I’ve been playing admin on our shiny new ESX server and it’s been a struggle trying to get the user accounts configured. I wanted to give our QA staff enough rights to login through the VMware Web Access portal so that they could start and stop their virtual machines. I figured I would just set up their accounts and put them in the “Virtual Machine User” role. No of the accounts could login in. They kept getting the dreaded “Login failed due to a bad username or password.”
I dug around a bit and started searching the VMware forums. Apparently everyone was using AD to authenticate their user accounts. I wasn’t planning using AD because we are going to be changing domains in the near future, but I figured nothing else was working, it couldn’t hurt. This message led me to a very useful post by Geert Baeke on how to integrate Active Directory with ESX 3. There was a lot of useful stuff in that post, but the part that I needed came down to this:
**esxcfg-auth –enablead –addomain=domain.com –addc=domain.com
**The VMware document uses the FQDN of a domain controller for the –addc parameter, but you can use the FQDN of the domain. That way, DNS is used to find domain controllers and use one of those. The command above modifies a few files like /etc/krb5.conf and also the system-auth file in /etc/pam.d. The ESX firewall is also automatically configured to open the needed ports for AD authentication.
Before you can logon with an AD account, you need to create a console user on the ESX box that has the same name as your AD account. For example, if you have an AD account domain\esxadmin, you need to add a user to the ESX console called esxadmin. The command to use is useradd esxadmin. You can also use VI Client to create the user. You can now logon with the account and use the AD password. I tested this with ESX 3.0.1 servers against Windows 2000 and Windows 2003 domains and it worked as advertised.
I did it and it worked like a charm. Life is good.