{"id":1495,"date":"2017-03-16T10:14:25","date_gmt":"2017-03-16T10:14:25","guid":{"rendered":"http:\/\/read.virtualizeplanet.com\/?p=1495"},"modified":"2017-03-16T10:15:57","modified_gmt":"2017-03-16T10:15:57","slug":"vro-active-directory-plugin-needs-ldaps","status":"publish","type":"post","link":"https:\/\/read.virtualizeplanet.com\/?p=1495","title":{"rendered":"vRO Active Directory Plugin needs LDAPS"},"content":{"rendered":"

Recently I rebuilt vRealize Automation in my home lab gearing up for some internal sessions on home labs. I wanted to show usual stuff like provisioning a VM and some admin orchestration like user management. What I noticed, however, is in vRealize Orchestrator that the Active Directory workflow to change a user’s Active Directory password would not work, and the error alluded to a certificate error. After doing some digging about, I found out it’s because I wasn\u2019t authenticating to Active Directory over LDAPS (Ldap over SSL) . Now in a vRealize Automation and a vRealize Orchestrator setup that would be configured in 3 places. 1) In the vRealize Orchestrator appliance to authenticate vRealize Orchestrator against Active Directory over SSL. 2) As a directory setup in vRealize Automation. 3) When registering the Active Directory plugin in vRealize Orchestrator against Active Directory. In my opinion, I followed the best instructions on the web I could find to achieve this as VMware documents are lacking proper instructions but failed with 1) and 2) .<\/p>\n

 <\/p>\n

I tested Active Directory over SSL (LDAPS) using the Microsoft tool ldp.exe and Apache LDAP Studio without fail, so I knew from the Active Directory side all was good.<\/p>\n

 <\/p>\n

I\u2019m sure it’s something I\u2019m doing wrong with how I\u2019m inputting the parameters on in the vRealize Orchestrator appliance and within vRealize Automation Directories but to be honest for my purposes I only needed the vRealize Orchestrator Active Directory Plugin operational, and I managed (with a little help from @railroadmanuk<\/a> ) get it working\u2026 So here\u2019s what to do based on a Windows 2012 Active Directory:<\/p>\n

 <\/p>\n

First, you need to make sure you have Active Directory certificate services working, and you do that by making sure you have added the role of Active Directory certificate services and certificate authority.<\/p>\n

\"\"<\/a><\/p>\n

Pick Enterprise CA<\/p>\n

\"\"<\/a><\/p>\n

And Root CA<\/p>\n

\"\"<\/a><\/p>\n

Then Create a Private Key.<\/p>\n

\"\"<\/a><\/p>\n

I changed the hash algorithm based on reading an article I found.<\/p>\n

\"\"<\/a><\/p>\n

Default the rest of the configuration by click Next.<\/p>\n

This will install your Active Directory certificate bits\u2026 you can check to see if this works by running LDP.EXE.. however, make sure you use localhost or FQDN in the connection string as it won’t work.<\/p>\n

\"\"<\/a><\/p>\n

Now if you open up MMC and add-in the Certificate snapin on point at Computer Account > Local Computer. Open the Personal Node and Certificates you\u2019ll see your cert here.<\/p>\n

\"\"<\/a><\/p>\n

Now it’s time to export this certificate to import later in the vRealize Orchestrator appliance.<\/p>\n

\"\"<\/a><\/p>\n

Click Next<\/p>\n

\"\"<\/a><\/p>\n

Click Next<\/p>\n

\"\"<\/a><\/p>\n

Provide a filename, but please copy this certificate to somewhere that can be uploaded to the vRealize Orchestrator appliance.<\/p>\n

 <\/p>\n

Now in your vRealize Orchestrator Control Center Click on Certificates<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Now import the certificate you exported earlier.<\/p>\n

\"\"<\/a><\/p>\n

Now if you open up the vRealize Orchestrator Client you can add an Active Directory server using SSL by running the following workflow<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Add in your parameters for you Active Directory Server making sure you specify port 636 and to use SSL.<\/p>\n

\"\"<\/a><\/p>\n

The mistake I made for a while was not using a UPN style naming convention when inputting my user credentials.<\/p>\n

\"\"<\/a><\/p>\n

 <\/p>\n

Now after all of the above I was then able to run the Active Directory workflows that require LDAPS connection\u2026 well after all we cannot have passwords sent in clear text can we? \ud83d\ude09<\/p>\n

Some resources I find along the way:<\/p>\n

https:\/\/goo.gl\/SLEIhl<\/a><\/p>\n

https:\/\/goo.gl\/HFdBZq<\/a><\/p>\n

https:\/\/goo.gl\/wsjMSM<\/a><\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

Recently I rebuilt vRealize Automation in my home lab gearing up for some internal sessions on home labs. I wanted to show usual stuff like provisioning a VM and some admin orchestration like user management. What I noticed, however, is in vRealize Orchestrator that the Active Directory workflow to change a user’s Active Directory password […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[15,4],"tags":[82,81,80],"class_list":["post-1495","post","type-post","status-publish","format-standard","hentry","category-vcloud","category-vmware","tag-vrealize-orchestrator","tag-vro-ad-plugin","tag-vro-ssl"],"aioseo_notices":[],"views":13523,"_links":{"self":[{"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=\/wp\/v2\/posts\/1495","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1495"}],"version-history":[{"count":3,"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=\/wp\/v2\/posts\/1495\/revisions"}],"predecessor-version":[{"id":1517,"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=\/wp\/v2\/posts\/1495\/revisions\/1517"}],"wp:attachment":[{"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1495"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1495"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/read.virtualizeplanet.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1495"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}