2V0-21.23 Question 108
Single answerAn organization is planning to implement identity federation for their VMware vSphere environment. They want users to authenticate using their corporate identity provider (IdP) without manually managing user accounts in vCenter Server. Which of the following is a requirement to successfully configure identity federation in this scenario?
- A
The corporate IdP must support OpenID Connect (OIDC).
- B
vCenter Server must be joined to an Active Directory domain.
- C
The corporate IdP must support LDAP authentication.
- D
vCenter Single Sign-On (SSO) must be disabled during the federation configuration process.
Show answer and explanation
Correct answer: A
Explanation
Identity federation in VMware vSphere enables vCenter Server to authenticate users through an external corporate identity provider (IdP) using OpenID Connect (OIDC). This approach eliminates the need to manage user accounts directly within vCenter Server. For identity federation to work, the IdP must support OIDC, as this is the protocol used for the integration. Other options like LDAP or disabling SSO are not applicable to this configuration.
- A. Correct.
Correct. Identity federation in vSphere relies on OpenID Connect (OIDC) to integrate with an external identity provider (IdP). The IdP must support OIDC for the federation to work.
- B. Incorrect.
Incorrect. While Active Directory can be used for traditional authentication with vCenter, it is not a requirement for identity federation. Identity federation allows vCenter Server to authenticate directly with an external IdP, bypassing the need for Active Directory integration.
- C. Incorrect.
Incorrect. LDAP authentication is not used for identity federation in vSphere. Instead, OIDC is the protocol required for federation with a corporate IdP.
- D. Incorrect.
Incorrect. vCenter Single Sign-On (SSO) is required for identity federation and must remain enabled. Disabling SSO would prevent proper authentication and federation configuration.