vCenter administrator as an SSO administrator

Similar Questions

• Get smashed on vCenter 5.1 Setup SSO

  VMWare experts,

  Get smashed on the vCenter 5.1 Setup SSO and I was wondering if I could get assistance.

  That's what I've done so far:

  1.) Execute the "rsaIMSLiteMSSQLSetupTables.sql".

  2.) change only the part "C:\Changeme" of the script that has been 'C:\Program Files\Microsoft SQL Server\MSSQL10_50.SQL2K8R2\MSSQL\DATA '.

  3.) Execute the script that creates a database named RSA

  I then went to vCenter install Simple which began by installing the SSO, I set myself on.

  Under Database Type: I chose MSSQL:

  I paint a white following the syntax remaining fields.

  The names of the affected servers are:

  Name of the SQL Server: TEST - SQL01.test.local

  Named instance of SQL: SQL2K8R2

  vCenter Server: TEST - VC01.test.local (where I install the SSO, inventory service, etc.)

  No idea on what to set for name of database, Windows, JDBC URL, authentication etc.

  I tried to follow the installation guide and there was no mention of whether I needed to implement ODBC connections or something like that.

  Any help would be greatly appreciated.

  Of course, I'll be happy to help you, Tony!  Of course, I thought the vSphere 5.1 Setup Guide and was a little kludgy SSO, too.

  Assuming that you already had a MSSQL DB taken in charge and install SSO on another virtual Windows computer or server (SSO vCenter separation is a best practice), here is what I recommend to you present to SSO with a database of MSSQL remote (not a local MSSQLEXPRESS).

  Note: Your Windows SSO server does not belong to an AD domain at this point because you can combine SSO with AD al later through the Web Client of VirtualCenter, but if she is joined before running the installation of SSO, it will save you this step.

  While there may be other methods supported to install SSO, here are the basic steps that worked for me:

  • Locate the rsaIMSLiteMSSQLSetupTables.sql on the installation of vCenter 5.1 ISO ([drive]: \Single Sign On\DBScripts\SSOServer\schema\mssql\) and double-click it in the MSSQL Server, which will open in SQL Management Studio for editing running.
  • Change the paths of the three[C:\CHANGEME\...] in the SQL script with the file appropriate to your DBs & Trans newspapers railways.  In my case, I put the DB and indexes on D:\MSSQL\DB and on E:\MSSQL\LOGS newspapers
  • Run the script, and if all goes well, he will create a RSA in MSSQL database and successfully complete
  • [IMPORTANT] Right-click on the top level of SQL Server icon and select Properties, select Security and select Windows and SQL Server authentication mode (it is now a requirement of VMware as indicated on page 241 of vSphere 5.1 Setup Guide and) and click OK.
  • Restart MSSQL & Agent of Service for this setting to take effect.
  • Create a new SQL user account (i.e. sso) in MSSQL Server-> Security-> connections in the hierarchy of SQL Management Studio (make sure that the account does not require that you must change the password during its first connection) and give it to the server role SYSADMIN and dbo in the DB of RSA under mapping of users, click OK.
    • Note: You can avoid running the other SQL 'users' script mentioned in thevSphere 5.1 Installation Guide and for creating user SSO if you do this step and let the SSO installation program create the necessary users to the site.
  • Sign in to your soon SSO Windows server as administrator
    • Note: Ensure that your Windows server is properly would be hostname, IP would be, with before and would reverse DNS synchronization and clocks.  See the documentation for the other terms, if necessary.  You can join an AD domain if you want right now.
  • Start the program installation 5.1 SSO to the ISO 5.1 vCenter vCenter.
  • Create a main node for SSO (assuming this is your first), click Next.
  • Select to create the head for a new Single Sign-On installation vCenter node (which you can later), click Next.
  • Enter a master password that you want to use for SINGLE sign-on, click Next.
  • Select use an existing supported database, click Next
    • Note: Because SSO uses JDBC, there is no need to create an ODBC System DSN for SSO.
  • Enter RSAin the database name field, enter your MSSQL Server's FULL domain name in the field name of host or IP address and, finally, enter sso (from my example above) the database username and the password you created, click Next.
    • Note: nothing else on this page must be changed
  • Fill in the name of the SSO (not the IP address!) server FQDN, click Next.
  • Keep the box using network service account, click Next
    • Note: Given that I had really no specific guidance on the use of a service with SSO account, I just went with the default for now.  Perhaps in the future I will use a service account, but given the SSO is somehow independent AD I thought to go with a choice course and do not a service account AD which can be revoked if SSO is seconded of this announcement in the future.
  • Select your preferred installation folder, click Next.
  • Keep the port by default, click Next.
  • Click on install!

  SSO should install correctly and to create user accounts appropriate SQL called RSA_USER & RSA_DBA.

  • Disable or remove the sso SQL Admin account you created as it is no longer necessary once the SSO is installed.

  Then, to install the Service to vCenter inventory where you want as well as the vCenter Server and Web Client (i.e. separate VMs)

  Tip: You can only connect to vCenter 5.1 by using a local administrator (Windows) via vSphere Client 5.1 account.  To establish the rights vCenter to administrator in a Windows/AD user account (assuming that SSO was associated by AD), first open a session in vCenter (via vSphere Client 5.1) using admin as username and the SSO master password , you created during the installation of SSO.  Which will take you in and you can make adjustments if necessary permission.

  Before that I'm totally flamed for what others might offer as a way of more refined for SSO rose, I realize VMware offers a few different implementation approaches and perhaps best practices will emerge in the coming months.  My intention was to share my success with Tony in SSO getting online and I hope this helps other people faced with this new service of vCenter.

  Please do not hesitate to comment on everything that you feel could be improved with these general installation steps or let me know how it worked for you.

  -Matt

• Connection of SSO authentication test only allows to vCenter administrator

  I'm vCO 5.1.1 with SSO configuration.  I am able to register Orchestrator using SSO registration - basic Mode; However, in the Configuration of SSO part, I am unable to save settings for a vCO Admin group I select it is a domain group.  While I can find the group using the group filter, when I click on "Update Orchestrator Configuration", the selected group of changes made to a local group on the vCenter Server system.  If I apply a local group as the vCO Admin as the Administrators group local to vCenter Server, and then test the connection by using the credentials of one of the members, the authentication fails: "subject of credentials are not valid."  The only credential that authenticates is built-in the vcenter Server system administrator account.  This prevents me to connect the customer to the vCO.  What could prevent the members of the group to be applied as vCO admins?

  The solution was double:

  1 can't use nested as vCO Admins groups.  I made a field of the CVO group Admins, but the Group was a group nested as a member.  All members of the domain group should be individual users.

  2. authentication SSO requires the full name in the login: [email protected]

  I also made sure my domain name has been listed as one of the default fields in the configuration of SSO.  Once I restarted the service configuration and the vCO Server service, I could successfully connect on the client of the vCO.

• Account domain for vCenter administrator install?

  Most of the people ask for some type of account 'service' to use for installing vCenter? Should I ask on this account domain administrator privileges?

  Should I also use this account to the SQL DB vCenter?

  Hello.

  Most of the people ask for some type of account 'service' to use for installing vCenter?

  It depends on what type of SQL authentication you will use. "The Server vCenter installation wizard gives you the ability to use the Windows system account or an account specified by the user for the purpose of execution of vCenter Server. The main reason to use a specified user account is to allow the use of Windows for SQL Server authentication. '- Ko 1009080

  Should I ask on this account domain administrator privileges?

  If you are using a Windows account, no. If you choose the Windows account option:

  -The account specified by the user must be an administrator on the local computer and the law as part of the operating system and login as a service rights.

  -You must specify the name of the account as domainname\username in the Server vCenter installation wizard.

  -You must configure the database SQL Server to allow the domain account to access SQL Server.

  List of Ko 1009080

  Should I also use this account to the SQL DB vCenter?

  It really comes down to whether or not you're going to use Windows or SQL authentication to the database.  If you a SQL database with Windows NT authentication, you cannot use the SYSTEM account for vCenter service to run in.

  Good luck!

• VCO 5.5 on vCenter 5.0 installation (SSO)?

  Hello

  We lack vCenter 5.0 Update 3. We were assigned to installing vCenter Orchestrator. Preference version 5.5.

  I have read a lot on the subject. SSO is quite often mentioned, but we have to 5.0... Is it possible to install it without SSO?

  Thank you in advance.

  / Pete

  Yes, you can install vCO using LDAP authentication.

• vCenter 5.5 and SSO multimaster device

  Dear guys,

  I think the move to vcenter 5.5 but I can't find a clear statement that I can deploy many appliances in version 5.5, but what all SSO vcenter?
  can I keep SSO built appliances and all the multimaster configuration?

  multimaster replication between VCSA is currently not supported. William Lam wrote an article concerning the replication multiaster SSO between Windows Server vCenter Server and a http://www.virtuallyghetto.com/2013/12/hybrid-environment-leveraging-sso-multi.html VCSA but it's too not a configuration supported for the moment.

• vCenter for lack of SSO and no. log in the same root not

  Hi guys

  A journal of issues was announced today and I tried with my AD credentials to log my vCenter device 5.1 (build 880146). No go.

  Tried with root credentials. I couldn't either.

  So lucky me I found a loged in as Web client session yesterday I'm gone my SSO config I showed me this

  

  then I went to vCenter Web Config and tried to restart the server and still the same issue

  

  So at this moment I don't really know what has failed if was SSO or vCenter Server Service... so any idea that to find the cause?

  -updated

  Hey guys I found this/storage/sore we full-no idea how to avoid this problem?

  Size of filesystem used Avail use % mounted on

  / dev/sda3 9.8 G G 4.2 5.1 G 46%.

  udev 4.0 G 104 K 4.0 G 1% / dev

  tmpfs G 4,0 4,0 G 0 0% / dev/shm

  / dev/sda1 128M 21 M 101M 17% / Boot

  / dev/sdb1 20G 20G 100% 0/storage/core

  / dev/sdb2 20G 3.2 G 16G 17% / storage/log

  / dev/sdb3 it 20G 15 G 4.4 G 77% / storage/db

  Thank you very much

  the kernel contains the dump files... If you don't need those... Delete them... you can also take a look at this thread to have a store NFS to store the unannounced dumps core.

  http://communities.VMware.com/thread/403107?start=0&TSTART=0

  Concerning

  Girish

• Problem with vCenter 5.1 (W2K8) & SSO without AD

  Hi all

  I have problems with my first experiences with vC 5.1 / SSO. I have a virtual machine running W2K8 + DNS but no ads. This is what I want and need. 5.0 had no problem with that, but in 5.1, I can't make everything work.

  Installation of SSO, the inventory service and vC (all 5.1), all this hard work and all the Associates services start. However, when I then restart the virtual machine, the vC service does not start, start services very well but no vC. It all started at the session of runtime install, but not after the restart of a virtual machine. By default use SQL Express installation options dbs SSO and vC have been taken.

  vpxd.log has a relevant error of:

  "Failed while trying to connect to the SSO Admin Server: no connection could be made because the target machine actively refused it.

  DNS is all right, forward and backward. Despite the warning (attachment), SSO is happy to install without this AD.

  I don't understand why vC post install but then fail to start after reboot.

  Surely the vC (Win) 5.1 is not having to be in an AD domain?

  What Miss me?

  Thank you and best regards,

  Mac

  I did a few more tests to prove the change the start mode of services could solve the problem.

  Today I install VC with simple installation.
  After installation completed, before the reboot, take a sanpshot of the virtual machine.
  Restart the VC, Vcenter service failed to start as usual.
  Then go back to the snapshot before restarting immediately after installation.
  And changed the start mode of service,

  vCenter single sign on Service - automatic (delayed) automatic
  VMware vCenter Inventory Service - automatic Automatic (delayed)
  VMware vSphere Profile - Driven Storage Service - from Automatic Automatic (delayed)
  VMwareVCMSDS - from Automatic Automatic (delayed)

  then restart VC.
  Services started normally vCenter.

  If the sequence to start the service really matters!

• vCenter Server 5.1, SSO and Service of the inventory on a single server?

  It is said in articles vmware all 3 roles can be installed for small deployments on a server with enough hardware requirements (2 hearts and 10 GB of RAM and hard drive 100 GB recommended).

  Question is what is considered to be low?

  Can I install all 3 roles on a server for lets say 14 guests and about 200 virtual machines?

  If I have 3 vCenter servers I'd better install all 3 roles on each of the 3 servers. or have a SSO or SSO HA for all vCenter servers?

  The problem is that we want to separate the vCenter by area.

  A big thank you!

  Yes, you can install all 3 roles on onse Server. We installed it on a virtual machine with 8 GB of RAM, 100 GB HD and 4 CPU.

  For the decision on wheter to install all 3 roles on 3 vCenter servers, I recommend you to read the next page.

  http://KB.VMware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalID=2032135

  If I should make the decision, I separate completely all 3 areas and thus install 3 with 3 roles vCenter servers. But this does not mean you have to do the same thing.

• New vCenter Server install fails - SSO

  I use a new system nested for a lab at home.  I'm under Workstation 9 with the latest version of vCenter.  I have the ms SQL all set up and verified.  The clocks are set to the same time a few seconds apart.  However, during installation when I get to vCenter single sign on Information, he returned with the error:

  Incorrect entry - a command line argument is wrong, a file is not found or the spec file does not contain the required information or the clocks on the two systems are not synchronized. Check vm_ssoreg.log in the temporary folder of the system for more details.

  I checked the two KB with information about this,

  http://KB.VMware.com/selfservice/microsites/search.do?language=en_US & cmd = displayKC & externalId = 2033880

  http://KB.VMware.com/selfservice/microsites/search.do?language=en_US & cmd = displayKC & externalId = 2033875

  and after the steps, I still can't pass it.  Then, I found this blog, http://blogs.vmware.com/kb/2012/09/vcenter-server-5-1-installation-fails-with-a-wrong-input-and-certificate-already-expired-error.html#.UWZSkJOThyI and reading, I get the assumption this isn't a big deal, however, I still can't complete the installation until it is fixed, at least as far as I know.

  I'm pretty new to this forum and to implement vmware but learn a lot, but this one left me speechless right now.

  Reflections on how to solve this problem, other things to test, etc.?

  David Seaman playing excellent series of blog on the configuration is

  http://derek858.blogspot.com.au/2012/09/VMware-vCenter-51-installation-part-1.html

  Michael Webster on his blog also has a great serise on certificates

  www.longwhiteclouds.com

• Local administrators on Windows of vCenter server is automatically granted 'Administrator' role in vSphere

  
  This still applies (5.0 and 5.5).  I might have missed in the 5 documentation site.  I see still ESX Admin workaround applies to 5.5 and wondered about the role of local administrators.

  VMware vSphere 4 - ESX and vCenter Server

  
  It's the 4.0 site doc.

  "Host records all selected Windows domain user, or a group through the process of assigning permissions." By default, all users who are members of the local windows Group istrators Adminthe vCenter Server have the same rights of access as any user assigned to the Adminsector role. Users who are members of the group Administrators can log on as individuals and have full access. »

  EDIT - I found this... VMware vSphere 5.1

  Seems to be the same... :))

  The main difference is that before 5.1 and 5.5, the local Administrators group on the server vCenter Server is the default vCenter Server Administrator. With vCenter 5.x with the addition of SSO, installing vCenter, you will be asked which user account or the group will be initially given and vCenter Server Administrator role. Here is the screenshot. This screenshot, after installing vCenter, only the [email protected] has the role of administrator on the vCenter server.

  

  If you upgrade your server vCenter to 5.x since a previous version using a Simple installation, if I remember correctly, you won't see the screen above as the installation will use the existing as the vCenter Administrator local Windows Administrators group.

  It will be useful.

• Display Administrator 5.2 horizon

  I'm trying to set up another Horizon view 5.2 Administrator.  In this case, I use an Active Directory group instead of a specific AD account.

  The new Director, I work with is able to make changes to the view, but as soon as he tries to spin out a new Pool of Clone-related, it gets an error: 'error commissioning occurred on pool < name-pool-here > because frree available on the disc is reserved for related clones.'

  When I do the exact same function with the same exact settings, the pool is created.

  Question: Other than the configuration of accounts (evident) in the GUI to view (it is configured as an administrator at the level of the root), the permissions that are necessary in both AD and vCenter to allow this new person administer the view entirely?  (If you come back with RTFM, I'll find you and track down you... I did this for 2 days now and not find anything in the books, except for the settings for the service accounts required for view to talk to vCenter, connection and security servers (which are all very well, thankyouverymuch):-P)

  Exasperated

  Quick question...

  Which option you selected when adding the new administrator in the user interface?

  -Select one or more files and click Next.

  -Select the root folder, and then click Next.

  The new user should all other permissions outside the display administrator UI as view interacts with vCenter using the vCenter administrator and composer interacts with vCenter with the user of the composer. These are the users who require permissions.

  See you soon,.

  JesusM

• Can't see vsa on the client Manager vcenter web

  Hello

  VSA, I installed on my system vcenter 5.5, but I do not see the Manager tab of vsa on any of my client screens web vcenter.

  I tried to follow the instructions to enable it, but they do not match what I see:

  on the 5.5 documentation page (ESXi and vCenter Server 5.5 Documentation > vSphere storage > vSphere Storage Appliance > troubleshooting a Cluster VSA) it says in step 2:

  "From the homepage of the vSphere Web Client, click Administration and click management plug-ins under Solutions."

  The only thing that appears on my admin page to the title of 'solutions' is:

  client plug-ins

  vCenter orchestrator plugin

  SSO admin interface plugin

  vchsplugininstaller

  machine virtual vsphere update manager client web plugin

  journal browser

  vCenter Server Extensions

  Management vServices

  vSphere esx agent handler

  There seems to be no way to turn it on.  Can someone help me?

  Thank you in advance!

  -jason

  Hello

  It turns out that it is "standard solutions" tab: the wizard to configure the thing.  Not in the docs so: support VMware reported it via youtube videos.

• Error nell' sommergibili del vCenter 5.5 knew Windows

  Salve a tutti,

  Oggi ho tried a fare un nuovo su vCenter windows 2008 con remote db on mssql, in version 5.5.

  SSO, WebClient, inventory vanno lisci, quando al vCenter tutto regolare... device arrival Service if my the sferisterio conclude con questa schermata:

  

  Previous passi nel ho scelto di far run vCenter come a when di dominio (che e amministratore di macchina). Guardando nel DB vedo che sono state table create.

  Nel file di log trovo qualcosa di questo tipo:

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_IsService::done Service IS

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_StartService::ServiceName: vctomcat TimeOut: 1200 s.

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_IsServiceRunning

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_IsServiceStatus::serviceStatus: 4

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_IsService

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvcManager

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvc

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_IsService::done Service EXISTS

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvcManager

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvc

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_IsServiceRunning::done Service does NOT WORK

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvcManagers

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvcManager

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvcs

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 OpenSrvc

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Service status: 1

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 IsLocked

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 QueryLockStatus

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 IsLocked::done NOT LOCKED error: 0

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 StartSrvc::NumArgs: 0

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 StartSrvc::ERROR_SERVICE_LOGON_FAILED service can not be written error: 1069

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Res StartSrvc::done: 0

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 failed to start service.

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 Srvc_StartService::vctomcat service NOT STARTED error: 1069

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 StartServices::done ret: 1603

  VMware VirtualCenter-build-1378903: 19/12/13 16:39:26 end of logging

  La cosa «curiosa"e che nei servizi vedo «vmware vcenter webservices...» "che é in automático d not avviato. Provo ad avviarlo dice mi mano e 'connection failure '. Provo a reinserire e password dopo parte...? !

  Rilanciando install works a po' e of che the e completata sommergibili con successo. Pero making connection customer web al non vede in nessun vCenter registrato if.

  COSA sto sbagliando?

  Alfine this feci... ebbene if: is windows when UN used cars by it servizio vCenter HIS word of PAST NON DEVE HOOP CHARACTERS STRÁNÍ. Reed it '-' mi ha dato problemi.

  Stessa regola vale by password dell 'amministratore dell' SSO, ma who at least e documentato.

  Inoltre con 5.5 b viene twice the Source Active Directory Identity (to lo E desiderate is it Server e in UN dominio).

  Pero a difference di quanto accadeva con 5.x, ora e necessario loggarsi nel webclient una prima volta is assegnare e [email protected] i years di amministratore del vCenter agli users desired.

  IO avevo put users nel gruppo directors della macchina e put como Director del vCenter MA NON Spannplatte questo: ho la aggiungerli uno by uno como del vCenter administrator explicitly.

  Attenzione anche alla questioned della versione dell'SQL Native Client: 5.5 a muffa non "schizzinosa" is the version no era identica al db, 5.5 b IF server '.

  Ho visto che gia era Reed is present it DSN, upgrade simply because he Native Client era no sufficiente e falliva ugualmente sommergibili del vCenter: necessario clear e ricreare un nuovo system DSN. Questa cosa possa essere critica quando temo if fanno News: forse if deve creare a new DSN che punti al db esistente e, quando if aggiorna, quello selects TR.

  Inoltre quando installate it VUM ricordatevi che, is non avete ancora added users como del vcenter (loggandosi nel webclient) managers, usare per forza [email protected] when working. Reed's text when Windows con cui gira it servizio prendete picche vCenter.

• SSO allows only local users of OS and not?

  We are small: 3 guests with about 40 virtual machines.  I only need a server to do all my stuff vcenter, and that's how I ran through 4.1.

  I intend to do a simple install, during the upgrade to 5.1.  I'd do it rather _not_ deal with Single Sign-On Donostiarra, adding and according to my Active Directory if I can help it.  Reading of the vSphere vCenter Server 5.1 Upgrade Guide ESXi, around 30-31 pages, it appears I can indeed just use SSO with local users and not need to discover AD at all.  Here again, it is not exactly clear to me.

  Here's what he said:

  Page 30-31

  How vCenter Single Sign-On affects vCenter Server upgrades:

  When you upgrade to vCenter Server 5.1, the upgrade process installs vCenter Single Sign On first, then upgrades vCenter Server...

  In vCenter Server 5.1, so vCenter Single Sign-On is... on a computer that is joined to an Active Directory domain, Single Sign-On will automatically discover the existing Active Directory domain and add it as a source of identity for the process of installing Single Sign-On. If the Single Sign-On is not running on a virtual machine or physical machine that is in the same domain as Active Directory, you must use the vSphere Web Client to connect to vCenter Server and add the Active Directory domain to single SignOn.

  If you install vCenter Single Sign-On and vCenter Server on the same physical or virtual computer, Single Sign-On recognizes existing users of local operating system. After the upgrade, you can connect to vCenter Server with a local operating system user ID.

  In vCenter Server 5.1, the term ' OS local users "refers to users the machine host Single Sign-On instead of the host to vCenter Server or virtual machine. After the upgrade, so no super Admin does (the administrative user or group for the root folder), you must provide a valid user or group as a super administrator during installation.

  So I can just be local admin user on my server vCenter Server, install the SSO, then the rest and make?  No need to attach the AD?

  PS: my current vCenter 4.1 server is indeed a member of our AD (Windows Server 2008), but it's mostly just do WSUS and others.  I do not AD require otherwise.

  TL; Dr: Yes your assumption is correct, local users are working with SSO, it is not necessary for users of the AD.

  long version:

  I would still install it as a domain user, if Autodiscover fails, don't bother on this subject. As long as you use install Simple (I rather advise you to install the components one after the other) or install SSO in basic Mode, you will be able to use your local users.

  If you ever decide you need users AD they can always be added at a later stage.

  If you install SSO without using Simple install do not forget to install basic as Multisite mode and Mode HA do not support the local system users.