Skip to main content

VMware vCenter

Support level: Community

What is vCenter

vCenter Server is the centralized management utility for VMware, and is used to manage virtual machines, multiple ESXi hosts, and all dependent components from a single centralized location. VMware vMotion and svMotion require the use of vCenter and ESXi hosts.



This requires authentik 0.10.3 or newer.


This requires VMware vCenter 7.0.0 or newer.


It seems that the vCenter still needs to be joined to the Active Directory Domain, otherwise group membership does not work correctly. We're working on a fix for this, for the meantime your vCenter should be part of your Domain.


The following placeholders will be used:

  • is the FQDN of the vCenter server.
  • is the FQDN of the authentik install.

Since vCenter only allows OpenID-Connect in combination with Active Directory/LDAP, it is recommended to have authentik sync with the same Active Directory. You also have the option of connecting to an authentik managed LDAP outpost for user management.

Step 1

Under Customization -> Property Mappings, create a Scope Mapping. Give it a name like "OIDC-Scope-VMware-vCenter". Set the scope name to openid and the expression to the following

return {
"domain": "<your active directory domain>",

If you are using an authentik managed LDAP outpost you can use the following expression in your property mapping. This will correctly return the groups claim as a list of LDAP DNs instead of their names.

ldap_base_dn = "DC=ldap,DC=goauthentik,DC=io"
groups = []
for group in request.user.ak_groups.all():
group_dn = f"CN={},dc=groups,{ldap_base_dn}"
return {
"preferred_username": request.user.username,
"nickname": request.user.username,
"groups": groups,
"domain": ""

Step 2


If your Active Directory Schema is the same as your Email address schema, skip to Step 3.

Under Sources, click Edit and ensure that "authentik default Active Directory Mapping: userPrincipalName" has been added to your source.

Step 3

Under Providers, create an OAuth2/OpenID provider with these settings:

  • Redirect URI:
  • Sub Mode: If your Email address Schema matches your UPN, select "Based on the User's Email...", otherwise select "Based on the User's UPN...". If you are using authentik's managed LDAP outpost, chose "Based on the User's username"
  • Scopes: Select the Scope Mapping you've created in Step 1
  • Signing Key: Select any available key

Step 4

Create an application which uses this provider. Optionally apply access restrictions to the application.

Set the Launch URL to This will skip vCenter's User Prompt and directly log you in.


This Launch URL only works for vCenter < 7.0u2. If you're running 7.0u2 or later, set the launch URL to

vCenter Setup

Login as local Administrator account (most likely ends with vsphere.local). Using the Menu in the Navigation bar, navigate to Administration -> Single Sing-on -> Configuration.

Click on Change Identity Provider in the top-right corner.

In the wizard, select "Microsoft ADFS" and click Next.

Fill in the Client Identifier and Shared Secret from the Provider in authentik. For the OpenID Address, click on View Setup URLs in authentik, and copy the OpenID Configuration URL.

On the next page, fill in your Active Directory Connection Details. These should be similar to what you have set in authentik.

If your vCenter was already setup with LDAP beforehand, your Role assignments will continue to work.