How to configure Teleport App service for VMware vCenter web UI?

[furrnace]

I would like to access the web UI of vCenter through Teleport. I always get [400] An error occurred while sending an authentication request to the vCenter Single Sign-On server - An error occurred when processing metadata during vCenter Single Sign-On setup: the service provider validation failed. Verify that the server URL is correct and is in FQDN format, or that the hostname is a trusted service provider alias. when trying to access.

In theory one can edit the domain name hat vCenter is using, but that is a risky thing to do, as you might lose access to your vCenter and need to rebuild from ground, not a fun exercise.

I have already tried to get this to work with support from Teleport staff on the Teleport Slack. I did not get a solution from there.

If someone got that to work I would be happy to see the configuration for Teleport. This is what I have now:

- name: "vcenter"
    insecure_skip_verify: true
    uri: "https://vcenter.ex.com"
    rewrite:
      redirect:
      - vcenter.ex.com
      headers:
      - "Origin: https://vcenter.teleport.ex.com"
      - "Host: vcenter.teleport.ex.com"

[rcaballo]

Any update here?
I am interested too about how to integrate Teleport and vCenter.

[webvictim]

It seems like vcenter is using some kind of single sign-on procedure which expects requests to originate from vcenter.ex.com rather than vcenter.teleport.ex.com. The only way to make this work is likely to be to alter the vcenter configuration to accept vcenter.teleport.ex.com as an SP URL instead of vcenter.ex.com.

If you take a backup of the vcenter install and configuration before doing this, it should be possible to restore if needed.

[rcaballo]

Could you write some steps how to do that, or at least point to the documentation?
Thanks.

[Roiki11]

After looking into this issue myself I've found this KB from vmware that should solve it. Though I haven't been able to test it myself with teleport it does work with shorthand urls and should allow you to set the teleport provided url as allowed one.

https://kb.vmware.com/s/article/71387

[tenaciousdlg]

https://knowledge.broadcom.com/external/article/318196/400-an-error-occurred-while-sending-an-a.html

Looks to be the updated link

[matjazp]

Btw, it works with standalone hypervisor GUI (direct connection to ESX).

[furrnace]

Yes it does, but I need to work on vCenter, not on the ESXi UI.

[rcaballo]

yeah, ESXI servers should always be accessible only by vCenter for security reasons.

[furrnace]

this, and if you work the ESXi UI directly instead of accessing the host through vCenter you might mess up the vCenter database!

[savv3]

I've been struggling with getting this working. The accepted answer seems to be the key, but even with that set, I cannot get it working. Getting HTTP Status 400 – Bad Request.
Could someone please share a working teleport config
Thanks!

[Roiki11]

The uses saml for internal authentication. Using the above host header causes vcenter to try and find the saml endpoint from the wrong place, where the teleport cluster is. For me it seems this url needs to be the same as the vcenter instance itself.

If you change the host header to the vcenter internal address, login works as expected. However the url teleport then attempts is the internal url of vcenter. And if you use dns to redirect internals urls to teleport proxy, teleport doesn't allow it.

Not sure if the host header is strictly even necessary in this case.

But one other point is that vcenter doesn't use this for its internal urls. So download links do not work without pointing them to teleport.