WEBVTT 00:00:00.000 --> 00:00:08.000 Welcome back to vSphere 8 in the real world, and now we're going to discuss single sign-on. 00:00:08.000 --> 00:00:14.000 So, single sign-on is used to authenticate users into your vSphere environment, 00:00:14.000 --> 00:00:20.000 but not using local accounts that are in your vSphere, you know, single sign-on environment 00:00:20.000 --> 00:00:22.000 that was created when you installed vCenter. 00:00:22.000 --> 00:00:30.000 It's going to allow you to use your single sign-on services to configure a third provider. 00:00:30.000 --> 00:00:35.000 In addition to the vSphere single sign-on service that's installed with vCenter, another provider. 00:00:35.000 --> 00:00:41.000 For example, the most common one that's very often used would be Active Directory Directory Services. 00:00:41.000 --> 00:00:47.000 So, we can actually have our vCenter server join our Active Directory Directory Services, 00:00:47.000 --> 00:00:53.000 become a member of that, and then start using user accounts for that vCenter server. 00:00:53.000 --> 00:00:56.000 So, we can use our local single sign-on. 00:00:56.000 --> 00:01:01.000 We can create users in our single sign-on, our vCenter single sign-on environment. 00:01:01.000 --> 00:01:02.000 We can create groups. 00:01:02.000 --> 00:01:04.000 We can assign roles to it. 00:01:04.000 --> 00:01:09.000 We can give it access to different, you know, resources or systems. 00:01:09.000 --> 00:01:11.000 We can say, I create a user. 00:01:11.000 --> 00:01:12.000 User gets a role. 00:01:12.000 --> 00:01:15.000 The role has certain privileges associated with it, 00:01:15.000 --> 00:01:22.000 and then I can assign that role and say it, you know, has this level of access to a cluster 00:01:22.000 --> 00:01:24.000 or to a host or to a single VM. 00:01:24.000 --> 00:01:29.000 And whatever that role has privileges to do, it can do on that cluster or that host 00:01:29.000 --> 00:01:33.000 or that VM or a resource pool or whatever you're assigned it to. 00:01:33.000 --> 00:01:37.000 We can do the same thing and create users in Active Directory. 00:01:37.000 --> 00:01:41.000 And in Active Directory, we can create groups, and we can put the user into a group. 00:01:41.000 --> 00:01:46.000 And then we can use our vCenter environment and take those users 00:01:46.000 --> 00:01:48.000 and groups that we created in Active Directory 00:01:48.000 --> 00:01:52.000 and assign them to roles in my vCenter single sign-on. 00:01:52.000 --> 00:01:56.000 So, then I can say, okay, the roles that we have here, manage VMs, 00:01:56.000 --> 00:02:01.000 and my Active Directory admins, you know, VM admins group, 00:02:01.000 --> 00:02:07.000 by creating Active Directory will be a member of the manage VMs role in my vCenter server. 00:02:07.000 --> 00:02:13.000 So, it allows me to use the same name and password that I use to log into my workstation 00:02:13.000 --> 00:02:15.000 when I need to do administrative tasks and things like that. 00:02:15.000 --> 00:02:17.000 Hopefully not the exact same name and password. 00:02:17.000 --> 00:02:19.000 Hopefully we have a separate one for administration. 00:02:19.000 --> 00:02:23.000 But it allows me to use that domain account that I use for administering my domain 00:02:23.000 --> 00:02:28.000 or for administering my servers and things like that to also manage my vCenter server. 00:02:28.000 --> 00:02:31.000 So, I don't have to worry about remembering two different usernames and two passwords 00:02:31.000 --> 00:02:34.000 and changing passwords here and changing them there. 00:02:34.000 --> 00:02:36.000 I just do it all in one place. 00:02:36.000 --> 00:02:39.000 It's really convenient. 00:02:39.000 --> 00:02:45.000 So, if we're using our vCenter single sign-on, then, you know, we're using the VMCA 00:02:45.000 --> 00:02:48.000 and using certificates that are provided to us through our VMCA. 00:02:48.000 --> 00:02:54.000 If we are using our single sign-on services and connecting to, like, Active Directory accounts, 00:02:54.000 --> 00:02:56.000 then we're using SAML tokens. 00:02:56.000 --> 00:03:03.000 And SAML is really just a language, a way of formatting tokens that is accepted by a lot of different, 00:03:03.000 --> 00:03:08.000 you know, organizations or a bunch of different companies that make different types of products, right? 00:03:08.000 --> 00:03:10.000 VMware, for example, is one. 00:03:10.000 --> 00:03:17.000 And you might, you know, have noticed that when you log into your Office 365 account 00:03:17.000 --> 00:03:19.000 and you can access certain things with your company. 00:03:19.000 --> 00:03:25.000 And then you go to another company's website, and you can use that same credential just to log in there. 00:03:25.000 --> 00:03:27.000 And sometimes you don't even have to log in. 00:03:27.000 --> 00:03:31.000 It will say, oh, this is your username, and your SAML token goes over. 00:03:31.000 --> 00:03:35.000 It says, oh, you're already authenticated, and it lets you into that website, into this website. 00:03:35.000 --> 00:03:39.000 So, SAML is a way of creating tokens that are trusted by different organizations 00:03:39.000 --> 00:03:45.000 because they trust your single sign-on environment or your directory service, okay? 00:03:45.000 --> 00:03:52.000 So, it administers things like, you know, user identity, what the identity store is going to trust or not trust, okay, 00:03:52.000 --> 00:03:57.000 and then the single sign-on domain, for example, your Active Directory domain. 00:03:57.000 --> 00:04:00.000 So, how do we add a single sign-on service? 00:04:00.000 --> 00:04:03.000 Okay, so this is to create a user for our single sign-on. 00:04:03.000 --> 00:04:05.000 We're going to log into our vCenter environment. 00:04:05.000 --> 00:04:09.000 And once we're in our environment, we can go to Home Administration. 00:04:09.000 --> 00:04:13.000 We're going to find our single sign-on tab, the tab that's over on the left, right? 00:04:13.000 --> 00:04:18.000 We're going to select Users and Groups, choose the Users tab, set the domain. 00:04:18.000 --> 00:04:21.000 So, by default, when you first go in there, if you haven't done anything else, 00:04:21.000 --> 00:04:27.000 if you haven't added Active Directory, you'll see that default vCenter single sign-on domain. 00:04:27.000 --> 00:04:31.000 And so, normally, it's vSphere.local, right? 00:04:31.000 --> 00:04:32.000 That's the one that creates by default. 00:04:32.000 --> 00:04:34.000 You can change that name. 00:04:34.000 --> 00:04:38.000 In our lab environment, ours is stormlab.local, so vSphere.local. 00:04:38.000 --> 00:04:46.000 But almost everyone, by default, is using the vSphere.local for the vCenter single sign-on domain. 00:04:46.000 --> 00:04:49.000 And so, you're going to choose the domain, and then you can go through. 00:04:49.000 --> 00:04:50.000 So, you want to create a new user. 00:04:50.000 --> 00:04:51.000 You can see your users that are in there. 00:04:51.000 --> 00:04:56.000 If you say Add, you can go in there and create the user and then click, you know, done, you're finished with that. 00:04:56.000 --> 00:05:03.000 So, we'll walk through a demo here shortly, and I'll show you how to do that. 00:05:03.000 --> 00:05:05.000 So, adding a single sign-on identity. 00:05:05.000 --> 00:05:07.000 So, we can add an Active Directory domain. 00:05:07.000 --> 00:05:10.000 We can also add some other identity-type tools in there. 00:05:10.000 --> 00:05:16.000 So, again, we can just go in to click the little hamburger, go to Administration. 00:05:16.000 --> 00:05:20.000 Once we're in Administration, we're going to go down to our Single Sign-On tab, 00:05:20.000 --> 00:05:24.000 and we'll see our single sign-on different tools in there. 00:05:24.000 --> 00:05:29.000 We can go in, select it, and say we want to add an Active Directory domain. 00:05:29.000 --> 00:05:36.000 And then it'll ask us for the domain we want to join this vCenter to, 00:05:36.000 --> 00:05:40.000 and then a domain admin that is allowed to join computers to it, right? 00:05:40.000 --> 00:05:46.000 And we'll walk through how you would do that. 00:05:46.000 --> 00:05:48.000 So, security best practices. 00:05:48.000 --> 00:05:51.000 So, single sign-on can help protect your environment, 00:05:51.000 --> 00:05:56.000 because it basically forces users to use credentials to authenticate 00:05:56.000 --> 00:06:00.000 and hopefully secure credentials, because you have configured your Active Directory 00:06:00.000 --> 00:06:05.000 to require secure names and secure passwords and complex passwords, 00:06:05.000 --> 00:06:07.000 and you need to change them every so often. 00:06:07.000 --> 00:06:12.000 And all those policies that you've configured with Active Directory that you trust, 00:06:12.000 --> 00:06:15.000 you now can use with your vCenter environment. 00:06:15.000 --> 00:06:17.000 So, how can single sign-on be secured? 00:06:17.000 --> 00:06:19.000 So, keep password expirations in mind. 00:06:19.000 --> 00:06:21.000 So, you want passwords to expire, right? 00:06:21.000 --> 00:06:23.000 You want your user's passwords to expire. 00:06:23.000 --> 00:06:26.000 You want them to expire in a reasonable amount of time. 00:06:26.000 --> 00:06:28.000 Six months is not reasonable. 00:06:28.000 --> 00:06:32.000 Usually it's like somewhere between 60 and 90 days is considered to be pretty reasonable. 00:06:32.000 --> 00:06:33.000 All right. 00:06:33.000 --> 00:06:35.000 Default time is 90 days. 00:06:35.000 --> 00:06:38.000 If a password expires, then you can't log in anymore, right? 00:06:38.000 --> 00:06:40.000 You must change that password before you can log into it again. 00:06:40.000 --> 00:06:44.000 And so, ensure passwords are changed often. 00:06:44.000 --> 00:06:47.000 Now, what that means is, just because it expires in 90 days, 00:06:47.000 --> 00:06:51.000 and let's say my password was password123, a really secure password, 00:06:51.000 --> 00:06:53.000 and I said, oh, I have to change it. 00:06:53.000 --> 00:06:54.000 Fine. 00:06:54.000 --> 00:06:55.000 What's my old password? 00:06:55.000 --> 00:06:56.000 Password123. 00:06:56.000 --> 00:06:57.000 What's my new password? 00:06:57.000 --> 00:06:58.000 Password123. 00:06:58.000 --> 00:06:59.000 Confirm password123. 00:06:59.000 --> 00:07:00.000 I didn't just change my password. 00:07:00.000 --> 00:07:02.000 I just kind of reset the timer on it. 00:07:02.000 --> 00:07:06.000 So, another option that you can do with your AD environment is, say, 00:07:06.000 --> 00:07:08.000 passwords must be unique. 00:07:08.000 --> 00:07:10.000 You can only reuse a password every so many times, 00:07:10.000 --> 00:07:12.000 and you can make that number be pretty high. 00:07:12.000 --> 00:07:17.000 So, maybe the last 10 or the last 60, right, have to be unique. 00:07:17.000 --> 00:07:20.000 So, that way users can't just keep recycling the same password, 00:07:20.000 --> 00:07:23.000 the same two or three passwords over and over and over. 00:07:23.000 --> 00:07:27.000 Another thing is you might want to make sure, you know, 00:07:27.000 --> 00:07:29.000 you set a policy that's a little bit harder to enforce through Active 00:07:29.000 --> 00:07:33.000 Directory by default, but that they don't use the same password as last 00:07:33.000 --> 00:07:36.000 time with a different character. 00:07:36.000 --> 00:07:37.000 Password123 start. 00:07:37.000 --> 00:07:39.000 And then, oh, now I've got to change it. 00:07:39.000 --> 00:07:41.000 Password123 dollar sign. 00:07:41.000 --> 00:07:42.000 Oh, now I've got to change it. 00:07:42.000 --> 00:07:44.000 Password123, you know, exclamation point. 00:07:44.000 --> 00:07:48.000 So, that's not really making your password very secure either, is it? 00:07:48.000 --> 00:07:52.000 So, make sure that users know they need to really change their passwords 00:07:52.000 --> 00:07:54.000 when it comes time to change their passwords. 00:07:54.000 --> 00:07:56.000 And then NTP. 00:07:56.000 --> 00:07:59.000 NTP is very important when you're discussing single sign-on because, 00:07:59.000 --> 00:08:02.000 again, the machine you're signing in from, 00:08:02.000 --> 00:08:05.000 its clock needs to be within, you know, 00:08:05.000 --> 00:08:11.000 no greater difference than five minutes between your clock, 00:08:11.000 --> 00:08:13.000 the vCenter clock, right, 00:08:13.000 --> 00:08:16.000 and the domain controller you're trying to authenticate against. 00:08:16.000 --> 00:08:19.000 So, if it's more than a five-minute variance there, 00:08:19.000 --> 00:08:21.000 what's going to happen is it'll say, oh, you know, 00:08:21.000 --> 00:08:24.000 your clocks are out of sync and I don't trust this packet you sent me 00:08:24.000 --> 00:08:28.000 because it looks like it's really old and it won't accept it. 00:08:28.000 --> 00:08:32.000 So, use NTP to keep, you know, your clients, your vCenter servers, 00:08:32.000 --> 00:08:34.000 your Windows domain controllers, 00:08:34.000 --> 00:08:38.000 all these different systems to keep all their clocks within at least a 00:08:38.000 --> 00:08:45.000 five-minute difference of each other. 00:08:45.000 --> 00:08:50.000 So, securing single sign-on best practices. 00:08:50.000 --> 00:08:53.000 Authentication by adding users, identity sources, 00:08:53.000 --> 00:08:58.000 and so this is quickly reviewing here. 00:08:58.000 --> 00:09:01.000 Single sign-on is used to authenticate users, right? 00:09:01.000 --> 00:09:03.000 We can add users into our single sign-on domain. 00:09:03.000 --> 00:09:05.000 We can also use our Active Directory domain. 00:09:05.000 --> 00:09:11.000 Basically, we are going to trust the source of this authentication, right? 00:09:11.000 --> 00:09:13.000 Either we're using the vCenter single sign-on, 00:09:13.000 --> 00:09:15.000 and we're saying we trust that, 00:09:15.000 --> 00:09:17.000 or we're using our Active Directory single sign-on, 00:09:17.000 --> 00:09:19.000 and we're saying we trust this database over here. 00:09:19.000 --> 00:09:21.000 We have established a relationship, 00:09:21.000 --> 00:09:25.000 a trust between vCenter and our Active Directory directory services, 00:09:25.000 --> 00:09:29.000 and we have certificates and stuff in place so we can authenticate each 00:09:29.000 --> 00:09:32.000 other and, yep, we know our communications are secure. 00:09:32.000 --> 00:09:34.000 And then you want to follow best practices. 00:09:34.000 --> 00:09:37.000 Like, for example, you want to follow password exploration best practices. 00:09:37.000 --> 00:09:42.000 You want to follow uniqueness best practices and things like that. 00:09:42.000 --> 00:09:44.000 But now that we discussed single sign-on, 00:09:44.000 --> 00:09:46.000 let's go ahead and go back into our demo environment, 00:09:46.000 --> 00:09:49.000 and I'll show you how you can set up and configure user accounts, 00:09:49.000 --> 00:09:52.000 roles, and how to configure single sign-on. 00:09:52.000 --> 00:09:57.000 So, here in our demo environment, I'm going to click on our hamburger here, 00:09:58.000 --> 00:10:03.000 and I'm going to go to administration. 00:10:03.000 --> 00:10:07.000 And in administration, you see here I have last time I had open, 00:10:07.000 --> 00:10:09.000 I had these roles, global permissions. 00:10:09.000 --> 00:10:16.000 First, let's go down to single sign-on, and let's go to configuration. 00:10:16.000 --> 00:10:20.000 So, here we can configure identity sources, right? 00:10:20.000 --> 00:10:25.000 We also can see our rules, our policies for local accounts, right? 00:10:25.000 --> 00:10:28.000 Our single sign-on domain name is stormlabs.local. 00:10:28.000 --> 00:10:32.000 Here I have policies for, like, minimum length and, you know, 00:10:32.000 --> 00:10:35.000 character requirements, things like that, maximum length, minimum length. 00:10:35.000 --> 00:10:40.000 Something that's kind of interesting, let's just say, for example, 00:10:40.000 --> 00:10:44.000 I say I need to have at least one uppercase character here. 00:10:44.000 --> 00:10:51.000 If that uppercase character is the first character in my password, 00:10:51.000 --> 00:10:53.000 it doesn't count as the uppercase character. 00:10:53.000 --> 00:10:57.000 I have to have an uppercase character someplace else in my password. 00:10:57.000 --> 00:11:01.000 And if I say that I have to have at least one numeric character, 00:11:01.000 --> 00:11:05.000 if that numeric character is the last character in my password, 00:11:05.000 --> 00:11:07.000 it doesn't count as a numeric character. 00:11:07.000 --> 00:11:11.000 I need to have an uppercase character somewhere else in my password 00:11:11.000 --> 00:11:15.000 and a numeric character someplace else other than the end in my password. 00:11:15.000 --> 00:11:17.000 An uppercase character someplace else in the beginning 00:11:17.000 --> 00:11:21.000 and a numeric character someplace else other than the end. 00:11:21.000 --> 00:11:24.000 So just keep that in mind if you go in and say, 00:11:24.000 --> 00:11:28.000 well, okay, my password's 10 characters long and it has to be at least 8, 00:11:28.000 --> 00:11:29.000 so not more than 20. 00:11:29.000 --> 00:11:30.000 Ten fits that bill. 00:11:30.000 --> 00:11:34.000 And I have an uppercase character and I have a numeric character 00:11:34.000 --> 00:11:35.000 and I have all these things. 00:11:35.000 --> 00:11:36.000 Why is it not working? 00:11:36.000 --> 00:11:40.000 Maybe put another uppercase character someplace other than the beginning 00:11:40.000 --> 00:11:42.000 and put a number someplace other than the end, 00:11:42.000 --> 00:11:44.000 and that might help you there. 00:11:44.000 --> 00:11:46.000 All right, just a little something to keep in mind. 00:11:46.000 --> 00:11:48.000 So here's our lockout policy. 00:11:49.000 --> 00:11:55.000 So also we can configure a message so when someone logs in, 00:11:55.000 --> 00:11:58.000 they get a banner that gives them some kind of corporate warning 00:11:58.000 --> 00:12:01.000 about only authorized corporate users. 00:12:01.000 --> 00:12:02.000 It might be something you get from your legal department 00:12:02.000 --> 00:12:03.000 or something like that, 00:12:03.000 --> 00:12:08.000 or something you've got GBT fed you that you asked it for. 00:12:08.000 --> 00:12:11.000 Okay, so if you want to configure Active Directory, 00:12:11.000 --> 00:12:15.000 here we can go and say we want to join AD. 00:12:15.000 --> 00:12:17.000 I'm going to give it the domain name, right, 00:12:17.000 --> 00:12:21.000 optional organizational unit name, 00:12:21.000 --> 00:12:24.000 an Active Directory directory services username, 00:12:24.000 --> 00:12:28.000 and my password for my Active Directory directory services. 00:12:28.000 --> 00:12:29.000 I'm going to say join. 00:12:29.000 --> 00:12:31.000 It's going to have to do a reboot of this system, 00:12:31.000 --> 00:12:33.000 and then when it comes back up again, 00:12:33.000 --> 00:12:35.000 I should be a member of Active Directory, 00:12:35.000 --> 00:12:38.000 and now I can start using Active Directory accounts. 00:12:38.000 --> 00:12:42.000 So under users and groups, like I can say here, 00:12:42.000 --> 00:12:44.000 I want to use my stormwindlabs.local. 00:12:44.000 --> 00:12:48.000 This is my vSphere single sign-on domain. 00:12:48.000 --> 00:12:52.000 If my corporate Active Directory directory services domain 00:12:52.000 --> 00:13:00.000 was stormwinds.local or stormwinds.com, 00:13:00.000 --> 00:13:03.000 then that domain would show up here also. 00:13:03.000 --> 00:13:10.000 So if I want to create users for my vSphere single sign-on domain, 00:13:10.000 --> 00:13:13.000 I can click on add, and I can give this a name. 00:13:13.000 --> 00:13:16.000 I can just call this demo01. 00:13:16.000 --> 00:13:18.000 I'll give it a password. 00:13:18.000 --> 00:13:21.000 All right. 00:13:21.000 --> 00:13:23.000 Oh, it's probably not. 00:13:23.000 --> 00:13:27.000 Okay, let me just try that and that. 00:13:27.000 --> 00:13:28.000 Okay, there we go. 00:13:28.000 --> 00:13:36.000 And I can just say it is a – I can put in things like email addresses 00:13:36.000 --> 00:13:38.000 and descriptions if I want to. 00:13:38.000 --> 00:13:41.000 I can go in there and change these things later also, 00:13:42.000 --> 00:13:44.000 except my username I can't change. 00:13:44.000 --> 00:13:50.000 So if I were to say add here, I have my demo account. 00:13:50.000 --> 00:13:51.000 I can check it. 00:13:51.000 --> 00:13:54.000 I can say I want to edit, and I can go in there and edit the password, 00:13:54.000 --> 00:13:57.000 change this password, change first name, change last name, 00:13:57.000 --> 00:13:59.000 modify the email address, modify the description. 00:13:59.000 --> 00:14:01.000 I can't change the username. 00:14:01.000 --> 00:14:04.000 That is kind of set in stone there. 00:14:04.000 --> 00:14:07.000 All right. 00:14:07.000 --> 00:14:08.000 Any other options? 00:14:08.000 --> 00:14:09.000 I can disable the account. 00:14:09.000 --> 00:14:13.000 If it's just locked out or, you know, disabled, I can enable it. 00:14:13.000 --> 00:14:17.000 Now, another thing I can do is now that I've created this demo account, 00:14:17.000 --> 00:14:22.000 I can go to my roles, and I can go in and say, okay, 00:14:22.000 --> 00:14:28.000 I want to make this user a virtual machine administrator, right? 00:14:28.000 --> 00:14:30.000 I just want them to administer virtual machines. 00:14:30.000 --> 00:14:37.000 So I can scroll, and I can see I have my virtual machine power user, right? 00:14:37.000 --> 00:14:41.000 Here's the virtual machine power user, and here's the virtual machine user. 00:14:41.000 --> 00:14:44.000 I can click on this and say, well, what can this user do? 00:14:44.000 --> 00:14:47.000 And all these different things, they can cancel tasks, 00:14:47.000 --> 00:14:51.000 they can create tasks, modify tasks on the VM, right? 00:14:51.000 --> 00:14:55.000 They can acquire a disk lease, add an existing disk, add a new disk, 00:14:55.000 --> 00:14:57.000 add or remove a device. 00:14:57.000 --> 00:15:02.000 Here's a list of all the things that this power virtual machine user can do. 00:15:02.000 --> 00:15:04.000 What about a regular virtual machine user? 00:15:04.000 --> 00:15:06.000 What can they do? 00:15:06.000 --> 00:15:08.000 They can create tasks, right? 00:15:08.000 --> 00:15:11.000 But they have a lot fewer things down here they can do. 00:15:11.000 --> 00:15:15.000 This list is a lot shorter than the power user. 00:15:15.000 --> 00:15:20.000 What if I wanted something in between this user and this user? 00:15:20.000 --> 00:15:26.000 Well, you know, you don't want to go in and modify your default roles. 00:15:26.000 --> 00:15:28.000 Those are always to be left alone. 00:15:28.000 --> 00:15:32.000 And notice how it says sample, kind of help you know that these are kind of, 00:15:32.000 --> 00:15:34.000 you know, some of the ones that are sample roles 00:15:34.000 --> 00:15:36.000 that we can mess with a little bit. 00:15:36.000 --> 00:15:41.000 What I can do is I can say I want to clone this, right? 00:15:41.000 --> 00:15:49.000 And I can say, maybe I can say storm winds virtual machine power user 00:15:49.000 --> 00:15:54.000 and get rid of that sample. 00:15:54.000 --> 00:16:13.000 And here I can say custom storm winds VM power user. 00:16:13.000 --> 00:16:17.000 So, I just know this is not the default one that comes with it, right? 00:16:17.000 --> 00:16:20.000 And I can say okay to this. 00:16:20.000 --> 00:16:25.000 And now that I have created my storm winds one, 00:16:25.000 --> 00:16:33.000 I've got to find an outward to place it. 00:16:33.000 --> 00:16:35.000 Right here. 00:16:35.000 --> 00:16:39.000 Now I can go into this guy, and this is one that I should not mind editing, 00:16:39.000 --> 00:16:42.000 and actually I want to edit it because this is going to give me the ability, 00:16:42.000 --> 00:16:45.000 you know, to make those changes I was looking for, right? 00:16:45.000 --> 00:16:47.000 So, I can say, all right, so what can this machine do? 00:16:47.000 --> 00:16:49.000 So, let's go down. 00:16:49.000 --> 00:16:52.000 I want to look for virtual machines. 00:16:52.000 --> 00:16:55.000 You can tell something in this is selected, 00:16:55.000 --> 00:16:58.000 and all these things are related to that, right? 00:16:58.000 --> 00:17:04.000 But there's nothing related to create data set and, you know, delete data set, 00:17:04.000 --> 00:17:05.000 things like that, right? 00:17:05.000 --> 00:17:07.000 Edit inventory, create new. 00:17:07.000 --> 00:17:10.000 Maybe I want to be able to create a new one, right? 00:17:10.000 --> 00:17:17.000 Or maybe I don't want the users to be able to change CPU or change memory. 00:17:17.000 --> 00:17:19.000 I don't want those. 00:17:19.000 --> 00:17:21.000 I don't want them to change any settings at all, right? 00:17:21.000 --> 00:17:24.000 They can modify some of these other things, right, 00:17:24.000 --> 00:17:27.000 but not the settings and not CPU and memory. 00:17:27.000 --> 00:17:30.000 Or maybe okay with settings, but, you know, not CPU and memory. 00:17:30.000 --> 00:17:34.000 So, now I have customized this storm winds virtual machine power user group 00:17:34.000 --> 00:17:37.000 that I created, and I can save that. 00:17:37.000 --> 00:17:45.000 Under these global permissions, I can go in, and I can say I want to add, 00:17:45.000 --> 00:17:50.000 and at my storm winds lab, I'm going to find my group, 00:17:50.000 --> 00:17:55.000 and I'll just call this demo one. 00:17:55.000 --> 00:18:02.000 And then I'm going to find my storm winds virtual machine power user. 00:18:02.000 --> 00:18:04.000 To have it jump there, I hit S on my keyboard, 00:18:04.000 --> 00:18:06.000 and it kind of jumped into that first instance there. 00:18:06.000 --> 00:18:11.000 So, now this user is going to be in this role. 00:18:11.000 --> 00:18:13.000 And when I say propagate to children, 00:18:13.000 --> 00:18:16.000 what that means is that I want this to propagate to other resources 00:18:16.000 --> 00:18:18.000 in my environment as well. 00:18:18.000 --> 00:18:20.000 So, it will probably get down in the chain to, like, 00:18:20.000 --> 00:18:24.000 subfolders and things like that when I assign it to resources. 00:18:24.000 --> 00:18:26.000 So, okay to that. 00:18:26.000 --> 00:18:32.000 And so, now that storm winds user is in the global permissions. 00:18:32.000 --> 00:18:34.000 Global means it's going to be assigned to everything, right? 00:18:35.000 --> 00:18:41.000 I can also go in to my inventory, and I can choose, like, for example, 00:18:41.000 --> 00:18:47.000 a data center or a cluster, and say I want to add permissions. 00:18:47.000 --> 00:18:52.000 And, again, I can say, okay, now to just this data center, 00:18:52.000 --> 00:18:55.000 choosing the domain, if I had AD integration configured, 00:18:55.000 --> 00:18:58.000 I could choose my Active Directory domain. 00:18:58.000 --> 00:19:04.000 I could say what user. 00:19:04.000 --> 00:19:06.000 I have one in here called test group. 00:19:06.000 --> 00:19:14.000 And I want test group to have that storm winds 00:19:14.000 --> 00:19:16.000 virtual machine power users ability. 00:19:16.000 --> 00:19:22.000 So, test group has a storm winds virtual power user ability only in that DC. 00:19:22.000 --> 00:19:29.000 So, now if I put a user in that role, they are in this DC. 00:19:29.000 --> 00:19:33.000 They now can, you know, manage virtual machines with the privileges I created 00:19:33.000 --> 00:19:35.000 for that unique role that we just set up. 00:19:35.000 --> 00:19:40.000 So, again, administration. 00:19:40.000 --> 00:19:44.000 We can configure our single sign-on through our single sign-on configuration. 00:19:44.000 --> 00:19:46.000 We can manage users. 00:19:46.000 --> 00:19:51.000 We can manage groups, right? 00:19:52.000 --> 00:20:04.000 So, I can create a group for my demo group. 00:20:04.000 --> 00:20:05.000 Let me take that one out. 00:20:05.000 --> 00:20:10.000 And we're going to look for my demo user, demo 01. 00:20:10.000 --> 00:20:14.000 So, now demo 01 in that group. 00:20:14.000 --> 00:20:22.000 And that group is already in my storm winds virtual machine power users role. 00:20:22.000 --> 00:20:26.000 And so, now this new user I just created or that new group I just created, 00:20:26.000 --> 00:20:29.000 right, in that role. 00:20:29.000 --> 00:20:31.000 So, it's pretty easy to see how we can quickly manage. 00:20:31.000 --> 00:20:34.000 So, now if I need to hire another person or bring another person on, 00:20:34.000 --> 00:20:41.000 I can just create a user account for them, add them to my demo group, 00:20:41.000 --> 00:20:44.000 and they'll automatically have all the same rights 00:20:44.000 --> 00:20:47.000 and permissions as the other people that are in that same demo group 00:20:47.000 --> 00:20:48.000 and what roles they're applied to. 00:20:48.000 --> 00:20:51.000 So, it makes it really easy to manage your vSphere environment. 00:20:51.000 --> 00:20:52.000 You don't have to create users 00:20:52.000 --> 00:20:54.000 and then go manually assign them to all these things. 00:20:54.000 --> 00:20:57.000 If we have certain job functions already defined, 00:20:57.000 --> 00:21:01.000 we can use our users and then groups and assign them to roles, 00:21:01.000 --> 00:21:04.000 and they'll start inheriting it from their group. 00:21:04.000 --> 00:21:08.000 And that is single sign-on in users and groups.