CDS – Cloud Director Services – SaaS implementation of Cloud Director for VMware Cloud Providers that can be connected to VMware in AWS (VMC) and provide the interface to the customer to manage their infrastructure.

CDS is a brilliant service which saves a lot of time when compared to the Cloud Director in the on-premise environment in terms of maintaining and resolving potential issues.

CDS takes the whole advantage of VMC to the next level where the VMC environment can be divided between customers, departments, etc, with the advantage of having super fast, highly scalable, implemented according to the best practices VMware implementation in Public Cloud.

Anyway, CDS similarly to the Cloud Director (on-prem) will need infrastructure services that can fulfill all the requirements. One of such services is authentication. In on-prem we can potentially (and usually) use Microsoft AD. In the cloud we can of course do the same, but why don’t we use native cloud services. 

Our target is to use a single authentication service for CDS and vCenter (in VMC).

The challenge here is that CDS can use:

• vCenter supports Active Directory, AD over LDAP and OpenLDAP
  
  
• CDS supports SAML, Active Directory and OpenLDAP
  
  

In this scenario we will use the following components:

• CDS – Cloud Directory Service (VMware Cloud Director as a Service)
• VMC/vCenter – VMware Cloud on AWS

• Network Load Balancer
• AWS simple AD
• Route 53 record
• LDAPS client – to verify communication
• Certificate manager

Proposed implementation is represented on the following schema:

• Client – CDS/vCenter (others) sends LDAPS request on tcp port 636 (default)
• NLB terminates the SSL/TSL traffic using the certificate and sends the decrypted LDAP traffic to AD (simple) using tcp/389
• Simple AD sends respond to NLB where it is encrypted and send to the client

Troubleshooting:

• Ticket to VMware – open outside communication
• openssl s_client -connect
• ldapsearch -D "Admin@youdomain.domain" -H 'ldaps://yourdomain.domain' -b "dc=yourdomain,dc=domain" -W -s base '(objectclass=*)' -vvv -x -Z

• https://aws.amazon.com/blogs/security/how-to-configure-ldaps-endpoint-for-simple-ad/
• https://docs.vmware.com/en/VMware-Cloud-Director-service/services/getting-started-with-vmware-cloud-director-service/GUID-149EF3CD-700A-4B9F-B58B-8EA5776A7A92.html
• https://aws.amazon.com/blogs/security/how-to-configure-an-ldaps-endpoint-for-simple-ad/
• https://docs.aws.amazon.com/directoryservice/latest/admin-guide/simple_ad_getting_started.html
• https://docs.vmware.com/en/VMware-Cloud-Director/10.2/VMware-Cloud-Director-Service-Provider-Admin-Portal-Guide/GUID-4ECA36E9-E051-489C-A039-67621DE2C688.html