recent Tasks pane.

What to do next

To prevent any conflicts that might arise from deploying multiple virtual machines with identical settings,

you create a general customization specification that you and your Rainpole architects can use to create

clone blueprints for Linux templates.

Scenario: Create a Customization Speciﬁcation for Cloning Linux Machines in

Rainpole

Using the vSphere Client, you create a standard customization specification for your vRealize Automation

IaaS architects to use when they create clone blueprints for Linux machines.

Procedure

1On the home page, click Customization Specification Manager to open the wizard.

2Click the New icon.

3Specify properties.

a Select Linux from the Target VM Operating System drop-down menu.

b Enter Linux in the Customization Spec Name text box.

c Enter Rainpole Linux cloning with vRealize Automation in the Description text box.

d Click Next.

4Set computer name.

a Select Use the virtual machine name.

b Enter the domain on which cloned machines are going to be provisioned in the Domain name

text box.

For example, rainpole.local.

c Click Next.

5Configure time zone settings.

6Click Next.

7Select Use standard network settings for the guest operating system, including enabling

DHCP on all network interfaces.

8Follow the prompts to enter the remaining required information.

9On the Ready to complete page, review your selections and click Finish.

Configuring vRealize Automation

VMware, Inc. 69

You have a general customization specification that you can use to create blueprints for cloning Linux

machines.

What to do next

installation and request the catalog items that quickly set up your proof of concept.

Preparing for Software Provisioning

Use Software to deploy applications and middleware as part of the vRealize Automation provisioning

process for vSphere, vCloud Director,vCloud Air, and Amazon AWS machines.

You can deploy Software on machines if your blueprint supports Software and if you install the guest

agent and software bootstrap agent on your reference machines before you convert them into templates,

snapshots, or Amazon Machine Images.

For related information about specifying ports when preparing for provisioning, see Secure Configuration

Guide and Reference Architecture at VMware vRealize Automation Information.

Table 1‑17. Provisioning Methods that Support Software

Machine Type

Provisioning

Method Required Preparation

vSphere Clone A clone blueprint provisions a complete and independent virtual machine based on a

vCenter Server virtual machine template. If you want your templates for cloning to support

Software components, install the guest agent and software bootstrap agent on your

reference machine as you prepare a template for cloning. See Checklist for Preparing to

Provision by Cloning.

vSphere Linked Clone A linked clone blueprint provisions a space-efficient copy of a vSphere machine based on a

snapshot, using a chain of delta disks to track differences from the parent machine. If you

want your linked clone blueprints to support Software components, install the guest agent

and software bootstrap agent on the machine before you take the snapshot.

If your snapshot machine was cloned from a template that supports Software, the required

agents are already installed.

vCloud Director Clone A clone blueprint provisions a complete and independent virtual machine based on a

vCenter Server virtual machine template. If you want your templates for cloning to support

Software components, install the guest agent and software bootstrap agent on your

reference machine as you prepare a template for cloning. See Checklist for Preparing to

Provision by Cloning.

Configuring vRealize Automation

VMware, Inc. 70

Table 1‑17. Provisioning Methods that Support Software (Continued)

Machine Type

Provisioning

Method Required Preparation

vCloud Air Clone A clone blueprint provisions a complete and independent virtual machine based on a

vCenter Server virtual machine template. If you want your templates for cloning to support

Software components, install the guest agent and software bootstrap agent on your

reference machine as you prepare a template for cloning. See Checklist for Preparing to

Provision by Cloning.

Amazon AWS Amazon

Machine

Image

An Amazon machine image is a template that contains a software configuration, including

an operating system. If you want to create an Amazon machine image that supports

Software, connect to a running Amazon AWS instance that uses an EBS volume for the root

device. Install the guest agent and software bootstrap agent on the reference machine, then

create an Amazon Machine Image from your instance. For instruction on creating Amazon

EBS-backed AMIs, see the Amazon AWS documentation.

For the guest agent and Software bootstrap agent to function on provisioned machines, you

must configure network-to-VPC connectivity.

Preparing to Provision Machines with Software

To support Software components, you must install the guest agent and Software bootstrap agent on your

reference machine before you convert to a template for cloning, create an Amazon machine image, or

take a snapshot.

Prepare a Windows Reference Machine to Support Software

You use a single script to install the Java Runtime Environment, guest agent, and Software bootstrap

agent on a Windows reference machine. From the reference machine, you can create a template for

cloning, a snapshot, or an Amazon machine image that supports Software components.

Software supports scripting with Windows CMD and PowerShell 2.0.

Important The startup process must not be interrupted. Configure the virtual machine so that nothing

pauses the virtual machine startup process before reaching the login prompt. For example, verify that no

processes or scripts prompt for user interaction while the virtual machine starts.

Prerequisites

nIdentify or create a Windows reference machine.

nEstablish secure trust between the reference machine and your IaaS Manager Service host. See

Configuring the Guest Agent to Trust a Server.

nOn the reference machine, verify that the Darwin user has Log on as a service access.

nIf you plan to remotely access the machine for troubleshooting or other reasons, install Remote

Desktop Services (RDS).

nRemove network configuration artifacts from the network configuration files.

Configuring vRealize Automation

VMware, Inc. 71

Procedure

1Log in to the Windows reference server as an administrator.

2Open a browser to the software download page on the vRealize Automation appliance.

https://vrealize-automation-appliance-FQDN/software

3Save the template ZIP to the Windows server.

prepare_vra_template_windows.zip

4Extract the ZIP contents to a folder, and run the batch file.

.\prepare_vra_template.bat

5Follow the prompts.

6When finished, shut down the Windows virtual machine.

The script removes any previous guest or Software bootstrap agents, and installs the supported versions

of the Java Runtime Environment, the guest agent, and the Software bootstrap agent.

What to do next

Convert the reference machine into a template for cloning, a snapshot, or an Amazon machine image.

Each supports Software components, and infrastructure architects can use them when creating

blueprints.

Prepare a Linux Reference Machine to Support Software

You use a single script to install the Java Runtime Environment, guest agent, and Software bootstrap

agent on your Linux reference machine. From the reference machine, you can create a template for

cloning, a snapshot, or an Amazon machine image that supports Software components.

Software supports scripting with Bash.

Important The boot process must not be interrupted. Configure the virtual machine so that nothing

pauses the virtual machine boot process before reaching the login prompt. For example, verify that no

processes or scripts prompt for user interaction while the virtual machine starts.

Prerequisites

nIdentify or create a Linux reference machine.

nVerify that the following commands are available, depending on your Linux system:

nyum or apt-get

nwget or curl

npython

ndmidecode as required by cloud providers

Configuring vRealize Automation

VMware, Inc. 72

nCommon requirements such as sed, awk, perl, chkconfig, unzip, and grep depending on your

Linux distribution

You might also use an editor to inspect the downloaded prepare_vra_template.sh script, which

exposes the commands that it uses.

nIf you plan to remotely access the machine for troubleshooting or other reasons, install OpenSSH.

nRemove network configuration artifacts from the network configuration files.

Procedure

1Log in to your reference machine as root.

2Download the template tar.gz package from the vRealize Automation appliance.

wget https://vrealize-automation-appliance-

FQDN/software/download/prepare_vra_template.tar.gz

If your environment is using self-signed certificates, you might need the --no-check-certificate

option.

wget --no-check-certificate https://vrealize-automation-appliance-

FQDN/software/download/prepare_vra_template.tar.gz

3Untar the package.

tar -xvf prepare_vra_template.tar.gz

4In the untar output, find the installer script, and make it executable.

chmod +x prepare_vra_template.sh

5Run the installer script.

./prepare_vra_template.sh

If you need information about non-interactive options and expected values, see the script help.

./prepare_vra_template.sh --help

6Follow the prompts.

A confirmation appears when installation succeeds. If errors and logs appear, resolve the errors and

rerun the script.

7When finished, shut down the Linux virtual machine.

The script removes any previous guest or Software bootstrap agents, and installs the supported versions

of the Java Runtime Environment, the guest agent, and the Software bootstrap agent.

What to do next

On your hypervisor or cloud provider, turn the reference machine into a template for cloning, a snapshot,

or an Amazon machine image. Each supports Software components, and infrastructure architects can

use them when creating blueprints.

Configuring vRealize Automation

VMware, Inc. 73

Updating Existing Virtual Machine Templates in vRealize Automation

If you are updating your templates, Amazon Machine Images, or snapshots for the latest version of the

Windows Software bootstrap agent, or if you are manually updating to the latest Linux Software bootstrap

agent instead of using the prepare_vra_template.sh script, you need to remove any existing

versions and delete any logs.

Linux

For Linux reference machines, running the prepare_vra_template.sh script script resets the agent

and removes any logs for you before reinstalling. However, if you intend to manually install, you need to

/opt/vmware-appdirector/agent-bootstrap/agent_reset.sh

Windows

For Windows reference machines, you remove the existing Software agent bootstrap and

vRealize Automation 6.0 or later guest agent, and delete any existing runtime log files. In a PowerShell

command window, run the commands to remove the agent and artifacts.

c:\opt\vmware-appdirector\agent-bootstrap\agent_bootstrap_removal.bat

c:\opt\vmware-appdirector\agent-bootstrap\agent_reset.bat

Scenario: Prepare a vSphere CentOS Template for Clone Machine

and Software Component Blueprints

As a vCenter Server administrator, you want to prepare a vSphere template that your

vRealize Automation architects can use to clone Linux CentOS machines. You want to ensure that your

template supports blueprints with software components, so you install the guest agent and the software

bootstrap agent before you turn your reference machine into a template.

Prerequisites

nIdentify or create a Linux CentOS reference machine with VMware Tools installed. Include at least

one Network Adapter to provide internet connectivity in case blueprint architects do not add this

functionality at the blueprint level. For information about creating virtual machines, see the vSphere

documentation.

nYou must be connected to a vCenter Server to convert a virtual machine to a template. You cannot

create templates if you connect the vSphere Client directly to an vSphere ESXi host.

Configuring vRealize Automation

VMware, Inc. 74

Procedure

1Scenario: Prepare Your Reference Machine for Guest Agent Customizations and Software

Components

So that your template can support software components, you install the software bootstrap agent

and its prerequisite, the guest agent, on your reference machine. The agents ensure that

vRealize Automation architects who use your template can include software components in their

blueprints.

2Scenario: Convert Your CentOS Reference Machine into a Template

After you install the guest agent and software bootstrap agent onto your reference machine, you turn

your reference machine into a template that vRealize Automation architects can use to create clone

machine blueprints.

3Scenario: Create a Customization Specification for vSphere Cloning

Create a customization specification for your blueprint architects to use with your

cpb_centos_63_x84 template.

You created a template and customization specification from your reference machine that blueprint

architects can use to create vRealize Automation blueprints that clone Linux CentOS machines. Because

you installed the Software bootstrap agent and the guest agent on your reference machine, architects can

use your template to create elaborate catalog item blueprints that include Software components or other

guest agent customizations such as running scripts or formatting disks. Because you installed

VMware Tools, architects and catalog administrators can allow users to perform actions against

machines, such as reconfigure, snapshot, and reboot.

What to do next

After you configure vRealize Automation users, groups, and resources, you can use your template and

customization specification to create a machine blueprint for cloning. See Installing and Configuring

vRealize Automation for the Rainpole Scenario.

Scenario: Prepare Your Reference Machine for Guest Agent Customizations

and Software Components

So that your template can support software components, you install the software bootstrap agent and its

prerequisite, the guest agent, on your reference machine. The agents ensure that vRealize Automation

architects who use your template can include software components in their blueprints.

To simplify the process, you download and run a vRealize Automation script that installs both agents,

instead of downloading and installing separate packages.

The script also connects to the Manager Service instance and downloads the SSL certificate, which

establishes trust between the Manager Service and machines deployed from the template. Note that

having the script download the certificate is less secure than manually obtaining the Manager Service

SSL certificate and installing it on your reference machine in /usr/share/gugent/cert.pem.

Configuring vRealize Automation

VMware, Inc. 75

Procedure

1In your Web browser, open the following URL.

https://vrealize-automation-appliance-FQDN/software/index.html

2Save the prepare_vra_template.sh script to your reference machine.

3On the reference machine, make prepare_vra_template.sh executable.

chmod +x prepare_vra_template.sh

4Run prepare_vra_template.sh.

./prepare_vra_template.sh

5Follow the prompts.

If you need non-interactive information about options and values,

enter ./prepare_vra_template.sh --help.

A confirmation message appears when installation finishes. If error messages and logs appear, correct

the issues and rerun the script.

Scenario: Convert Your CentOS Reference Machine into a Template

After you install the guest agent and software bootstrap agent onto your reference machine, you turn your

reference machine into a template that vRealize Automation architects can use to create clone machine

blueprints.

After you convert your reference machine to a template, you cannot edit or power on the template unless

you convert it back to a virtual machine.

Procedure

1Log in to your reference machine as the root user and prepare the machine for conversion.

a Remove udev persistence rules.

/bin/rm -f /etc/udev/rules.d/70*

b Enable machines cloned from this template to have their own unique identifiers.

/bin/sed -i '/^\(HWADDR\|UUID\)=/d'

/etc/sysconfig/network-scripts/ifcfg-eth0

Configuring vRealize Automation

VMware, Inc. 76

c If you rebooted or reconfigured the reference machine after installing the software bootstrap

agent, reset the agent.

/opt/vmware-appdirector/agent-bootstrap/agent_reset.sh

d Power down the machine.

shutdown -h now

2Log in to the vSphere Web Client as an administrator.

3Right-click your reference machine and select Edit Settings.

4Enter cpb_centos_63_x84 in the VM Name text box.

5Even though your reference machine has a CentOS guest operating system, select Red Hat

Enterprise Linux 6 (64-bit) from the Guest OS Version drop-down menu.

If you select CentOS, your template and customization specification might not work as expected.

6Right-click your reference machine in the vSphere Web Client and select Template > Convert to

Template.

vCenter Server marks your cpb_centos_63_x84 reference machine as a template and displays the task in

the Recent Tasks pane. If you have already brought your vSphere environment under

vRealize Automation management, your template is discovered during the next automated data

collection. If you have not configured your vRealize Automation yet, the template is collected during that

process.

Scenario: Create a Customization Speciﬁcation for vSphere Cloning

Create a customization specification for your blueprint architects to use with your cpb_centos_63_x84

template.

Procedure

1Log in to the vSphere Web Client as an administrator.

2On the home page, click Customization Specification Manager to open the wizard.

3Click the New icon.

4Click the New icon.

5Specify properties.

a Select Linux from the Target VM Operating System drop-down menu.

b Enter Customspecs in the Customization Spec Name text box.

c Enter cpb_centos_63_x84 cloning with vRealize Automation in the Description text box.

d Click Next.

Configuring vRealize Automation

VMware, Inc. 77

6Set computer name.

a Select Use the virtual machine name.

b Enter the domain on which cloned machines are going to be provisioned in the Domain name

text box.

c Click Next.

7Configure time zone settings.

8Click Next.

9Select Use standard network settings for the guest operating system, including enabling

DHCP on all network interfaces.

Fabric administrators and infrastructure architects handle network settings for provisioned machine by

creating and using Network profiles in vRealize Automation.

10 Follow the prompts to enter the remaining required information.

11 On the Ready to complete page, review your selections and click Finish.

Scenario: Prepare for Importing the Dukes Bank for vSphere

Sample Application Blueprint

As a vCenter Server administrator, you want to prepare a vSphere CentOS 6.x Linux template and

customization specification that you can use to provision the vRealize Automation Dukes Bank sample

application.

You want to ensure that your template supports the sample application software components, so you

install the guest agent and the software bootstrap agent onto your Linux reference machine before you

convert it to a template and create a customization specification. You disable SELinux on your reference

machine to ensure your template supports the specific implementation of MySQL used in the Dukes Bank

sample application.

Prerequisites

nInstall and fully configure vRealize Automation. See Installing and Configuring vRealize Automation

for the Rainpole Scenario.

nIdentify or create a CentOS 6.x Linux reference machine with VMware Tools installed. For information

about creating virtual machines, see the vSphere documentation.

nYou must be connected to a vCenter Server to convert a virtual machine to a template. You cannot

create templates if you connect the vSphere Client directly to an vSphere ESXi host.

Configuring vRealize Automation

VMware, Inc. 78

Procedure

1Scenario: Prepare Your Reference Machine for the Dukes Bank vSphere Sample Application

You want your template to support the Dukes Bank sample application, so you must install both the

guest agent and the software bootstrap agent on your reference machine so vRealize Automation

can provision the software components. To simplify the process, you download and run a

vRealize Automation script that installs both the guest agent and the software bootstrap agent

instead of downloading and installing the packages separately.

2Scenario: Convert Your Reference Machine into a Template for the Dukes Bank vSphere Application

After you install the guest agent and software bootstrap agent on your reference machine, you

disable SELinux to ensure your template supports the specific implementation of MySQL used in the

Dukes Bank sample application. You turn your reference machine into a template that you can use

to provision the Dukes Bank vSphere sample application.

3Scenario: Create a Customization Specification for Cloning the Dukes Bank vSphere Sample

Application Machines

You create a customization specification to use with your Dukes Bank machine template.

You created a template and customization specification from your reference machine that supports the

vRealize Automation Dukes Bank sample application.

Scenario: Prepare Your Reference Machine for the Dukes Bank vSphere

Sample Application

You want your template to support the Dukes Bank sample application, so you must install both the guest

agent and the software bootstrap agent on your reference machine so vRealize Automation can provision

the software components. To simplify the process, you download and run a vRealize Automation script

that installs both the guest agent and the software bootstrap agent instead of downloading and installing

the packages separately.

Procedure

1Log in to your reference machine as the root user.

2Download the installation script from your vRealize Automation appliance.

wget https://vRealize_VA_Hostname_fqdn/software/download/prepare_vra_template.sh

If your environment is using self-signed certificates, you might have to use the wget option --no-

check-certificate option. For example:

wget --no-check-certificate

https://vRealize_VA_Hostname_fqdn/software/download/prepare_vra_template.sh

3Make the prepare_vra_template.sh script executable.

chmod +x prepare_vra_template.sh

Configuring vRealize Automation

VMware, Inc. 79

4Run the prepare_vra_template.sh installer script.

./prepare_vra_template.sh

You can run the help command ./prepare_vra_template.sh --help for information about non-

interactive options and expected values.

5Follow the prompts to complete the installation.

You see a confirmation message when the installation is successfully completed. If you see an error

message and logs in the console, resolve the errors and run the installer script again.

You installed both the software bootstrap agent and its prerequisite, the guest agent, to ensure the Dukes

Bank sample application successfully provisions software components. The script also connected to your

Manager Service instance and downloaded the SSL certificate to establish trust between the Manager

Service and machines deployed from your template. This is a less secure approach than obtaining the

Manager Service SSL certificate and manually installing it on your reference machine

in /usr/share/gugent/cert.pem, and you can manually replace this certificate now if security is a high

priority.

Scenario: Convert Your Reference Machine into a Template for the Dukes

Bank vSphere Application

After you install the guest agent and software bootstrap agent on your reference machine, you disable

SELinux to ensure your template supports the specific implementation of MySQL used in the Dukes Bank

sample application. You turn your reference machine into a template that you can use to provision the

Dukes Bank vSphere sample application.

After you convert your reference machine to a template, you cannot edit or power on the template unless

you convert it back to a virtual machine.

Procedure

1Log in to your reference machine as the root user.

a Edit your /etc/selinux/config file to disable SELinux.

SELINUX=disabled

If you do not disable SELinux, the MySQL software component of the Duke's Bank Sample

application might not work as expected.

b Remove udev persistence rules.

/bin/rm -f /etc/udev/rules.d/70*

c Enable machines cloned from this template to have their own unique identifiers.

/bin/sed -i '/^\(HWADDR\|UUID\)=/d'

/etc/sysconfig/network-scripts/ifcfg-eth0

Configuring vRealize Automation

VMware, Inc. 80

d If you rebooted or reconfigured the reference machine after installing the software bootstrap

agent, reset the agent.

/opt/vmware-appdirector/agent-bootstrap/agent_reset.sh

e Power down the machine.

shutdown -h now

2Log in to the vSphere Web Client as an administrator.

3Right-click your reference machine and select Edit Settings.

4Enter dukes_bank_template in the VM Name text box.

5If your reference machine has a CentOS guest operating system, select Red Hat Enterprise Linux 6

(64-bit) from the Guest OS Version drop-down menu.

If you select CentOS, your template and customization specification might not work as expected.

6Click OK.

7Right-click your reference machine in the vSphere Web Client and select Template > Convert to

Template.

vCenter Server marks your dukes_bank_template reference machine as a template and displays the task

in the Recent Tasks pane. If you have already brought your vSphere environment under

vRealize Automation management, your template is discovered during the next automated data

collection. If you have not configured your vRealize Automation yet, the template is collected during that

process.

Scenario: Create a Customization Speciﬁcation for Cloning the Dukes Bank

vSphere Sample Application Machines

You create a customization specification to use with your Dukes Bank machine template.

Procedure

1Log in to the vSphere Web Client as an administrator.

2On the home page, click Customization Specification Manager to open the wizard.

3Click the New icon.

4Specify properties.

a Select Linux from the Target VM Operating System drop-down menu.

b Enter Customspecs_sample in the Customization Spec Name text box.

c Enter Dukes Bank customization spec in the Description text box.

d Click Next.

Configuring vRealize Automation

VMware, Inc. 81

5Set computer name.

a Select Use the virtual machine name.

b Enter the domain on which you want to provision the Dukes Bank sample application in the

Domain name text box.

c Click Next.

6Configure time zone settings.

7Click Next.

8Select Use standard network settings for the guest operating system, including enabling

DHCP on all network interfaces.

Fabric administrators and infrastructure architects handle network settings for provisioned machine by

creating and using Network profiles in vRealize Automation.

9Follow the prompts to enter the remaining required information.

10 On the Ready to complete page, review your selections and click Finish.

You created a template and customization specification that you can use to provision the Dukes Bank

sample application.

What to do next

1 Create an external network profile to provide a gateway and a range of IP addresses. See Create an

External Network Profile by Using A Third-Party IPAM Provider.

2 Map your external network profile to your vSphere reservation. See Create a Reservation for Hyper-V,

KVM, SCVMM, vSphere, or XenServer. The sample application cannot provision successfully without

an external network profile.

3 Import the Duke's Bank sample application into your environment. See Scenario: Importing the Dukes

Bank for vSphere Sample Application and Configuring for Your Environment.

Configuring vRealize Automation

VMware, Inc. 82

Tenant and Resource

Preparations for Blueprint

Provisioning 2

You can configure multiple tenant environments, each with their own groups of users and unique access

to resources that you bring under vRealize Automation management.

This chapter includes the following topics:

nConfiguring Tenant Settings

nConfiguring Resources

nUser Preferences for Notifications and Delegates

Conﬁguring Tenant Settings

Tenant administrators configure tenant settings such as user authentication, and manage user roles and

business groups. System administrators and tenant administrators configure options such as email

servers to handle notifications, and branding for the vRealize Automation console.

You can use the Configuring Tenant Settings Checklist to see a high-level overview of the sequence of

steps required to configure tenant settings.

Table 2‑1. Checklist for Conﬁguring Tenant Settings

Task

vRealize

Automation Role Details

Create local user accounts and assign a tenant

administrator.

System

administrator

For an example of creating local user

accounts, see Installing and Configuring

vRealize Automation for the Rainpole

Scenario.

Configure Directories Management to set up tenant identity

management and access control settings.

Tenant

administrator

Choosing Directories Management

Configuration Options

Create business groups and custom groups, and grant

user access rights to the vRealize Automation console.

Tenant

administrator

Configuring Groups and User Roles

(Optional) Create additional tenants so users can access

the appropriate applications and resources they need to

complete their work assignments.

System

administrator

Create Additional Tenants

(Optional) Configure custom branding on the tenant login

and application pages of the vRealize Automation console.

nSystem

administrator

nTenant

administrator

Configuring Custom Branding

VMware, Inc. 83

Table 2‑1. Checklist for Conﬁguring Tenant Settings (Continued)

Task

vRealize

Automation Role Details

(Optional) Configure vRealize Automation to send users

notifications when specific events occur.

nSystem

administrator

nTenant

administrator

Checklist for Configuring Notifications

(Optional) Configure vRealize Orchestrator to support

XaaS and other extensibility.

nSystem

administrator

nTenant

administrator

Configuring vRealize Orchestrator

(Optional) Create a custom remote desktop protocol file

that IaaS architects use in blueprints to configure RDP

settings.

System

administrator

Create a Custom RDP File to Support RDP

Connections for Provisioned Machines

(Optional) Define datacenter locations that your fabric

administrators and IaaS architects can leverage to allow

users to select an appropriate location for provisioning when

they request machines.

System

administrator

For an example of adding datacenter

locations, see Scenario: Add Datacenter

Locations for Cross Region Deployments.

Choosing Directories Management Conﬁguration Options

You can use vRealize Automation Directories Management features to configure an Active Directory link

in accordance with your user authentication requirements.

Directories Management provides many options to support a highly customized user authentication.

Table 2‑2. Choosing Directories Management Conﬁguration Options

Configuration Option Procedure

Configure a link to your Active Directory. 1 Configure a link to your Active Directory. See Configure an

Active Directory over LDAP/IWA Link.

2 If you configured vRealize Automation for high availability,

see Configure Directories Management for High Availability.

(Optional) Enhance security of a user ID and password based

directory link by configuring bi-directional integration with Active

Directory Federated Services.

Configure a Bi Directional Trust Relationship Between vRealize

Automation and Active Directory

(Optional) Add users and groups to an existing Active Directory

Link .

Add Users or Groups to an Active Directory Connection.

(Optional) Edit the default policy to apply custom rules for an

Active Directory link.

Manage the User Access Policy.

(Optional) Configure network ranges to restrict the IP addresses

through which users can log in to the system, manage login

restrictions (timeout, number of login attempts before lock-out).

Add or Edit a Network Range.

Directories Management Overview

Tenant administrators can configure tenant identity management and access control settings using the

Directories Management options on the vRealize Automation application console.

Configuring vRealize Automation

VMware, Inc. 84

You can manage the following settings from the Administration > Directories Management tab.

Table 2‑3. Directories Management Settings

Setting Description

Directories The Directories page enables you to create and manage Active Directory links to support

vRealize Automation tenant user authentication and authorization. You create one or more

directories and then sync those directories with your Active Directory deployment. This page

displays the number of groups and users that are synced to the directory and the last sync time.

You can click Sync Now, to manually start the directory sync.

See Using Directories Management to Create an Active Directory Link.

When you click on a directory and then click the Sync Settings button, you can edit the sync

settings, navigate the Identity Providers page, and view the sync log.

From the directories sync settings page you can schedule the sync frequency, see the list of

domains associated with this directory, change the mapped attributes list, update the user and

groups list that syncs, and set the safeguard targets.

Connectors The Connectors page lists deployed connectors for your enterprise network. A connector syncs

user and group data between Active Directory and the Directories Management service, and when

it is used as the identity provider, authenticates users to the service. Each vRealize Automation

appliance contains a connector by default. See Managing Connectors and Connector Clusters.

User Attributes The User Attributes page lists the default user attributes that sync in the directory and you can add

other attributes that you can map to Active Directory attributes. See Select Attributes to Sync with

Directory.

Network Ranges This page lists the network ranges that are configured for your system. You configure a network

range to allow users access through those IP addresses. You can add additional network ranges

and you can edit existing ranges. See Add or Edit a Network Range.

Identity Providers The Identity Providers page lists identity providers that are available on your system.

vRealize Automation systems contain a connector that serves as the default identity provider and

that suffices for many user needs. You can add third-party identity provider instances or have a

combination of both.

See Configure a Third Party Identity Provider Connection.

Policies The Policies page lists the default access policy and any other web application access policies you

created. Policies are a set of rules that specify criteria that must be met for users to access their

application portals or to launch Web applications that are enabled for them. The default policy

should be suitable for most vRealize Automation deployments, but you can edit it if needed. See

Manage the User Access Policy.

Important Concepts Related to Active Directory

Several concepts related to Active Directory are integral to understanding how Directories Management

integrates with your Active Directory environments.

Connector

nSyncs user and group data between Active Directory and the service.

nWhen being used as an identity provider, authenticates users to the service.

Configuring vRealize Automation

VMware, Inc. 85

The connector is the default identity provider. For the authentication methods the connector supports,

see VMware Identity Manager Administration. You can also use third-party identity providers that

support the SAML 2.0 protocol. Use a third-party identity provider for an authentication type the

connector does not support or for an authentication type the connector does support, if the third-party

identity provider is preferable based on your enterprise security policy.

Directory

You can enhance system security of a basic vRealize Automation Active Directory connection by

configuring a bi directional trust relationship between your identity provider and Active Directory

Federated Services.

To configure a bi-directional trust relationship between vRealize Automation and Active Directory, you

must create a custom identity provider and add Active Directory metadata to this provider. Also, you must

modify the default policy used by your vRealize Automation deployment. Finally, you must configure

Active Directory to recognize your identity provider.

Prerequisites

nVerify that you have configured tenants for your vRealize Automation deployment set up an

appropriate Active Directory link to support basic Active Directory user ID and password

authentication.

nActive Directory is installed and configured for use on your network.

nObtain the appropriate Active Directory Federated Services (ADFS) metadata.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Obtain the Federation Metadata file.

You can download this file from

https://servername.domain/FederationMetadata/2007-06/FederationMetadata.xml

Configuring vRealize Automation

VMware, Inc. 99

2Search for the word logout, and edit the location of each instance to point to

https://servername.domain/adfs/ls/logout.aspx

For example, the following:

SingleLogoutService

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

Location="https://servername.domain/adfs/ls/ "/>

Should be changed to:

SingleLogoutService

Binding="urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST"

Location="https://servername.domain/adfs/ls/logout.aspx"/>

3Create a new Identity Provider for you deployment.

a Select Administration > Directories Management > Identity Providers.

b Click Add Identity Provider and complete the fields as appropriate.

Option Description

Identity Provider Name Enter a name for the new identity provider

Identity Provider Metadata (URI or

XML)

Paste the contents of your Active Directory Federated Services metadata file

here.

Name ID Policy in SAML Request

(Optional)

If appropriate, enter a name for the identity policy SAML request.

Users Select the domains to which you want users to have access privileges.

Process IDP Metadata Click to process the metadata file that you added.

Network Select the network ranges to which you want users to have access.

Authentication Methods Enter a name for the authentication method used by this identity provider.

SAML Context Select the appropriate context for your system.

SAML Signing Certificate Click the link beside the SAML Metadata heading to download the Directories

Management metadata.

c Save the Directories Management metadata file as sp.xml.

d Click Add.

4Add a rule to the default policy.

a Select Administration > Directories Management > Policies.

b Click the default policy name.

Configuring vRealize Automation

VMware, Inc. 100

c Click the + icon under the Policy Rules heading to add a new rule.

Use the fields on the Add a Policy Rule page to create a rule that specifies the appropriate

primary and secondary authentication methods to use for a specific network range and device.

For example, if your network range is My Machine, and you need to access content from

All Device Types then, for a typical deployment, you must authenticate by using the following

method: ADFS Username and Password.

d Click Save to save your policy updates.

e On the Default Policy page, drag the new rule to the top of the table so that it takes precedence

over existing rules.

5Using the Active Directory Federated Services management console, or another appropriate tool, set

up a relying party trust relationship with the vRealize Automation identity provider.

To set up this trust, you must import the Directories Management metadata that you previously

downloaded. See the Microsoft Active Directory documentation for more information about

configuring Active Directory Federated Services for bi-directional trust relationships. As part of this

process, you must do the following:

nSet up a Relying Party Trust. When you set up this trust, you must import the VMware Identity

Provider service provider metadata XML file that you copied and saved

nCreate a claim rule that transforms the attributes retrieved from LDAP in the Get Attributes rule

into the desired SAML format. After you create the rule, edit the rule by adding the following text:

c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]

=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer

= c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType,

Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =

"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",

Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] =

"vmwareidentity.domain.com");

Conﬁgure SAML Federation Between Directories Management and SSO2

You can establish SAML federation between vRealize Automation Directories Management and systems

that use SSO2 to support single sign on.

Establish federation between Directories Management and SSO2 by creating a SAML connection

between the two parties. Currently, the only supported end-to-end flow is where SSO2 acts as the Identity

Provider (IdP) and Directories Management acts as the service provider (SP).

For SSO2 user authentication, the same account must exist in both Directories Management and SSO2.

Minimally, the UserPrincipalName (UPN) of the user has to match on both ends. Other attributes can

differ as they are required to identify the SAML subject.

For local users in SSO2, such as admin@vsphere.local, corresponding accounts must also exist in

Directories Management, where at least the UPN of the user matches. Create these accounts manually

or with a script using the Directories Management local user creation APIs.

Configuring vRealize Automation

VMware, Inc. 101

Setting up SAML between SSO2 and Directories Management involves configuration on the Directories

Management and SSO components.

Table 2‑4. SAML Federation Component Conﬁguration

Component Configuration

Directories Management Configure SSO2 as a third-party Identity Provider on Directories Management and update the

default authentication policy. You can create an automated script to set up

Directories Management.

SSO2 component Configure Directories Management as a service provider by importing the

Directories Management sp.xml file. This file enables you to configure SSO2 to use

Directories Management as the Service Provider (SP).

Prerequisites

nConfigure tenants for your vRealize Automation deployment. See Create Additional Tenants.

nSet up an appropriate Active Directory link to support basic Active Directory user ID and password

authentication.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Download SSO2 Identity Provider metadata through the SSO2 user interface.

a Log in to vCenter as an administrator at https://<cloudvm-hostname>/ .

b Click the Log in to vSphere Web Client link.

c On the left navigation pane, select Administration > Single Sign On > Configuration.

d Click Download adjacent to the Metadata for your SAML service provider heading.

The vsphere.local.xml file should begin downloading.

e Copy the contents of the vsphere.local.xml file.

2On the vRealize Automation Directories Management Identity Providers page, create a new Identity

Provider.

a Log in to vRealize Automation as a tenant administrator.

b Select Administration > Directories Management > Identity Providers.

Configuring vRealize Automation

VMware, Inc. 102

c Click Add Identity Provider and provide the configuration information.

Option Action

Identity Provider Name Enter a name for the new Identity Provider.

Identity Provider Metadata (URI or

XML) text box

Paste the contents of your SSO2 idp.xml metadata file in the text box and

click Process IDP Metadata.

Name ID Policy in SAML Request

(Optional)

Enter http://schemas.xmlsoap.org/claims/UPN.

Users Select the domains to which you want users to have access privileges.

Network Select the network ranges from which you want users to have access

privileges.

If you want to authenticate users from an IP addresses, select All Ranges.

Authentication Methods Enter a name for the authentication method. Then, use the SAML Context

drop down menu to the right to map the authentication method to

urn:oasis:names:tc:SAML:2.0:ac:classes:Password.

SAML Signing Certificate Click the link beside the SAML Metadata heading to download the Directories

Management metadata.

d Save the Directories Management metadata file as sp.xml.

e Click Add.

3Update the relevant authentication policy using the Directories Management Policies page to redirect

authentication to the third party SSO2 identity provider.

a Select Administration > Directories Management > Policies.

b Click the default policy name.

c Click the authentication method under the Policy Rules heading to edit the existing

authentication rule.

d On the Edit a Policy Rule page, change the authentication method from password to the

appropriate method.

In this case, the method should be SSO2.

e Click Save to save your policy updates.

4On the left navigation pane, select Administration > Single Sign On > Configuration, and click

Update to upload the sp.xml file to vSphere.

Add Users or Groups to an Active Directory Connection

You can add users or groups to an existing Active Directory connection.

The Directories Management user authentication system imports data from Active Directory when adding

groups and users. The speed of the data transport is limited by Active Directory capabilities. As a result,

actions can take a long time depending on the number of groups and users that are added. To minimize

problems, limit the groups and users to only the groups and users required for a vRealize Automation

Configuring vRealize Automation

VMware, Inc. 103

action. If problems occur, close unneeded applications and verify that your deployment has appropriate

memory allocated to Active Directory. If problems continue, increase the Active Directory memory

allocation. For deployments with large numbers of users and groups, you might need to increase the

Active Directory memory allocation to as much as 24 GB.

When you sync a vRealize Automation deployment with a many users and groups, there might be a delay

before the Log details are available. The time stamp on the log file can differ from the completed time

displayed on the console.

If members of a group are not in the Users list, when you add the group from Active Directory, the

members are added to the list. When you sync a group, any users that do not have Domain Users as

their primary group in Active Directory are not synced.

Note You cannot cancel a synchronize action after you start the action.

Prerequisites

nConnector installed and the activation code activated. Select the required default attributes and add

additional attributes on the User Attributes page.

See Select Attributes to Sync with Directory in Configuring vRealize Automation.

nList of the Active Directory groups and users to sync from Active Directory.

nFor Active Directory over LDAP, information required includes the Base DN, Bind DN, and Bind DN

password.

nFor Active Directory Integrated Windows Authentication, the information required includes the

domain's Bind user UPN address and password.

nIf Active Directory is accessed over SSL, a copy of the SSL certificate is required.

nIf you have a multi-forest Active Directory integrated with Windows Authentication and the Domain

Local group contains members from different forests, do the following. Add the Bind user to the

Administrators group of the Domain Local group. If the Bind user is not added, these members are

missing from the Domain Local group.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Select Administration > Directories Management > Directories.

2Click the desired directory name.

3Click Sync Settings to open a dialog box with synchronization options.

4Click the appropriate icon depending on whether you want to change the user or group configuration.

To edit the group configuration:

nTo add groups, click the + icon to add a line for group DN definitions and enter the appropriate

group DN.

nIf you want to delete a group DN definition, click the x icon for the desired group DN.

Configuring vRealize Automation

VMware, Inc. 104

To edit the user configuration:

uTo add users, click the + icon to add a line for a user DN definition and enter the appropriate user

DN.

If you want to delete a user DN definition, click the x icon for the desired user DN.

5Click Save to save your changes without synchronizing your updates immediately. Click Save &

Sync to save your changes and synchronize your updates immediately.

Select Attributes to Sync with Directory

When you set up the Directories Management directory to sync with Active Directory, you specify the user

attributes that sync to the directory. Before you set up the directory, you can specify on the User Attributes

page which default attributes are required and, if you want, add additional attributes that you want to map

to Active Directory attributes.

When you configure the User Attributes page before the directory is created, you can change default

attributes from required to not required, mark attributes as required, and add custom attributes.

For a list of the default mapped attributes, see Managing User Attributes that Sync from Active Directory.

After the directory is created, you can change a required attribute to not be required, and you can delete

custom attributes. You cannot change an attribute to be a required attribute.

When you add other attributes to sync to the directory, after the directory is created, go to the directory's

Mapped Attributes page to map these attributes to Active Directory Attributes.

Procedure

1Log in to vRealize Automation as a system or tenant administrator.

2Click the Administration tab.

3Select Directories Management > User Attributes

4In the Default Attributes section, review the required attribute list and make appropriate changes to

reflect what attributes should be required.

5In the Attributes section, add the Directories Management directory attribute name to the list.

6Click Save.

The default attribute status is updated and attributes you added are added on the directory's Mapped

Attributes list.

7After the directory is created, go to the Identity Stores page and select the directory.

8Click Sync Settings > Mapped Attributes.

9In the drop-down menu for the attributes that you added, select the Active Directory attribute to map

to.

10 Click Save.

The directory is updated the next time the directory syncs to the Active Directory.

Configuring vRealize Automation

VMware, Inc. 105

Add Memory to Directories Management

You may need to allocate additional memory to Directories Management if you have Active Directory

connections that contain a large number of users or groups.

By default, 4 GB of memory is allocated to the Directories Management service. This is sufficient for many

small to medium sized deployments. If you have an Active Directory connection that uses a large number

of users or groups, you may need to increase this memory allocation. Increased memory allocation is

appropriate for systems with more than 100,000 users , each in 30 groups and 750 groups overall. For

these system, VMware recommends increasing the Directories Management memory allocation to 6 GB.

Directories Management memory is calculated based on the total memory allocated to the

vRealize Automation appliance The following table shows memory allocations for relevant components.

Table 2‑5. vRealize Automation Appliance Memory Allocation

Virtual Appliance memory vRA service memory vIDM service memory

18 GB 3.3 GB 4 GB

24 GB 4.9 GB 6 GB

30 GB 7.4 GB 9.1 GB

Note These allocations assume that all default services are enabled and running on the virtual

appliance. They may change if some services are stopped.

Prerequisites

nAn appropriate Active Directory connection is configured and functioning on your

vRealize Automation deployment.

Procedure

1Stop each machine on which a vRealize Automation appliance is running.

2Increase the virtual appliance memory allocation on each machine.

If you are using the default memory allocation of 18 GB, VMware recommends increasing the

memory allocation to 24 GB.

3Restart the vRealize Automation appliance machines.

Create a Domain Host Lookup File to Override DNS Service Location (SRV) Lookup

When you enable Integrated Windows Authentication, the Directory configuration is changed to enable

the DNS Service Location field. The connector service location lookup is not site aware. If you want to

override the random DC selection, you can create a file called domain_krb.properties and add the

domain to host values that take precedence over SRV lookup.

Procedure

1From the appliance-va command line, log in as the user with root privileges.

Configuring vRealize Automation

VMware, Inc. 106

2Change directories to /usr/local/horizon/conf and create a file called

domain_krb.properties.

3Edit the domain_krb.properties file to add the list of the domain to host values. Add the information as

<AD Domain>=<host:port>, <host2:port2>, <host2:port2>.

For example, enter the list as example.com=examplehost.com:636,

examplehost2.example.com:389

4Change the owner of the domain_krb.properties file to horizon and group to www. Enter

chown horizon:www /usr/local/horizon/conf/domain_krb.properties.

5Restart the service. Enter service horizon-workspace restart.

Conﬁgure Just-in-Time User Provisioning

You can configure Just-in-Time (JIT) provisioning to support adding users without syncing from your

Active Directory.

To support Just-in-Time provisioning, you must add a third party identity provider and then configure a

connection to it within your vRealize Automation deployment to integrate Directories Management with

other SSO providers via a SAML protocol. In addition, you must create a new directory with the

appropriate name, such as JIT Directory.

When you enable Just-in-Time provisioning, you can add Just-in-Time users to a designated custom

group. To support this functionality, create a custom group with the appropriate members. See Add Just-

in-Time Users with Custom Groups and Rules.

Note As a best practice, do not configure Just-in-Time provisioning on the default vsphere.local tenant.

Prerequisites

Configure an appropriate third party identity provider for use with JIT provisioning.

Configuring vRealize Automation

VMware, Inc. 107

Procedure

1Create an identity provider for Just-in-Time provisioning.

a Select Administration > Directories management > Identity Providers

b Click Add Identity Provider and edit the identity provider instance settings as appropriate.

nFor just in time provisioning, create a third party identity provider.

nIn the Create Just-in-Time Directory section, enter names for the directory and one or more

domains.

nYou must select a network for the third party identity provider configuration.

nIf you are using an external VMware Identity Manager as your third party identity provider,

and you are using userPrincipleName to authenticate users, you must change the Name ID

mapping configuration for userPrincipleName from the default of x509SubjectName to

unspecified.

See Configure a Third Party Identity Provider Connection for more information about creating

identity providers.

2Configure SAML on the Just-in-Time identity provider.

a Copy IdP metadata from your identity provider.

b In vRealize Automation, select your identity provider and paste the IdP metadata into the Identity

Provider Metadata (URL or XML) text box.

c Click Save.

d In the Name ID policy in SAML Request (Optional) drop-down menu, select the appropriate

format.

For example, if you are using the emal address as the unique user identifier, you would select

urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress.

e Select the appropriate directory under the Users heading.

f Select the networks for use by this identity provider under the Network heading.

g Specify an appropriate name in the Authentication Methods text box.

h In the SAML Context drop down, select urn:oasis:names:tc:SAML:

2.0:ac:classes:PasswordProtectedTransport

i Right-click the Service Provider (SP) Metadata link, and open it in a separate browser tab.

j Use this metadata to configure the SAML connection on your identity provider.

If you are using VMware Identity Manager see the VMware Identity Manager documentation for

complete instructions on configuring SAML.

3Click Add.

The new directory is created using the Directory Name provided.

Configuring vRealize Automation

VMware, Inc. 108

4Configure the vRealize Automation Access Policy.

a Select Administration > Policies.

b Click the green + icon at the top right of the policy rules table.

c Set the policy rule to apply to applicable ranges and device types.

d Select the authentication method that you created when configuring the third party identity

provider for JIT provisioning for the authentication method.

Managing User Attributes that Sync from Active Directory

The Directories Management User Attributes page lists the user attributes that sync to your Active

Directory connection.

Changes that you make and save in the User Attributes page are added to the Mapped Attributes page in

the Directories Management directory. The attributes changes are updated to the directory with the next

sync to Active Directory.

The User Attributes page lists the default directory attributes that you can map to Active Directory

attributes. You select the attributes that are required, and you can add other Active Directory attributes to

sync to the directory.

Table 2‑6. Default Active Directory Attributes to Sync to Directory

Directory Attribute Name Default Mapping to Active Directory Attribute

userPrincipalName userPrincipalName

distinguishedName distinguishedName

employeeId employeeID

domain canonicalName. Adds the fully qualified domain name of the object.

disabled (external user disabled) userAccountControl. Flagged with UF_Account_Disable.

When an account is disabled, users cannot log in to access their

applications and resources. The resources that users were entitled

to are not removed from the account so that when the flag is

removed from the account users can log in and access their entitled

resources.

phone telephoneNumber

lastName sn

firstName givenName

email mail

userName sAMAccountName

The User Attributes page lists the default directory attributes that you can map to Active Directory

attributes. You select the attributes that are required, and you can add other Active Directory attributes to

sync to the directory.

Configuring vRealize Automation

VMware, Inc. 109

Table 2‑7. Default Active Directory Attributes to Sync to Directory

Directory Attribute Name Default Mapping to Active Directory Attribute

userPrincipalName userPrincipalName

distinguishedName distinguishedName

employeeId employeeID

domain canonicalName. Adds the fully qualified domain name of the object.

disabled (external user disabled) userAccountControl. Flagged with UF_Account_Disable.

When an account is disabled, users cannot log in to access their

applications and resources. The resources that users were entitled

to are not removed from the account so that when the flag is

removed from the account users can log in and access their entitled

resources.

phone telephoneNumber

lastName sn

firstName givenName

email mail

userName sAMAccountName

Managing Connectors and Connector Clusters

The Connectors page lists deployed connectors for your enterprise network. A connector syncs user and

group data between Active Directory and the Directories Management service, and when it is used as the

identity provider, authenticates users to the service.

In vRealize Automation, each vRealize Automation appliance contains its own connector, and these

connectors are suitable for most deployments.

When you associate a directory with a connector instance, the connector creates a partition for the

associated directory called a worker. A connector instance can have multiple associated workers. Each

worker acts as an identity provider. The connector syncs user and group data between Active Directory

and the service through one or more workers. You define and configure authentication methods on a per

worker basis.

You can manage various aspects of an Active Directory link from the Connectors page. This page

contains a table and several buttons that enable you to complete various management tasks.

nIn the Worker column, select a worker to view the connector details and navigate to the Auth

Adapters page to see the status of the available authentication methods. For information about

authentication, see Integrating Alternative User Authentication Products with Directories

Management.

nIn the Identity Provider column, select the IdP to view, edit or disable. See Configure a Third Party

Identity Provider Connection.

nIn the Associated Directory column, access the directory associated with this worker.

Configuring vRealize Automation

VMware, Inc. 110

nClick Join Domain to join the connector to a specific Active Directory domain. For example when you

configure Kerberos authentication, you must join the Active Directory domain either containing users

or having trust relationship with the domains containing users.

nWhen you configure a directory with an Integrated Windows Authentication Active Directory, the

connector joins the domain according to the configuration details.

Connectors in a Clustered Environment

In a distributed, vRealize Automation deployment, all available connectors perform any required user

authorization, while a single designated connector handles all configuration synchronization. Typically,

synchronization would include additions, deletions, or changes to the user configuration, and

synchronization occurs automatically as long as all connectors are available. There are some specific

situations in which automatic synchronization may not occur.

For changes related to directory configuration, such as base dn, vRealize Automation attempts to

automatically push updates to all connectors in a cluster. If a connector is inoperable or unreachable for

some reason, that connector will not receive the update, even when it resumes online operation. To

implement configuration changes to connectors that may not have received them automatically, system

administrators must manually save the changes to all applicable connectors.

For directory sync profile related changes, vRealize Automation attempts to automatically push updates

to all connectors as well. If the sync connector is operational, the update is saved and pushed to all

available authorization connectors. If one or more connectors is unreachable, the system admin receives

a warning indicating that not all connectors were updated. If the sync connector is inoperable, the update

fails and an error occurs. If the system admin changes the connector designated as the sync connector,

the new sync connector receives the latest available profile information, and this information is pushed to

all applicable, and available, connectors.

Join a Connector Machine to a Domain

In some cases, you may need to join a machine containing a Directories Management connector to a

domain.

For Active Directory over LDAP directories, you can join a domain after creating the directory. For Active

Directory (Integrated Windows Authentication) directories, the connector is joined to the domain

automatically when you create the directory. In both cases, you must supply the appropriate credentials.

To join a domain, you need Active Directory credentials that have the privilege to "join computer to AD

domain". This is configured in Active Directory with the following rights:

nCreate Computer Objects

nDelete Computer Objects

When you join a domain, a computer object is created in the default location in Active Directory.

If you do not have the rights to join a domain, or if your company policy requires a custom location for the

computer object, you must ask your administrator to create the object and then join the connector

machine to the domain.

Configuring vRealize Automation

VMware, Inc. 111

Procedure

1Ask your Active Directory administrator to create the computer object in Active Directory in a location

determined by your company policy. You must provide the host name of the connector. Ensure that

you provide the fully-qualified domain name, for example server.example.com.

You can find the host name in the Host Name column on the Connectors page in the administrative

console. Select Administration > Directories Management > Connectors.

2After the computer object is created, click Join Domain on the Connectors page to join the domain

using any domain user account available in Directories Management.

About Domain Controller Selection

The domain_krb.properties file determines which domain controllers are used for directories that have

DNS Service Location (SRV records) lookup enabled. It contains a list of domain controllers for each

domain. The connector creates the file initially, and you must maintain it subsequently. The file overrides

DNS Service Location (SRV) lookup.

The following types of directories have DNS Service Location lookup enabled.

nActive Directory over LDAP with the This Directory supports DNS Service Location option

selected

nActive Directory (Integrated Windows Authentication), which always has DNS Service Location

lookup enabled

When you first create a directory that has DNS Service Location lookup enabled, a

domain_krb.properties file is created automatically in the /usr/local/horizon/conf directory of the

virtual machine and is auto-populated with domain controllers for each domain. To populate the file, the

connector attempts to find domain controllers that are at the same site as the connector and selects two

that are reachable and that respond the fastest.

When you create additional directories that have DNS Service Location enabled, or add new domains to

an Integrated Windows Authentication directory, the new domains, and a list of domain controllers for

them, are added to the file.

You can override the default selection at any time by editing the domain_krb.properties file. As a best

practice, after you create a directory, view the domain_krb.properties file and verify that the domain

controllers listed are the optimal ones for your configuration. For a global Active Directory deployment that

has multiple domain controllers across different geographical locations, using a domain controller that is

in close proximity to the connector ensures faster communication with Active Directory.

You must also update the file manually for any other changes. The following rules apply.

nThe file is created, and auto-populated with domain controllers for each domain, when you first create

a directory that has DNS Service Location lookup enabled.

nDomain controllers for each domain are listed in order of priority. To connect to Active Directory, the

connector tries the first domain controller in the list. If it is not reachable, it tries the second one in the

list, and so on.

Configuring vRealize Automation

VMware, Inc. 112

nThe file is updated only when you create a new directory that has DNS Service Location lookup

enabled or when you add a domain to an Integrated Windows Authentication directory. The new

domain and a list of domain controllers for it are added to the file.

Note that if an entry for a domain already exists in the file, it is not updated. For example, if you

created a directory, then deleted it, the original domain entry remains in the file and is not updated.

nThe file is not updated automatically in any other scenario. For example, if you delete a directory, the

domain entry is not deleted from the file.

nIf a domain controller listed in the file is not reachable, edit the file and remove it.

nIf you add or edit a domain entry manually, your changes will not be overwritten.

How Domain Controllers are Selected to Auto-Populate the domain_krb.properties File

To auto-populate the domain_krb.properties file, domain controllers are selected by first determining

the subnet on which the connector resides (based on the IP address and netmask), then using the Active

Directory configuration to identify the site of that subnet, getting the list of domain controllers for that site,

filtering the list for the appropriate domain, and picking the two domain controllers that respond the

fastest.

To detect the domain controllers that are the closest, VMware Identity Manager has the following

requirements.

nThe subnet of the connector must be present in the Active Directory configuration, or a subnet must

be specified in the runtime-config.properties file.

The subnet is used to determine the site.

nThe Active Directory configuration must be site aware.

If the subnet cannot be determined or if your Active Directory configuration is not site aware, DNS Service

Location lookup is used to find domain controllers, and the file is populated with a few domain controllers

that are reachable. Note that these domain controllers may not be at the same geographical location as

the connector, which can result in delays or timeouts while communicating with Active Directory. In this

case, edit the domain_krb.properties file manually and specify the correct domain controllers to use

for each domain.

Sample domain_krb.properties File

example.com=host1.example.com:389,host2.example.com:389

nOverride the Default Subnet Selection

To auto-populate the domain_krb.properties file, the connector attempts to find domain

controllers that are at the same site so there is minimal latency between the connector and Active

Directory.

Configuring vRealize Automation

VMware, Inc. 113

nEdit the domain_krb.properties file

The /usr/local/horizon/conf/domain_krb.properties file determines the domain controllers

to use for directories that have DNS Service Location lookup enabled. You can edit the file at any

time to modify the list of domain controllers for a domain, or to add or delete domain entries. Your

changes will not be overridden.

nTroubleshooting domain_krb.properties

Use this information to troubleshoot the domain_krb.properties file.

Override the Default Subnet Selection

To auto-populate the domain_krb.properties file, the connector attempts to find domain controllers that

are at the same site so there is minimal latency between the connector and Active Directory.

To find the site, the connector determines the subnet on which it resides, based on its IP address and

netmask, then uses the Active Directory configuration to identify the site for that subnet. If the subnet of

the virtual machine is not in Active Directory, or if you want to override the automatic subnet selection, you

can specify a subnet in the runtime-config.properties file.

Procedure

1Log in to the virtual machine as the root user.

2Edit the /usr/local/horizon/conf/runtime-config.properties file and add the following

attribute.

siteaware.subnet.override=subnet

where subnet is a subnet for the site whose domain controllers you want to use. For example:

siteaware.subnet.override=10.100.0.0/20

3Save and close the file.

4Restart the service.

service horizon-workspace restart

Edit the domain_krb.properties ﬁle

The /usr/local/horizon/conf/domain_krb.properties file determines the domain controllers to

use for directories that have DNS Service Location lookup enabled. You can edit the file at any time to

modify the list of domain controllers for a domain, or to add or delete domain entries. Your changes will

not be overridden.

The file is initially created and auto-populated by the connector. You need to update it manually in some

scenarios.

nIf the domain controllers selected by default are not the optimal ones for your configuration, edit the

file and specify the domain controllers to use.

nIf you delete a directory, delete the corresponding domain entry from the file.

nIf any domain controllers in the file are not reachable, remove them from the file.

Configuring vRealize Automation

VMware, Inc. 114

See also About Domain Controller Selection.

Procedure

1Log in to the virtual machine as the root user.

2Change directories to /usr/local/horizon/conf.

3Edit the domain_krb.properties file to add or edit the list of domain to host values.

Use the following format:

domain=host:port,host2:port,host3:port

For example:

example.com=examplehost1.example.com:389,examplehost2.example.com:389

List the domain controllers in order of priority. To connect to Active Directory, the connector tries the

first domain controller in the list. If it is not reachable, it tries the second one in the list, and so on.

Important Domain names must be in lowercase.

4Change the owner of the domain_krb.properties file to horizon and group to www using the

following command:

chown horizon:www /usr/local/horizon/conf/domain_krb.properties

5Restart the service.

service horizon-workspace restart

Troubleshooting domain_krb.properties

Use this information to troubleshoot the domain_krb.properties file.

"Error resolving domain" error

If the domain_krb.properties file already includes an entry for a domain, and you try to create a new

directory of a different type for the same domain, an "Error resolving domain" error occurs. You must edit

the domain_krb.properties file and manually remove the domain entry before creating the new

directory.

Domain controllers are unreachable

Once a domain entry is added to the domain_krb.properties file, it is not updated automatically. If any

domain controllers listed in the file become unreachable, edit the file manually and remove them.

Managing Access Policies

The Directories Management policies are a set of rules that specify criteria that must be met for users to

access their app portal or to launch specified Web applications.

Configuring vRealize Automation

VMware, Inc. 115

You create the rule as part of a policy. Each rule in a policy can specify the following information.

nThe network range, where users are allowed to log in from, such as inside or outside the enterprise

network.

nThe device type that can access through this policy.

nThe order that the enabled authentication methods are applied.

nThe number of hours the authentication is valid.

nCustom access denied message.

Note The policies do not control the length of time that a Web application session lasts. They control the

amount of time that users have to launch a Web application.

The Directories Management service includes a default policy that you can edit. This policy controls

access to the service as a whole. See Applying the Default Access Policy. To control access to specific

Web applications, you can create additional policies. If you do not apply a policy to a Web application, the

default policy applies.

Conﬁguring Access Policy Settings

A policy contains one or more access rules. Each rule consists of settings that you can configure to

manage user access to their application portals as a whole or to specified Web applications.

Network Range

For each rule, you determine the user base by specifying a network range. A network range consists of

one or more IP ranges. You create network ranges from the Identity & Access Management tab, Setup >

Network Ranges page prior to configuring access policy sets.

Device Type

Select the type of device that the rule manages. The client types are Web Browser, Identity Manager

Client App, iOS, Android, and All device types.

Authentication Methods

Set the priority of the authentication methods for the policy rule. The authentication methods are applied

in the order they are listed. The first identity provider instances that meets the authentication method and

network range configuration in the policy is selected, and the user authentication request is forwarded to

the identity provider instance for authentication. If authentication fails, the next authentication method in

the list is selected. If Certificate authentication is used, this method must be the first authentication

method in the list.

Configuring vRealize Automation

VMware, Inc. 116

You can configure access policy rules to require users to pass credentials through two authentication

methods before they can sign in. If one or both authentication method fails and fallback methods are also

configured, users are prompted to enter their credentials for the next authentication methods that are

configured. The following two scenarios describe how authentication chaining can work.

nIn the first scenario, the access policy rule is configured to require users to authenticate with their

password and with their Kerberos credential. Fallback authentication is set up to require the password

and the RADIUS credential for authentication. A user enters the password correctly, but fails to enter

the correct Kerberos authentication credential. Since the user entered the correct password, the

fallback authentication request is only for the RADIUS credential. The user does not need to re-enter

the password.

nIn the second scenario, the access policy rule is configured to require users to authenticate with their

password and their Kerberos credential. Fallback authentication is set up to require RSA SecurID and

a RADIUS for authentication. A user enters the password correctly but fails to enter the correct

Kerberos authentication credential. The fallback authentication request is for both the RSA SecurID

credential and the RADIUS credential for authentication.

Authentication Session Length

For each rule, you set the length that this authentication is valid. The value determines the maximum

amount of time users have since their last authentication event to access their portal or to launch a

specific Web application. For example, a value of 4 in a Web application rule gives users four hours to

launch the web application unless they initiate another authentication event that extends the time.

Custom Access Denied Error Message

When users attempt to sign in and fail because of invalid credentials, incorrect configuration, or system

error, an access denied message is displayed. The default message is

Access denied as no valid authentication methods were found.

You can create a custom error message for each access policy rule that overrides the default message.

The custom message can include text and a link for a call to action message. For example, in a policy

rules for mobile devices that you want to manage, if a user tries to sign in from an unenrolled device, the

follow custom error message could appear:

Please enroll your device to access corporate resources by clicking the link at the end of this

message. If your device is already enrolled, contact support for help.

Example Default Policy

The following policy serves as an example of how you can configure the default policy to control access

to the apps portal. See Manage the User Access Policy.

The policy rules are evaluated in the order listed. You can change the order of the policy by dragging and

dropping the rule in the Policy Rules section.

In the following use case, this policy example applies to all applications.

Configuring vRealize Automation

VMware, Inc. 117

1nFor the internal network (Internal Network Range), two authentication methods are configured for

the rule, Kerberos and password authentication as the fallback method. To access the apps portal

from an internal network, the service attempts to authenticate users with Kerberos authentication

first, as it is the first authentication method listed in the rule. If that fails, users are prompted to

enter their Active Directory password. Users log in using a browser and now have access to their

user portals for an eight-hour session.

nFor access from the external network (All Ranges), only one authentication method is configured,

RSA SecurID. To access the apps portal from an external network, users are required to log in

with SecurID. Users log in using a browser and now have access to their apps portals for a four-

hour session.

2 When a user attempts to access a resource, except for Web applications covered by a Web-

application-specific policy, the default portal access policy applies.

For example, the re-authentication time for such resources matches the re-authentication time of the

default access policy rule. If the time for a user who logs in to the apps portal is eight hours according

to the default access policy rule, when the user attempts to launch a resource during the session, the

application launches without requiring the user to re-authenticate.

Managing Web-Application-Speciﬁc Policies

When you add Web applications to the catalog, you can create Web-application-specific access policies.

For example, you can create an policy with rules for a Web application that specifies which IP addresses

have access to the application, using which authentication methods, and for how long until

reauthentication is required.

The following Web-application-specific policy provides an example of a policy you can create to control

access to specified Web applications.

Example 1 Strict Web-Application-Speciﬁc Policy

In this example, a new policy is created and applied to a sensitve Web application.

Configuring vRealize Automation

VMware, Inc. 118

1 To access the service from outside the enterprise network, the user is required to log in with RSA

SecurID. The user logs in using a browser and now has access to the apps portal for a four hour

session as provided by the default access rule.

2 After four hours, the user tries to launch a Web application with the Sensitive Web Applications policy

set applied.

3 The service checks the rules in the policy and applies the policy with the ALL RANGES network

range since the user request is coming from a Web browser and from the ALL RANGES network

range.

The user logs in using the RSA SecurID authentication method, but the session just expired. The user

is redirected for reauthentication. The reauthentication provides the user with another four hour

session and the ability to launch the application. For the next four hours, the user can continue to

launch the application without having to reauthenticate.

Example 2 Stricter Web-Application-Speciﬁc Policy

For a stricter rule to apply to extra sensitve Web applications, you could require re-authentication With

SecureId on any device after 1 hour. The following is an example of how this type of policy access rule is

implemented.

1 User logs in from an inside the enterprise network using the password authentication method.

Now, the user has access to the apps portal for eight hours, as set up in Example 1.

2 The user immediately tries to launch a Web application with the Example 2 policy rule applied, which

requires RSA SecurID authentication.

3 The user is redirected to an identity provider that provides RSA SecurID authentication.

Configuring vRealize Automation

VMware, Inc. 119

4 After the user successfully logs in, the service launches the application and saves the authentication

event.

The user can continue to launch this application for up to one hour but is asked to reauthenticate after

an hour, as dictated by the policy rule.

Manage the User Access Policy

vRealize Automation is supplied with a default user access policy that you can use as is or edit as needed

to manage tenant access to applications.

vRealize Automation is supplied with a default user access policy, and you cannot add new policies. You

can edit the existing policy to add rules.

Prerequisites

nSelect or configure the appropriate identity providers for your deployment. See Configure a Third

Party Identity Provider Connection.

nConfigure the appropriate network ranges for your deployment. See Add or Edit a Network Range.

nConfigure the appropriate authentication methods for your deployment. See Integrating Alternative

User Authentication Products with Directories Management.

nIf you plan to edit the default policy (to control user access to the service as a whole), configure it

before creating Web-application-specific policy.

nAdd Web applications to the Catalog. The Web applications must be listed in the Catalog page before

you can add a policy.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Select Administration > Directories Management > Policies.

2Click Edit Policy to add a new policy.

3Add a policy name and description in the respective text boxes.

4In the Applies To section, click Select and in the page that appears, select the Web applications that

are associated with this policy.

5In the Policy Rules section, click + to add a rule.

The Add a Policy Rule page appears.

a Select the network range to apply to this rule.

b Select the type of device that can access the web applications for this rule.

c Select the authentication methods to use in the order the method should be applied.

d Specify the number of hours a Web application session open.

e Click Save.

6Configure additional rules as appropriate.

Configuring vRealize Automation

VMware, Inc. 120

7Click Save.

Conﬁguring Additional Identity Provider Connections

You can configure additional identity provider connections as needed to support different identity

management scenarios, including additional built-in identity providers and third-party identity providers.

You can create three types of identity provider connections using Directories Management.

nCreate Third-Party IDP - Use this item to create a connection to an external third-party identity

provider. Ensure that you have following before adding a third-party identity provider instance.

nVerify that the third-party instances are SAML 2.0 compliant and that the service can reach the

third-party instance.

nObtain the appropriate third-party metadata information to add when you configure the identity

provider in the administration console. The metadata information you obtain from the third-party

instance is either the URL to the metadata or the actual metadata.

nCreate Workspace IDP - When you enable a connector to authenticate users during Directories

Management configuration, a Workspace IDP is created as the identity provider and password

authentication is enabled. You can configure additional workspace identity providers behind different

load balancers.

nCreate Built-in IDP - Built in Identity Providers use the internal Directories Management mechanisms

to support authentication. You can configure built-in identity providers to use authentication methods

that do not require the use of an on premises connector. When you configure the built-in provider, you

associate the authentication methods to use with the provider.

nConfigure a Third Party Identity Provider Connection

vRealize Automation is supplied with a default identity provider connection instance. Users may

want to create additional identity provider connections to support just-in-time user provisioning or

other custom configurations.

nConfigure Additional Workspace Identity Providers

When you configure a Directories Management connector to authenticate users, a Workspace IDP is

created and password authentication is enabled.

nConfigure a Built-in Identity Provider Connection

You can configure multiple built-in identity providers and associate authentication methods with

them.

Conﬁgure a Third Party Identity Provider Connection

vRealize Automation is supplied with a default identity provider connection instance. Users may want to

create additional identity provider connections to support just-in-time user provisioning or other custom

configurations.

vRealize Automation is supplied with an default identity provider. In most cases, the default provider is

sufficient for customer needs. If you use an existing enterprise identity management solution, you can set

up a custom identity provider to redirect users to your existing identity solution.

Configuring vRealize Automation

VMware, Inc. 121

When using a custom identity provider, Directories Management uses SAML metadata from that provider

to establish a trust relationship with the provider. After this relationship is established, Directories

Management maps the users from the SAML assertion to the list of internal vRealize Automation users

based the subject name ID.

Prerequisites

nConfigure the network ranges that you want to direct to this identity provider instance for

authentication. See Add or Edit a Network Range.

nAccess to the third-party metadata document. This can be either the URL to the metadata or the

actual metadata.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Select Administration > Directories Management > Identity Providers.

This page displays all configured Identity Providers.

2Click Add Identity Provider.

A menu appears with Identity Provider options.

3Select Create Third Party IDP.

4Enter the appropriate information to configure the identity provider.

Option Description

Identity Provider Name Enter a name for this identity provider instance.

SAML Metadata Add the third party IdPs XML-based metadata document to establish trust with the identity

provider.

1 Enter the SAML metadata URL or the xml content into the text box.

2 Click Process IdP Metadata. The NameID formats supported by the IdP are extracted from

the metadata and added to the Name ID Format table.

3 In the Name ID value column, select the user attribute in the service to map to the ID formats

displayed. You can add custom third-party name ID formats and map them to the user

attribute values in the service.

4 (Optional) Select the NameIDPolicy response identifier string format.

Users Select the Directories Management directories of the users that can authenticate using this

identity provider.

Just-in-Time User

Provisioning

Select the appropriate options to support just-in-time provisioning using an appropriate third party

identity provider.

Enter the Directory Name to use for just-in-time provisioning.

Enter one or more Domains that exist within the external identity provider that you will use for

just-in-time provisioning.

Network The existing network ranges configured in the service are listed.

Select the network ranges for the users, based on their IP addresses, that you want to direct to

this identity provider instance for authentication.

Configuring vRealize Automation

VMware, Inc. 122

Option Description

Authentication Methods Add the authentication methods supported by the third-party identity provider. Select the SAML

authentication context class that supports the authentication method.

SAML Signing Certificate Click Service Provider (SP) Metadata to see URL to Directories Management SAML service

provider metadata URL . Copy and save the URL. This URL is configured when you edit the

SAML assertion in the third-party identity provider to map Directories Management users.

Hostname If the Hostname field displays, enter the hostname where the identity provider is redirected to for

authentication. If you are using a non-standard port other than 443, you can set this as

Hostname:Port. For example, myco.example.com:8443.

5Click Add.

What to do next

nCopy and save the Directories Management service provider metadata that is required to configure

the third-party identity provider instance. This metadata is available either in the SAML Signing

Certificate section of the Identity Provider page.

nAdd the authentication method of the identity provider to the services default policy.

See the Setting Up Resources in Directories Management guide for information about adding and

customizing resources that you add to the catalog.

Conﬁgure Additional Workspace Identity Providers

When you configure a Directories Management connector to authenticate users, a Workspace IDP is

created and password authentication is enabled.

You can configure additional connectors to operate behind multiple load balancers. When your

deployment includes more than one load balancer, you can configure additional Workspace identity

providers for authentication in each load balancer configuration.

Procedure

1Select Administration > Directories Management > Identity Providers.

This page displays all configured Identity Providers.

2Click Add Identity Provider.

A menu appears with Identity Provider options.

3Select Create Workspace IDP.

4Enter the appropriate information to configure the identity provider.

Option Description

Identity Provider Name Enter the name for this built-in identity provider instance.

Users Select the users to authenticate. The configured directories are listed.

Users Select the group of users who can authenticate using this Workspace identity provider.

Configuring vRealize Automation

VMware, Inc. 123

Option Description

Network The existing network ranges configured in the service are listed. Select the network range

for the users based on the IP addresses that you want to direct to this identity provider

instance for authentication.

Authentication Methods Authentication methods that are configured for the service are displayed. Select the check

box for the authentication methods to associate with this identity provider.

For device compliance and Password, with AirWatch and AirWatch Connector, ensure that

the option is enabled on the AirWatch configuration page.

5Click Add.

Conﬁgure a Built-in Identity Provider Connection

You can configure multiple built-in identity providers and associate authentication methods with them.

Prerequisites

If you are using Built-in Keberos authentication, download the KDC issuer certificate to use in the

AirWatch configuration of the iOS device management profile.

Procedure

1Select Administration > Directories Management > Identity Providers.

This page displays all configured Identity Providers.

2Click Add Identity Provider.

A menu appears with Identity Provider options.

3Select Create Built-in IDP.

4Enter the appropriate information to configure the identity provider.

Option Description

Identity Provider Name Enter the name for this built-in identity provider instance.

Users Select the users to authenticate. The configured directories are listed.

Network The existing network ranges configured in the service are listed. Select the network range

for the users based on the IP addresses that you want to direct to this identity provider

instance for authentication.

Authentication Methods The authentication methods that are configured for the service are displayed. Select the

check box for the authentication methods to associate with this identity provider.

For device compliance and Password, with AirWatch and AirWatch Connector, ensure that

the appropriate option is enabled on the AIrWatch configuration page.

5Click Add.

Configuring vRealize Automation

VMware, Inc. 124

Integrating Alternative User Authentication Products with Directories

Management

Typically, when you initially configure Directories Management, you use the connectors supplied with your

existing vRealize Automation infrastructure to create an Active Directory connection for user ID and

password based authentication and management. Alternatively, you can integrate Directories

Management with other authentication solutions such as Kerberos or RSA SecurID.

The identity provider instance can be the Directories Management connector instance, third-party identity

provider instances, or a combination of both.

The identity provider instance that you use with the Directories Management service creates an in-

network federation authority that communicates with the service using SAML 2.0 assertions.

When you initially deploy the Directories Management service, the connector is the initial identity provider

for the service. Your existing Active Directory infrastructure is used for user authentication and

management.

The following authentication methods are supported. You configure these authentication methods from

the administration console.

Table 2‑8. User Authentication Types Supported by Directories Management

Authentication Types Description

Password (on-premise deployment) Without any configuration after Active Directory is configured, Directories Management

supports Active Directory password authentication. This method authenticates users

directly against Active Directory.

Kerberos for desktops Kerberos authentication provides domain users with single sign-in access to their apps

portal. Users do not need to sign in again after they sign in to the network.

Certificate (on-premise deployment) Certificate-based authentication can be configured to allow clients to authenticate with

certificates on their desktop and mobile devices or to use a smart card adapter for

authentication.

Certificate-based authentication is based on what the user has and what the person

knows. An X.509 certificate uses the public key infrastructure standard to verify that a

public key contained within the certificate belongs to the user.

RSA SecurID (on-premise deployment) When RSA SecurID authentication is configured, Directories Management is configured

as the authentication agent in the RSA SecurID server. RSA SecurID authentication

requires users to use a token-based authentication system. RSA SecurID is an

authentication method for users accessing Directories Management from outside the

enterprise network.

RADIUS (on-premise deployment) RADIUS authentication provides two-factor authentication options. You set up the

RADIUS server that is accessible to the Directories Management service. When users

server for authentication.

RSA Adaptive Authentication (on-

premise deployment)

RSA authentication provides a stronger multi-factor authentication than only user name

and password authentication against Active Directory. When RSA Adaptive Authentication

is enabled, the risk indicators specified in the risk policy set up in the RSA Policy

Management application. The Directories Management service configuration of adaptive

authentication is used to determine the required authentication prompts.

Configuring vRealize Automation

VMware, Inc. 125

Table 2‑8. User Authentication Types Supported by Directories Management (Continued)

Authentication Types Description

Mobile SSO (for iOS) Mobile SSO for iOS authentication is used for single sign-on authentication for AirWatch-

managed iOS devices. Mobile SSO (for iOS) authentication uses a Key Distribution

Center (KDC) that is part of the Directories Management service. You must initiate the

KDC service in the VMware Identity Manager service before you enable this

authentication method.

Mobile SSO (for Android) Mobile SSO for Android authentication is used for single sign-on authentication for

AirWatch-managed Android devices. A proxy service is set up between the

Directories Management service and AirWatch to retrieve the certificate from AirWatch for

authentication.

Password (AirWatch Connector) The AirWatch Cloud Connector can be integrated with the Directories Management

service for user password authentication. You configure the

Directories Managementservice to sync users from the AirWatch directory.

Users are authenticated based on the authentication methods, the default access policy rules, network

ranges, and the identity provider instance you configure. After the authentication methods are configured,

you create access policy rules that specify the authentication methods to be used by device type.

Conﬁguring SecurID for Directories Management

When you configure RSA SecurID server, you must add the service information as the authentication

agent on the RSA SecurID server and configure the RSA SecurID server information on the service.

When you configure SecurID to provide additional security, you must ensure that your network is properly

configured for your Directories Management deployment. For SecurID specifically, you must ensure that

the appropriate port is open to enable SecurID to authenticate users outside your network.

After you run the Setup wizard and configured your Active Directory connection, you have the information

necessary to prepare the RSA SecurID server. After you prepare the RSA SecurID server for

Directories Management, you enable SecurID in the administration console.

nPrepare the RSA SecurID Server

The RSA SecurID server must be configured with information about the appliance as the

authentication agent. The information required is the host name and the IP addresses for network

interfaces.

nConfigure RSA SecurID Authentication

After Directories Management is configured as the authentication agent in the RSA SecurID server,

you must add the RSA SecurID configuration information to the connector.

Prepare the RSA SecurID Server

The RSA SecurID server must be configured with information about the appliance as the authentication

agent. The information required is the host name and the IP addresses for network interfaces.

Configuring vRealize Automation

VMware, Inc. 126

Prerequisites

nVerify that one of the following RSA Authentication Manager versions is installed and functioning on

the enterprise network: RSA AM 6.1.2, 7.1 SP2 and later, and 8.0 and later. The server uses

AuthSDK_Java_v8.1.1.312.06_03_11_03_16_51 (Agent API 8.1 SP1), which only supports the

preceding versions of RSA Authentication Manager (the RSA SecurID server). For information about

installing and configuring RSA Authentication Manager (RSA SecurID server), see RSA

documentation.

Procedure

1On a supported version of the RSA SecurID server, add the connector as an authentication agent.

Enter the following information.

Option Description

Hostname The host name of .

IP address The IP address of .

Alternate IP address If traffic from the connector passes through a network address translation (NAT)

device to reach the RSA SecurID server, enter the private IP address of the

appliance.

2Download the compressed configuration file and extract the sdconf.rec file.

Be prepared to upload this file later when you configure RSA SecurID in Directories Management.

What to do next

Go to the administration console and in the Identity & Access Management tab Setup pages, select the

connector and in the AuthAdapters page configure SecurID.

Conﬁgure RSA SecurID Authentication

After Directories Management is configured as the authentication agent in the RSA SecurID server, you

must add the RSA SecurID configuration information to the connector.

Prerequisites

nVerify that RSA Authentication Manager (the RSA SecurID server) is installed and properly

configured.

nDownload the compressed file from the RSA SecurID server and extract the server configuration file.

Procedure

1As a tenant administrator, navigate to Administration > Directories Management > Connectors

2On the Connectors page, select the Worker link for the connector that is being configured with RSA

SecurID.

3Click Auth Adapters and then click SecurIDldpAdapter.

You are redirected to the identity manager sign in page.

Configuring vRealize Automation

VMware, Inc. 127

4In the Authentication Adapters page SecurIDldpAdapter row, click Edit.

5Configure the SecurID Authentication Adapter page.

Information used and files generated on the RSA SecurID server are required when you configure the

SecurID page.

Option Action

Name A name is required. The default name is SecurIDldpAdapter. You can change this.

Enable SecurID Select this box to enable SecurID authentication.

Number of

authentication

attempts

allowed

Enter the maximum number of failed login attempts when using the RSA SecurID token. The default is five

attempts.

Connector

Address

Enter the IP address of the connector instance. The value you enter must match the value you used when

you added the connector appliance as an authentication agent to the RSA SecurID server. If your RSA

SecurID server has a value assigned to the Alternate IP address prompt, enter that value as the connector

IP address. If no alternate IP address is assigned, enter the value assigned to the IP address prompt.

Agent IP

Address

Enter the value assigned to the IP address prompt in the RSA SecurID server.

Server

Configuration

Upload the RSA SecurID server configuration file. First, you must download the compressed file from the

RSA SecurID server and extract the server configuration file, which by default is named sdconf.rec.

Node Secret Leaving the node secret field blank allows the node secret to auto generate. It is recommended that you

clear the node secret file on the RSA SecurID server and intentionally do not upload the node secret file.

Ensure that the node secret file on the RSA SecurID server and on the server connector instance always

match. If you change the node secret at one location, change it at the other location.

6Click Save.

What to do next

Add the authentication method to the default access policy. Navigate to Administration > Directories

Management > Policies and click Edit Default Policy to edit the default policy rules to add the SecurID

authentication method to the rule in the correct authentication order.

Conﬁguring RADIUS for Directories Management

You can configure Directories Management so that users are required to use RADIUS (Remote

Authentication Dial-In User Service) authentication. You configure the RADIUS server information on the

Directories Management service.

RADIUS support offers a wide range of alternative two-factor token-based authentication options.

Because two-factor authentication solutions, such as RADIUS, work with authentication managers

installed on separate servers, you must have the RADIUS server configured and accessible to the identity

manager service.

Configuring vRealize Automation

VMware, Inc. 128

When users sign in to their My Apps portal and RADIUS authentication is enabled, a special login dialog

box appears in the browser. Users enter their RADUS authentication user name and passcode in the

a dialog box prompting for a second passcode. Currently support for RADIUS challenges is limited to

prompting for text input.

After a user enters credentials in the dialog box, the RADIUS server can send an SMS text message or

email, or text using some other out-of-band mechanism to the user's cell phone with a code. The user can

enter this text and code into the login dialog box to complete the authentication.

If the RADIUS server provides the ability to import users from Active Directory, end users might first be

prompted to supply Active Directory credentials before being prompted for a RADIUS authentication

username and passcode.

Prepare the RADIUS Server

Set up the RADIUS server and then configure it to accept RADIUS requests from the

Directories Management service.

Refer to your RADIUS vendor's setup guides for information about setting up the RADIUS server. Note

your RADIUS configuration information as you use this information when you configure RADIUS in the

service. To view the type of RADIUS information required to configure Directories Management see

Configure RADIUS Authentication in Directories Management.

You can set up a secondary Radius authentication server to be used for high availability. If the primary

RADIUS server does not respond within the server timeout configured for RADIUS authentication, the

request is routed to the secondary server. When the primary server does not respond, the secondary

server receives all future authentication requests.

Conﬁgure RADIUS Authentication in Directories Management

You enable RADIUS software on an authentication manager server. For RADIUS authentication, follow

the vendor's configuration documentation.

Prerequisites

Install and configure the RADIUS software on an authentication manager server. For RADIUS

authentication, follow the vendor's configuration documentation.

You need to know the following RADIUS server information to configure RADIUS on the service.

nIP address or DNS name of the RADIUS server.

nAuthentication port numbers. Authentication port is usually 1812.

nAuthentication type. The authentication types include PAP (Password Authentication Protocol), CHAP

(Challenge Handshake Authentication Protocol), MSCHAP1, MSCHAP2 (Microsoft Challenge

Handshake Authentication Protocol, versions 1 and 2).

nRADIUS shared secret that is used for encryption and decryption in RADIUS protocol messages.

nSpecific timeout and retry values needed for RADIUS authentication.

nLog in to vRealize Automation as a tenant administrator.

Configuring vRealize Automation

VMware, Inc. 129

Procedure

1Select Administration > Directories Management > Connectors.

2On the Connectors page, select the Worker link for the connector that is being configured for RADIUS

authentication.

3Click Auth Adapters and then click RadiusAuthAdapter.

You are redirected to the identity manager sign-in page.

4Click Edit to configure these fields on the Authentication Adapter page.

Option Action

Name A name is required. The default name is RadiusAuthAdapter. You can change this.

Enable Radius

Adapter

Select this box to enable RADIUS authentication.

Number of

authentication

attempts

allowed

Enter the maximum number of failed login attempts when using RADIUS to log in. The default is five

attempts.

Number of

attempts to

Radius server

Specify the total number of retry attempts. If the primary server does not respond, the service waits for the

configured time before retrying again.

Radius server

hostname/addr

ess

Enter the host name or the IP address of the RADIUS server.

Authentication

port

Enter the Radius authentication port number. This is usually 1812.

Accounting port Enter 0 for the port number. The accounting port is not used at this time.

Authentication

type

Enter the authentication protocol that is supported by the RADIUS server. Either PAP, CHAP, MSCHAP1,

OR MSCHAP2.

Shared secret Enter the shared secret that is used between the RADIUS server and the VMware Identity Manager service.

Server timeout

in seconds

Enter the RADIUS server timeout in seconds, after which a retry is sent if the RADIUS server does not

respond.

Realm Prefix (Optional) The user account location is called the realm.

If you specify a realm prefix string, the string is placed at the beginning of the user name when the name is

sent to the RADIUS server. For example, if the user name is entered as jdoe and the realm prefix DOMAIN-

A\ is specified, the user name DOMAIN-A\jdoe is sent to the RADIUS server. If you do not configure these

fields, only the user name that is entered is sent.

Realm Suffix (Optional) If you specify a realm suffix, the string is placed at end of the user name. For example, if the suffix

is @myco.com, the username jdoe@myco.com is sent to the RADIUS server.

passphrase

hint

Enter the text string to display in the message on the user login page to direct users to enter the correct

Radius passcode. For example, if this field is configured with AD password first and then SMS passcode,

the login page message would read Enter your AD password first and then SMS passcode. The default

text string is RADIUS Passcode.

Configuring vRealize Automation

VMware, Inc. 130

5You can enable a secondary RADIUS server for high availability.

Configure the secondary server as described in step 4.

6Click Save.

What to do next

Add the RADIUS authentication method to the default access policy. Select Administration >

Directories Management > Policies and click Edit Default Policy to edit the default policy rules to add

the RADIUS authentication method to the rule in the correct authentication order.

Conﬁguring a Certiﬁcate or Smart Card Adapter for Use with Directories Management

You can configure x509 certificate authentication to allow clients to authenticate with certificates on their

desktop and mobile devices or to use a smart card adapter for authentication. Certificate-based

authentication is based on what the user has (the private key or smart card), and what the person knows

(the password to the private key or the smart-card PIN.) An X.509 certificate uses the public key

infrastructure (PKI) standard to verify that a public key contained within the certificate belongs to the user.

With smart card authentication, users connect the smart card with the computer and enter a PIN.

The smart card certificates are copied to the local certificate store on the user's computer. The certificates

in the local certificate store are available to all the browsers running on this user's computer, with some

exceptions, and therefore, are available to a Directories Management instance in the browser.

nUsing User Principal Name for Certificate Authentication

You can use certificate mapping in Active Directory. Certificate and smart card logins uses the user

principal name (UPN) from Active Directory to validate user accounts. The Active Directory accounts

of users attempting to authenticate in the Directories Management service must have a valid UPN

that corresponds to the UPN in the certificate.

nCertificate Authority Required for Authentication

To enable logging in using certificate authentication, root certificates and intermediate certificates

must be uploaded to the .

nUsing Certificate Revocation Checking

You can configure certificate revocation checking to prevent users who have their user certificates

revoked from authenticating. Certificates are often revoked when a user leaves an organization,

loses a smart card, or moves from one department to another.

nConfigure Certificate Authentication for Directories Management

You enable and configure certificate authentication from the vRealize Automation administration

console Directories Management feature.

Using User Principal Name for Certiﬁcate Authentication

You can use certificate mapping in Active Directory. Certificate and smart card logins uses the user

principal name (UPN) from Active Directory to validate user accounts. The Active Directory accounts of

users attempting to authenticate in the Directories Management service must have a valid UPN that

corresponds to the UPN in the certificate.

Configuring vRealize Automation

VMware, Inc. 131

You can configure the to use an email address to validate the user account if the UPN does not exist in

the certificate.

You can also enable an alternate UPN type to be used.

Certiﬁcate Authority Required for Authentication

To enable logging in using certificate authentication, root certificates and intermediate certificates must be

uploaded to the .

The certificates are copied to the local certificate store on the user's computer. The certificates in the local

certificate store are available to all the browsers running on this user's computer, with some exceptions,

and therefore, are available to a Directories Management instance in the browser.

For smart-card authentication, when a user initiates a connection to a the Directories Management

instance, the Directories Management service sends a list of trusted certificate authorities (CA) to the

browser. The browser checks the list of trusted CAs against the available user certificates, selects a

suitable certificate, and then prompts the user to enter a smart card PIN. If multiple valid user certificates

are available, the browser prompts the user to select a certificate.

If a user cannot authenticate, the root CA and intermediate CA might not be set up correctly, or the

service has not been restarted after the root and intermediate CAs were uploaded to the server. In these

cases, the browser cannot show the installed certificates, the user cannot select the correct certificate,

and certificate authentication fails.

Using Certiﬁcate Revocation Checking

You can configure certificate revocation checking to prevent users who have their user certificates

revoked from authenticating. Certificates are often revoked when a user leaves an organization, loses a

smart card, or moves from one department to another.

Certificate revocation checking with certificate revocation lists (CRLs) and with the Online Certificate

Status Protocol (OCSP) is supported. A CRL is a list of revoked certificates published by the CA that

issued the certificates. OCSP is a certificate validation protocol that is used to get the revocation status of

a certificate.

You can configure certificate revocation checking in the administration console Connectors > Auth

Adapters > CertificateAuthAdapter page when you configure certificate authentication.

You can configure both CRL and OCSP in the same certificate authentication adapter configuration.

When you configure both types of certificate revocation checking and the Use CRL in case of OCSP

failure checkbox is enabled, OCSP is checked first and if OCSP fails, revocation checking falls back to

CRL. Revocation checking does not fall back to OCSP if CRL fails.

Logging in with CRL Checking

When you enable certificate revocation, the server reads a CRL to determine the revocation status of a

user certificate.

If a certificate is revoked, authentication through the certificate fails.

Configuring vRealize Automation

VMware, Inc. 132

Logging in with OCSP Certiﬁcate Checking

When you configure Certificate Status Protocol (OCSP) revocation checking, sends a request to an

OCSP responder to determine the revocation status of a specific user certificate. The server uses the

OCSP signing certificate to verify that the responses it receives from the OCSP responder are genuine.

If the certificate is revoked, authentication fails.

You can configure authentication to fall back to CRL checking if it does not receive a response from the

OSCP responder or if the response is invalid.

Conﬁgure Certiﬁcate Authentication for Directories Management

You enable and configure certificate authentication from the vRealize Automation administration console

Directories Management feature.

Prerequisites

nObtain the Root certificate and intermediate certificates from the CA that signed the certificates

presented by your users.

n(Optional) List of Object Identifier (OID)s of valid certificate policies for certificate authentication.

nFor revocation checking, the file location of the CRL, the URL of the OCSP server.

n(Optional) OCSP Response Signing certificate file location.

nConsent form content, if enabling a consent form to display before authentication.

Procedure

1As a tenant administrator, navigate to Administration > Directories Management > Connectors

2On the Connectors page, select the Worker link for the connector that is being configured.

3Click Auth Adapters and then click CertificateAuthAdapter.

You are redirected to the identity manager sign in page.

4In the CertificateAuthAdapter row, click Edit.

5Configure the Certificate Authentication Adapter page.

Note An asterisk indicates a required field. All other fields are optional.

Option Description

*Name A name is required. The default name is CertificateAuthAdapter. You can change

this name.

Enable certificate adapter Select the check box to enable certificate authentication.

*Root and intermediate CA certificates Select the certificate files to upload. You can select multiple root CA and

intermediate CA certificates that are encoded as DER or PEM.

Configuring vRealize Automation

VMware, Inc. 133

Option Description

Uploaded CA certificates The uploaded certificate files are listed in the Uploaded Ca Certificates section of

the form.

You must restart the service before the new certificates are made available.

Click Restart Web Service to restart the service and add the certificates to the

trusted service.

Note Restarting the service does not enable certificate authentication. After the

service is restarted, continue configuring this page. Clicking Save at the end of

the page enables certificate authentication on the service.

Use email if no UPN in certificate If the user principal name (UPN) does not exist in the certificate, select this

checkbox to use the emailAddress attribute as the Subject Alternative Name

extension to validate user accounts.

Certificate policies accepted Create a list of object identifiers that are accepted in the certificate policies

extensions.

Enter the object ID numbers (OID) for the Certificate Issuing Policy. Click Add

another value to add additional OIDs.

Enable cert revocation Select the check box to enable certificate revocation checking. This prevents

users who have revoked user certificates from authenticating.

Use CRL from certificates Select the check box to use the certificate revocation list (CRL) published by the

CA that issued the certificates to validate a certificate's status, revoked or not

revoked.

CRL Location Enter the server file path or the local file path from which to retrieve the CRL.

Enable OCSP Revocation Select the check box to use the Online Certificate Status Protocol (OCSP)

certificate validation protocol to get the revocation status of a certificate.

Use CRL in case of OCSP failure If you configure both CRL and OCSP, you can check this box to fall back to using

CRL if OCSP checking is not available.

Send OCSP Nonce Select this check box if you want the unique identifier of the OCSP request to be

sent in the response.

OCSP URL If you enabled OCSP revocation, enter the OCSP server address for revocation

checking.

OCSP responder's signing certificate Enter the path to the OCSP certificate for the responder, /path/to/file.cer.

Enable consent form before

authentication

Select this check box to include a consent form page to appear before users log

in to their My Apps portal using certificate authentication.

Consent form content Type the text that displays in the consent form in this text box.

6Click Save.

What to do next

nAdd the certificate authentication method to the default access policy.Navigate to Administration >

Directories Management > Policies and click Edit Default Policy to edit the default policy rules and

add Certificate and make it the first authentication method for the default policy. Certificate must be

first authentication method listed in the policy rule, otherwise certificate authentication fails.

Configuring vRealize Automation

VMware, Inc. 134

nWhen Certificate Authentication is configured, and the service appliance is set up behind a load

balancer, make sure that the Directories Management connector is configured with SSL pass-through

at the load balancer and not configured to terminate SSL at the load balancer. This configuration

ensures that the SSL handshake is between the connector and the client in order to pass the

certificate to the connector.

Conﬁguring a Third-Party Identity Provider Instance to Authenticate Users

You can configure a third-party identity provider to be used to authenticate users in the

Directories Management service.

Complete the following tasks prior to using the administration console to add the third-party identity

provider instance.

nVerify that the third-party instances are SAML 2.0 compliant and that the service can reach the third-

party instance.

nObtain the appropriate third-party metadata information to add when you configure the identity

provider in the administration console. The metadata information you obtain from the third-party

instance is either the URL to the metadata or the actual metadata.

Conﬁgure a Third Party Identity Provider Connection

vRealize Automation is supplied with a default identity provider connection instance. Users may want to

create additional identity provider connections to support just-in-time user provisioning or other custom

configurations.

vRealize Automation is supplied with an default identity provider. In most cases, the default provider is

sufficient for customer needs. If you use an existing enterprise identity management solution, you can set

up a custom identity provider to redirect users to your existing identity solution.

When using a custom identity provider, Directories Management uses SAML metadata from that provider

to establish a trust relationship with the provider. After this relationship is established, Directories

Management maps the users from the SAML assertion to the list of internal vRealize Automation users

based the subject name ID.

Prerequisites

nConfigure the network ranges that you want to direct to this identity provider instance for

authentication. See Add or Edit a Network Range.

nAccess to the third-party metadata document. This can be either the URL to the metadata or the

actual metadata.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Select Administration > Directories Management > Identity Providers.

This page displays all configured Identity Providers.

Configuring vRealize Automation

VMware, Inc. 135

2Click Add Identity Provider.

A menu appears with Identity Provider options.

3Select Create Third Party IDP.

4Enter the appropriate information to configure the identity provider.

Option Description

Identity Provider Name Enter a name for this identity provider instance.

SAML Metadata Add the third party IdPs XML-based metadata document to establish trust with the identity

provider.

1 Enter the SAML metadata URL or the xml content into the text box.

2 Click Process IdP Metadata. The NameID formats supported by the IdP are extracted from

the metadata and added to the Name ID Format table.

3 In the Name ID value column, select the user attribute in the service to map to the ID formats

displayed. You can add custom third-party name ID formats and map them to the user

attribute values in the service.

4 (Optional) Select the NameIDPolicy response identifier string format.

Users Select the Directories Management directories of the users that can authenticate using this

identity provider.

Just-in-Time User

Provisioning

Select the appropriate options to support just-in-time provisioning using an appropriate third party

identity provider.

Enter the Directory Name to use for just-in-time provisioning.

Enter one or more Domains that exist within the external identity provider that you will use for

just-in-time provisioning.

Network The existing network ranges configured in the service are listed.

Select the network ranges for the users, based on their IP addresses, that you want to direct to

this identity provider instance for authentication.

Authentication Methods Add the authentication methods supported by the third-party identity provider. Select the SAML

authentication context class that supports the authentication method.

SAML Signing Certificate Click Service Provider (SP) Metadata to see URL to Directories Management SAML service

provider metadata URL . Copy and save the URL. This URL is configured when you edit the

SAML assertion in the third-party identity provider to map Directories Management users.

Hostname If the Hostname field displays, enter the hostname where the identity provider is redirected to for

authentication. If you are using a non-standard port other than 443, you can set this as

Hostname:Port. For example, myco.example.com:8443.

5Click Add.

What to do next

nCopy and save the Directories Management service provider metadata that is required to configure

the third-party identity provider instance. This metadata is available either in the SAML Signing

Certificate section of the Identity Provider page.

nAdd the authentication method of the identity provider to the services default policy.

See the Setting Up Resources in Directories Management guide for information about adding and

customizing resources that you add to the catalog.

Configuring vRealize Automation

VMware, Inc. 136

Managing Authentication Methods to Apply to Users

The Directories Management service attempts to authenticate users based on the authentication

methods, the default access policy, network ranges, and the identity provider instances you configure.

When users attempt to log in, the service evaluates the default access policy rules to select which rule in

the policy to apply. The authentication methods are applied in the order they are listed in the rule. The first

identity provider instance that meets the authentication method and network range requirements of the

rule is selected and the user authentication request is forwarded to the identity provider instance for

authentication. If authentication fails, the next authentication method configured in the rule is applied.

You can add rules that specify the authentication methods to be used by device type or by device type

and from a specific network range. For example, you could configure a rule requiring users that sign in

using iOS devices from a specific network to authenticate using RSA SecurID and another rule that

specifies all device types signing in from the internal network IP address to authenticate using their

password.

Add or Edit a Network Range

You can manage the network ranges to define the IP addresses from which users can log in via an Active

Directory link. You add the network ranges you create to specific identity provider instances and to access

policy rules.

Define network ranges for your Directories Management deployment based on your network topology.

One network range, called ALL RANGES, is created as the default. This network range includes every IP

address available on the Internet, 0.0.0.0 to 255.255.255.255. Even if your deployment has a single

identity provider instance, you can change the IP address range and add other ranges to exclude or

include specific IP addresses to the default network range. You can create other network ranges with

specific IP addresses that you can apply for specific purpose.

Note The default network range, ALL RANGES, and its description, "a network for all ranges," are

editable. You can edit the name and description, including changing the text to a different language, by

clicking the network range name on the Network Ranges page.

Prerequisites

nYou have configured tenants for your vRealize Automation deployment set up an appropriate Active

Directory link to support basic Active Directory user ID and password authentication.

nActive Directory is installed and configured for use on your network.

nLog in to vRealize Automation as a tenant administrator.

Procedure

1Select Administration > Directories Management > Network Ranges.

Configuring vRealize Automation

VMware, Inc. 137

2Edit an existing network range or add a new network range.

Option Description

Edit an existing range Click the network range name to edit.

Add a range Click Add Network Range to add a new range.

3Complete the form.

Form Item Description

Name Enter a name for the network range.

Description Enter a description for the Network Range.

IP Ranges Edit or add IP ranges until all desired and no undesired IP addresses are included.

What to do next

nAssociate each network range with an identity provider instance.

nAssociate network ranges with access policy rule as appropriate. See Configuring Access Policy

Settings.

Select Attributes to Sync with Directory

When you set up the Directories Management directory to sync with Active Directory, you specify the user

attributes that sync to the directory. Before you set up the directory, you can specify on the User Attributes

page which default attributes are required and, if you want, add additional attributes that you want to map

to Active Directory attributes.

When you configure the User Attributes page before the directory is created, you can change default

attributes from required to not required, mark attributes as required, and add custom attributes.

For a list of the default mapped attributes, see Managing User Attributes that Sync from Active Directory.

After the directory is created, you can change a required attribute to not be required, and you can delete

custom attributes. You cannot change an attribute to be a required attribute.

When you add other attributes to sync to the directory, after the directory is created, go to the directory's

Mapped Attributes page to map these attributes to Active Directory Attributes.

Procedure

1Log in to vRealize Automation as a system or tenant administrator.

2Click the Administration tab.

3Select Directories Management > User Attributes

4In the Default Attributes section, review the required attribute list and make appropriate changes to

reflect what attributes should be required.

5In the Attributes section, add the Directories Management directory attribute name to the list.

Configuring vRealize Automation

VMware, Inc. 138

6Click Save.

The default attribute status is updated and attributes you added are added on the directory's Mapped

Attributes list.

7After the directory is created, go to the Identity Stores page and select the directory.

8Click Sync Settings > Mapped Attributes.

9In the drop-down menu for the attributes that you added, select the Active Directory attribute to map

to.

10 Click Save.

The directory is updated the next time the directory syncs to the Active Directory.

Applying the Default Access Policy

The Directories Management service includes a default access policy that controls user access to their

apps portals. You can edit the policy to change the policy rules as necessary.

When you enable authentication methods other than password authentication, you must edit the default

policy to add the enabled authentication method to the policy rules.

Each rule in the default access policy requires that a set of criteria be met in order to allow user access to

the apps portal. You apply a network range, select which type of user can access content and select the

authentication methods to use. See Managing Access Policies.

The number of attempts the service makes to login a user using a given authentication method varies.

The services only makes one attempt at authentication for Kerberos or certificate authentication. If the

attempt is not successful in logging in a user, the next authentication method in the rule is attempted. The

maximum number of failed login attempts for Active Directory password and RSA SecurID authentication

is set to five by default. When a user has five failed login attempts, the service attempts to log in the user

with the next authentication method on the list. When all authentication methods are exhausted, the

service issues an error message.

Apply Authentication Methods to Policy Rules

Only the password authentication method is configured in the default policy rules. You must edit the policy

rules to select the other authentication methods you configured and set the order in which the

authentication methods are used for authentication.

Prerequisites

Enable and configure the authentication methods that your organization supports. See Integrating

Alternative User Authentication Products with Directories Management

Procedure

1Select Administration > Directories Management > Policies

2Click the default access policy to edit.

Configuring vRealize Automation

VMware, Inc. 139

3To edit a policy rule, click the authentication method to edit in the Policy Rules, Authentication Method

column.

The add a new policy rule, click the + icon.

4Click Save and click Save again on the Policy page.

5Click Save and click Save again on the Policy page.

Conﬁguring Kerberos for Directories Management

Kerberos authentication provides users who are successfully signed in to their Active Directory domain to

access their apps portal without additional credential prompts. You enable Windows authentication to

allow the Kerberos protocol to secure interactions between users' browsers and the

Directories Management service. You do not need to directly configure Active Directory to make Kerberos

function with your deployment.

Currently, interactions between a user's browser and the service are authenticated by Kerberos on the

Windows operating systems only. Accessing the service from other operating systems does not take

advantage of Kerberos authentication.

nConfigure Kerberos Authentication

To configure the Directories Management service to provide Kerberos authentication, you must join

to the domain and enable Kerberos authentication on the connector.

nConfigure Internet Explorer to Access the Web Interface

You must configure the Internet Explorer browser if Kerberos is configured for your deployment and

if you want to grant users access to the Web interface using Internet Explorer.

nConfigure Firefox to Access the Web Interface

You must configure the Firefox browser if Kerberos is configured for your deployment and you want

to grant users access to the Web interface using Firefox.

nConfigure the Chrome Browser to Access the Web Interface

You must configure the Chrome browser if Kerberos is configured for your deployment and if you

want to grant users access to the Web interface using the Chrome browser.

Configuring vRealize Automation

VMware, Inc. 140

Conﬁgure Kerberos Authentication

To configure the Directories Management service to provide Kerberos authentication, you must join to the

domain and enable Kerberos authentication on the connector.

Procedure

1As a tenant administrator, navigate to Administration > Directories Management > Connectors

2On the Connectors page, for the connector that is being configured for Kerberos authentication, click

Join Domain.

3On the Join Domain page, enter the information for the Active Directory domain.

Option Description

Domain Enter the fully qualified domain name of the Active Directory. The domain name you enter must be the same

Windows domain as the connector server.

Domain User Enter the user name of an account in the Active Directory that has permissions to join systems to that Active

Directory domain.

Domain

Password

Enter the password associated with the AD Username. This password is not stored by

Directories Management

Click Save.

The Join Domain page is refreshed and displays a message that you are currently joined to the

domain.

4In the Worker column for the connector click Auth Adapters.

5Click KerberosIdpAdapter

You are redirected to the identity manager sign in page.

6Click Edit in the KerberosldpAdapter row and configure the Kerberos authentication page.

Option Description

Name A name is required. The default name is KerberosIdpAdapter. You can change this.

Directory UID

Attribute

Enter the account attribute that contains the user name.

Enable

Windows

Authentication

Select this to extend authentication interactions between users' browsers and Directories Management.

Enable NTLM Select this to enable NT LAN Manager (NTLM) protocol-based authentication only if your Active Directory

infrastructure relies on NTLM authentication.

Enable

Redirect

Select this if round-robin DNS and load balancers do not have Kerberos support. Authentication requests

are redirected to Redirect Host Name. If this is selected, enter the redirect host name in Redirect Host

Name text box. This is usually the hostname of the service.

7Click Save.

Configuring vRealize Automation

VMware, Inc. 141

What to do next

Add the authentication method to the default access policy. Navigate to Administration > Directories

Management > Policies and click Edit Default Policy to edit the default policy rules to add the Kerberos

authentication method to the rule in the correct authentication order.

Conﬁgure Internet Explorer to Access the Web Interface

You must configure the Internet Explorer browser if Kerberos is configured for your deployment and if you

want to grant users access to the Web interface using Internet Explorer.

Kerberos authentication works in conjunction with Directories Management on Windows operating

systems.

Note Do not implement these Kerberos-related steps on other operating systems.

Prerequisites

Configure the Internet Explorer browser for each user or provide users with the instructions after you

configure Kerberos.

Procedure

1Verify that you are logged into Windows as a user in the domain.

2In Internet Explorer, enable automatic log in.

a Select Tools > Internet Options > Security.

b Click Custom level.

c Select Automatic login only in Intranet zone.

d Click OK.

3Verify that this instance of the connector virtual appliance is part of the local intranet zone.

a Use Internet Explorer to access the sign in URL at https://myconnectorhost.domain/authenticate/.

b Locate the zone in the bottom right corner on the status bar of the browser window.

If the zone is Local intranet, Internet Explorer configuration is complete.

4If the zone is not Local intranet, add the sign in URL to the intranet zone.

a Select Tools > Internet Options > Security > Local intranet > Sites.

b Select Automatically detect intranet network.

If this option was not selected, selecting it might be sufficient for adding the to the intranet zone.

c (Optional) If you selected Automatically detect intranet network, click OK until all dialog boxes

are closed.

d In the Local Intranet dialog box, click Advanced.

A second dialog box named Local intranet appears.

Configuring vRealize Automation

VMware, Inc. 142

e Enter the URL in the Add this Web site to the zone text box.

https://myconnectorhost.domain/authenticate/

f Click Add > Close > OK.

5Verify that Internet Explorer is allowed to pass the Windows authentication to the trusted site.

a In the Internet Options dialog box, click the Advanced tab.

b Select Enable Integrated Windows Authentication.

This option takes effect only after you restart Internet Explorer.

c Click OK.

6Log in to the Web interface to check access.

If Kerberos authentication is successful, the test URL goes to the Web interface.

The Kerberos protocol secures all interactions between this Internet Explorer browser instance and

Directories Management. Now, users can use single sign-on to access their My Apps portal.

Conﬁgure Firefox to Access the W