MFA integration with VCF 5.2.1

[Guillermo Argañaras]

Good afternoon, question. Has anyone implemented MFA in the VCF UI admin consoles?
My client has a Radius server, and I was wondering if I could integrate it.
Thank you very much.

[William Lam]

SDDC Manager delegates its authentication to vCenter Server, which supports a number of external Identity Providers (Microsoft ADFS, Okta, Microsoft Entra ID & PingFederate). Its important to understand that MFA is a capability of the IdP, it has no barring on VMware components :)

For example, I'm able to use YubiKey & Face ID to authenticate:

https://williamlam.com/2025/01/passwordless-login-to-vcenter-server-or-vmware-cloud-foundation-vcf-using-apple-face-id-or-yubico-yubikey.html

As long as your RADIUS Server has OAuth2/OIDC support, then it'll work but as mentioned above, only the officially listed IdPs today are officially supported but you can see from https://williamlam.com/tag/oidc it works with any OAuth2/OIDC compliant IdP 

------------------------------
----
William Lam
https://williamlam.com/
------------------------------

[Guillermo Argañaras]

Hi William.
It's a pleasure interacting with you, very well-known in our field! Thanks for the response.
Well, then, knowing that these are the only approved IDPs, I can check with the client to see if Radius accepts OAuth 2.0 as the authorization protocol and OIDC as the authentication protocol.
Thank you very much, W. Lam!

[WuGeDe]

@William Lam
here is another one for your list:
http://vbrain.com.br/index.php/2022/05/01/configuring-2fa-two-factor-authentication-in-vcenter-using-duo-proxy-providing-for-example-azure-ad-as-an-identity-provider/
https://www.virtualizationhowto.com/2021/12/easy-vcenter-server-two-factor-authentication-without-adfs/

https://youtu.be/q-7ee2tJAQo

I think DUO is not yet mentioned in your collection. :-)

And there is? also a TAM lab:
https://blogs.vmware.com/professional-services/2022/06/tam-lab-enabling-mfa-in-vsphere-7.html


Cheers

[William Lam]

Duo is a hosted IdP, I'm primarily focused on self-hosted :) 

But hopefully the point being is that any OAuth/OIDC-compliant IdP will just "work" 

------------------------------
----
William Lam
https://williamlam.com/
------------------------------

[Guillermo Argañaras]

Thank you, dear William!