VCF 9 Home Lab | Embedded vIDM (viDB) — AD Integration, Users, Groups & NSX SSO

📅 May 2026 | 🏷️ VCF 9 Home Lab Series | ✍️ Farrukh Hanif | LinkedIn

VCF 9 Home Lab | Embedded vIDM (viDB) — AD Integration, Users, Groups & NSX SSO

In this post I walk through the full configuration of embedded VMware Identity Manager (viDB) in VMware Cloud Foundation 9, integrating Active Directory over LDAP, creating VCF-specific users and groups via PowerShell, assigning roles across SDDC Manager and NSX, and troubleshooting the NSX SSO registration — including a real-world API authentication issue specific to VCF 9's microservices architecture.

Lab Environment

Component	Detail
Platform	VMware Cloud Foundation 9
SDDC Manager	edi-vcf01.edi.vcflab.local (10.11.10.14)
vCenter	edi-m01-vc01.edi.vcflab.local
Domain Controller	Windows Server 2022 — vcflab.local (10.11.10.4)
AD Domain	vcflab.local
Switching	Arista DCS-7050TX-64-R (ASN 65000)

Overview — What is Embedded vIDM (viDB)?

In VCF 9, VMware Identity Manager is embedded directly into the SDDC Manager appliance as a lightweight identity broker — referred to as viDB (vIDM Database). Unlike the full standalone Workspace ONE Access deployment, viDB is purpose-built for VCF's internal SSO and role-based access control needs.

Once configured, viDB acts as the identity federation layer across SDDC Manager, NSX Manager, and vCenter — meaning a single Active Directory login grants appropriately scoped access to all three components based on group membership.

The configuration is done via Operations Fleet Management in the SDDC Manager UI, not the old standalone vIDM interface.

Step 1 — Configure vCenter Identity Source (AD over LDAP)

Before configuring viDB, vCenter needs to know about the Active Directory domain so that SSO can resolve AD users and groups.

Navigate to: vCenter → Administration → Single Sign On → Configuration → Identity Sources → Add

Select Active Directory over LDAP and fill in the following:

Field	Value
Identity Source Type	Active Directory over LDAP
Identity source name	vcflab.local
Base DN for users	CN=Users,DC=vcflab,DC=local
Base DN for groups	CN=Users,DC=vcflab,DC=local
Domain name	vcflab.local
Domain alias	vcflab
Username	administrator@vcflab.local
Primary server URL	ldap://10.11.10.4:389
Secondary server URL	(leave blank)

Note: Use plain ldap:// on port 389 for lab use. For LDAPS (port 636) you would need to upload the ADCS CA certificate in the Certificates field. Keep it simple for the initial deployment.

Click Add. No errors should be returned if the DC is reachable on VLAN 1110 and port 389 is not blocked.

Step 2 — Create AD Users and Groups via PowerShell

Before configuring viDB, the required OUs, groups, and service accounts need to exist in Active Directory. Run the following on your Windows Server 2022 domain controller:

# Create OUs
New-ADOrganizationalUnit -Name "VCF-Users"  -Path "DC=vcflab,DC=local"
New-ADOrganizationalUnit -Name "VCF-Groups" -Path "DC=vcflab,DC=local"

# Create AD Groups
New-ADGroup -Name "vcf-admins"     -GroupScope Global -Path "OU=VCF-Groups,DC=vcflab,DC=local" -Description "VCF SDDC Manager Admins"
New-ADGroup -Name "vcf-operators"  -GroupScope Global -Path "OU=VCF-Groups,DC=vcflab,DC=local" -Description "VCF SDDC Manager Operators"
New-ADGroup -Name "vcf-viewers"    -GroupScope Global -Path "OU=VCF-Groups,DC=vcflab,DC=local" -Description "VCF SDDC Manager Viewers"
New-ADGroup -Name "vcf-nsx-admins" -GroupScope Global -Path "OU=VCF-Groups,DC=vcflab,DC=local" -Description "NSX Admin Group"

# Set password
$password = ConvertTo-SecureString "VMware1!" -AsPlainText -Force

# Create Users
New-ADUser -Name "vcf-admin"       -SamAccountName "vcf-admin"       -UserPrincipalName "vcf-admin@vcflab.local"       -Path "OU=VCF-Users,DC=vcflab,DC=local" -AccountPassword $password -Enabled $true
New-ADUser -Name "vcf-operator"    -SamAccountName "vcf-operator"    -UserPrincipalName "vcf-operator@vcflab.local"    -Path "OU=VCF-Users,DC=vcflab,DC=local" -AccountPassword $password -Enabled $true
New-ADUser -Name "vcf-viewer"      -SamAccountName "vcf-viewer"      -UserPrincipalName "vcf-viewer@vcflab.local"      -Path "OU=VCF-Users,DC=vcflab,DC=local" -AccountPassword $password -Enabled $true
New-ADUser -Name "vcf-svc-nsxmgr"  -SamAccountName "vcf-svc-nsxmgr"  -UserPrincipalName "vcf-svc-nsxmgr@vcflab.local"  -Path "OU=VCF-Users,DC=vcflab,DC=local" -AccountPassword $password -Enabled $true
New-ADUser -Name "vcf-svc-sddc"    -SamAccountName "vcf-svc-sddc"    -UserPrincipalName "vcf-svc-sddc@vcflab.local"    -Path "OU=VCF-Users,DC=vcflab,DC=local" -AccountPassword $password -Enabled $true

# Assign group memberships
Add-ADGroupMember -Identity "vcf-admins"     -Members "Administrator","vcf-admin","vcf-svc-sddc"
Add-ADGroupMember -Identity "vcf-operators"  -Members "vcf-operator","vcf-svc-nsxmgr"
Add-ADGroupMember -Identity "vcf-viewers"    -Members "vcf-viewer"
Add-ADGroupMember -Identity "vcf-nsx-admins" -Members "vcf-admin","vcf-svc-nsxmgr"

User	Group	Purpose
vcf-admin	vcf-admins, vcf-nsx-admins	SDDC + NSX admin
vcf-operator	vcf-operators	SDDC operator
vcf-viewer	vcf-viewers	Read-only access
vcf-svc-nsxmgr	vcf-operators, vcf-nsx-admins	NSX service account
vcf-svc-sddc	vcf-admins	SDDC service account
administrator	vcf-admins	Domain admin + VCF admin

Step 3 — Configure Embedded vIDM Directory (viDB)

Navigate to: SDDC Manager → Operations Fleet Management → Identity and Access Management → Embedded vIDM

Directory Configuration

Field	Value
Directory display name	vcflab.local
DNS Server Location	Disabled
Global Catalog	Unchecked
Primary domain controller	10.11.10.4
Secondary domain controller	(leave blank)
Directory search attribute	sAMAccountName
Base DN	DC=vcflab,DC=local
Bind user name	CN=vcf-svc-sddc,OU=VCF-Users,DC=vcflab,DC=local
Bind user password	VMware1!

Important: The bind username must be in full Distinguished Name (DN) format. UPN format (vcf-svc-sddc@vcflab.local) will fail silently. Use the full CN=... DN as shown above.

Click Test Connection before saving. A successful test confirms the bind account can reach port 389 on the DC.

Attribute Mapping

vIDM Attribute	AD Attribute
Username	sAMAccountName
First name	givenName
Last name	sn
Email	mail
Distinguished name	distinguishedName

Group and User Provisioning

The embedded viDB only allows a single group and user search base per directory — unlike the full Workspace ONE Access deployment. The solution is to point both at the parent OU so all groups and users are captured in one sync:

Field	Value
Group DN	OU=VCF-Groups,DC=vcflab,DC=local
User DN	OU=VCF-Users,DC=vcflab,DC=local
Sync nested group members	Enabled

After saving, trigger a manual sync. You should see 4 groups and 6 users imported successfully.

Step 4 — Assign Roles in SDDC Manager

Navigate to: SDDC Manager → Administration → Users and Groups

AD Group	SDDC Manager Role
vcf-admins	ADMIN
vcf-operators	OPERATOR
vcf-viewers	VIEWER

Step 5 — Assign Roles in NSX Manager

Navigate to: NSX Manager → System → User Management → Role Assignments → Add

AD Group	NSX Role
vcf-nsx-admins	Enterprise Admin
vcf-operators	Network Engineer

Step 6 — NSX SSO Registration (API Method)

After completing viDB configuration, NSX Manager reported "VCF SSO not set". The SDDC Manager GUI option to register NSX with vIDM was not present in this VCF 9 build, so the API method was required.

Troubleshooting: Finding the Correct API Credentials

VCF 9 has moved to a fully microservices-based architecture. The SDDC Manager API is fronted by nginx which routes to internal services on ports 7100–7900. The token endpoint is /v1/tokens routed to port 7100 (commonsvcs).

Error encountered: All token requests returned IDENTITY_UNAUTHORIZED_ENTITY when using admin, vcf, and administrator@vsphere.local — because VCF 9 uses admin@local as the local domain format, not admin or vsphere.local.

The correct local admin account format in VCF 9 is admin@local — set during the VCF bringup wizard.

Get API Token

TOKEN=$(curl -sk -X POST \
  https://localhost/v1/tokens \
  -H 'Content-Type: application/json' \
  -d '{"username":"admin@local","password":"<your-sddc-admin-password>"}' \
  | python3 -c "import sys,json; print(json.load(sys.stdin)['accessToken'])")
echo $TOKEN

Success: Once admin@local was used with the correct bringup password, the API returned a full JWT access token with ADMIN scope — confirming the authentication method for all subsequent VCF 9 API calls.

Get vIDM Configuration

curl -sk -X GET \
  https://localhost/v1/vidu/configuration \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -m json.tool

Get NSX Manager Details

curl -sk -X GET \
  https://localhost/v1/nsx-managers \
  -H "Authorization: Bearer $TOKEN" \
  | python3 -m json.tool

Get SDDC Manager Certificate Thumbprint

echo | openssl s_client -connect edi-vcf01.edi.vcflab.local:443 2>/dev/null \
  | openssl x509 -noout -fingerprint -sha256 \
  | sed 's/://g' \
  | awk -F= '{print $2}'

Register vIDM on NSX Manager

NSX_IP="<your-nsx-manager-ip>"

curl -sk -X PUT \
  https://$NSX_IP/api/v1/node/aaa/providers/vidm \
  -u "admin:<nsx-admin-password>" \
  -H "Content-Type: application/json" \
  -d '{
    "vidm_enable": true,
    "host": "edi-vcf01.edi.vcflab.local",
    "thumbprint": "<THUMBPRINT>",
    "client_id": "<CLIENT_ID>",
    "client_secret": "<CLIENT_SECRET>",
    "node_host_name": "<nsx-manager-fqdn>"
  }' \
  | python3 -m json.tool

Key Learnings & Gotchas

VCF 9 local admin format is admin@local — not admin, not admin@vsphere.local. This is new in VCF 9 and caught me out across multiple token attempts.
Bind DN must be full Distinguished Name — viDB rejects UPN format for the bind user. Always use CN=user,OU=...,DC=...,DC=local.
Embedded viDB only supports one group/user OU — unlike standalone Workspace ONE Access. Point it at the parent OU to capture all child objects.
ADFS is not required for VCF lab identity — AD over LDAP covers all VCF identity needs for a lab or PoC. ADFS/OIDC is only needed for production federated identity scenarios.
VCF 9 is fully microservices-based — there is no monolithic sddc-manager.service. Services run as individual systemd units (commonsvcs, domainmanager, lcm, operationsmanager) fronted by nginx on port 443.
NSX SSO registration has no GUI button in this build — the API path via /api/v1/node/aaa/providers/vidm is the supported workaround.

What's Next

With identity configured end-to-end, the next steps in the VCF 9 home lab build are:

NSX T0 Gateway deployment and BGP peering with the Arista DCS-7050TX (currently in Idle(NoIf) state)
NSX T1 Gateway and segment configuration
Workload domain expansion
Automation via Terraform VMware provider against the VCF API

Virtualization and Cloud