Inside vCenter SSO, this service signs SAML tokens with its own certificate and gives them to users and solution users once authenticated, so a single login covers every vCenter service.
Also called Security Token Service.
Read more: Broadcom TechDocs
In the Ultra Transcenders books
Each book explains STS in context, with comparison tables and the common traps.
Terms in this definition
- vCenter
Management software for VMs, clusters and ESX hosts. Each domain in VCF gets a dedicated one.
- SSO
Signing in once to gain access to multiple applications.
- SAML
Security Assertion Markup Language: a federation protocol for single sign-on, which non-gallery apps added as enterprise applications commonly use.
- Certificate
Key Vault object holding an X.509 certificate, whose associated key and secret are managed alongside it.
- Once flow
A flow that executes a single time and repeats only if the pipeline is fully refreshed. It's a common choice for a first full load ahead of a change feed, and that refresh becomes dangerous once the original files no longer exist.
- Login
A server-wide security principal used for connecting to SQL Server or an Azure SQL logical server; users inside each database are linked to it. EXECUTE AS LOGIN can't be used in Azure SQL Database.
- vpxd
vCenter's core service: if it stops you lose management, yet hosts and VMs carry on running. Its output goes to vpxd.log, with the logging level controlled from vCenter's general settings.
Related terms
- HOK
Holder-of-key tokens are a SAML token flavour within vCenter Single Sign-On, tied to the presenter's certificate. A log line reading 'Could not parse HOK Token' in applmgmt.log hints that the STS certificate chain is missing a link.
- STS signing certificate
vCenter Single Sign-On signs the tokens from its Security Token Service with this certificate. VMCA issues one valid for ten years and renews it by itself, but a certificate supplied by you or a third party is not renewed automatically and is the administrator's job.