VMware Enhanced Authentication Plugin Not Working

For several versions of vSphere vCenter it is possible to logon with your windows credentials. Making it easier to only tick a box and logon instead of typing your username and password.
This nice and neat trick is done via the VMware Enhanced Authentication Plugin.
The only issue… it does need to work every time, else it is going to be an annoyance.
And , yes, it became an annoyance for me… especially when using Firefox.
So let me give you to possible solutions

Solution 1# (re)start the service

Check if the VMware Cip Message Proxy Service is running. Firefox will let you know that it is not running.
Easy, right ?
Refresh your browser page are open the vCenter webclient. After ticking the box you should see your windows username filled in.

Solution 2# trust the SSL certificate

Yes, the Cip uses a SSL certificate and nowadays browsers are becoming more strict about it.
When you start the webclient for the first time in a browser, the browser will detect that a plugin wants to start and it asks you if it is allowed. And it gives you the option to remember your choice. (Tip let’s remember that it is allowed to run the plugin.)

When I used chrome or IE I did get a warning pop-up and told the browser that it is ok. But when using firefox, I didn’t get a pop-up warning. And I could tick and logon but it wasn’t working.

So after some googling I found this artice https://www.jonkensy.com/vcenter-6-5-enhanced-authentication-plugin-not-working/ which guided me to the solution. For firefox it was to accept the certificate from the proxy service. How ?

  1. browser to https:\\vmware-plugin:8094
  2. Confirm the security exception (see image below)

Voila…. try it again by opening the webclient UI of vSphere.
Tick the box and logon…. you should see that it is entering your windows account detais

Issue 2 – bypassing the fingerprint cache message when using PLINK

This article is part of a series of articles about issues I encountered during implementation of a vSphere stretched cluster based on vSphere 6.7 U1.
You can find the introduction article here

Issue 2

For some configuration settings I need SSH access to the host.  I use plink.exe to execute instructions through the SSH session. One issue, the first time when you connect with plink you get a message about storing the fingerprint ID in the cache. Normally you would accept this when using putty. But now this is going to be a challenge.
On some other blogs I found the solution. You echo the ‘Y’ which results in storing the ID in the cache.
In my code I now  call plink two times. The first time to accept the fingerprint, the second time to execute the command.
Why two times ? Well, I can’t assume that the fingerprint ID is already known.
The first plink instruction is a simple exit, we only want to check if we can logon.

$credential=get-credential
$plink="d:\plink.exe $hostname -l "+ $credential.username + " -pw " + $credential.getnetworkcredential().password
$command="ls"
invoke-expression ("echo Y | " + $plink +  " -ssh exit")
invoke-expression ($plink + " "+ $command)

Issue 1 – changing root password

This article is part of a series of articles about issues I encountered during implementation of a vSphere stretched cluster based on vSphere 6.7 U1.
You can find the introduction article here

Issue

All the hosts are delivered with 6.5 U2 pre-installed, and they have their own root password. For the implementation we want to have just one general root account password. So after adding all the hosts to the cluster I want to change the root password with powercli. But I tripped over a bug in get-esxcli (thanks to this thread ). The ‘&’ character is not correctly being interpreted when using get-esxli.
The script I wrote checks if the new password contains that character and will kindly ask to change it. After succesfull validation of the password it will apply it to all selected esxi hosts.
I

#-- select one or more hosts
[array]$esxiHosts=get-vmhost | select name | sort | out-gridview -Title "Select one or more ESXi Hosts"-OutputMode Multiple
if ($esxiHosts.count -eq 0) {
write-host "No host(s) selected, will exit." -foregroundcolor yellow
exit
}
#-- ask for root password and validate it agains known bug
Do {
$newCredential = Get-Credential -Username root -Message "Enter the password for the ESXi root account."
$isValid=$true
if ($newCredential.getNetworkCredential().Password -imatch "[\&]") {
$isValid=$false
write-host"Password contains character & which get-esxcli can't handle (bug)..... please consider a different password." -foregroundcolor yellow
}
}
until ($isValid)

#-- change root password for all selected esxi hosts
foreach ($esxiHost in $esxiHosts) {
$esxiHost=get-vmhost -Name -$esxiHost.name
$esxiCli=get-esxcli -v2 -vmhost $esxiHost
$arguments=$esxcli.system.account.set.createArgs()
$arguments.id=$newCredential.UserName
$arguments.password=$newCredential.GetNetworkCredential().password
$arguments.passwordconfirmation=$arguments.password
try {$esxcli.system.account.set.Invoke($arguments)}
catch{write-host "Setting password failed for " $esxiHost.name -ForegroundColor Yellow}
}

Use customer VPN via encrypted VM

in my job as a consultant I often work for a short period for customers. Most of the time they have a solution in place for working remotely. Or by using a laptop from them, or by a VPN portal.
To have the oppertunity to work remotely is a blessing. But when it is, using their VPN portal… well…. most of the time you have some issues. Why ?
Well, most of the time the VPN client will limit the use of your laptop. all your internet activity is send through the tunnel….via the customer…. hmmm I have nothing to hide, but it is not a desirable situation in my opinion.

Continue reading “Use customer VPN via encrypted VM”

new category – Tools

I was thinking, why don’t I start a blog series on the tools that I use for my work ?
I know, there are several articles out there about why you should certain tools, and I know that my setup isn’t the answer to all problems…. but hey why not share it, maybe even get some feedback / input etc….

So there is a new category born, called tools. Articles about tools and tips will be placed under this category.

Issues I encountered with a stretched cluster implementation on 6.7 U1

At the moment I’m busy with a stretched cluster implementation based on vSphere 6.7 U1. Most of the configuration is straight forward. But I encounter some snags.
So this post is about these snags, and how I solved them.

For configuring 16 hosts I use a lot of powerCLI. Why ? Well I have some issues with host profiles, and not the time (yet) to figure out what is going on.
Edit: I found out what the issue is, I’ll explain it in Issue 3.

I encountered the following issues

Change All Services icon through Rest API of vRA

A blog on my experience in using postman to change the All Services icon off vRA 7.2

Since vRA 7.1 you can change the “All Services” icon.
VMware has an article here on how to change this through the API.
I thought, maybe you could also do this via Postman. Which would also be a good exercise (for me) in understanding and using the Rest API via Postman.
The article below is one of many ways to solve this issue, feedback is welcome in the comments below.

Continue reading “Change All Services icon through Rest API of vRA”