|Manuals

VMware vSphere

Thinfinity® Cloud Manager connects to VMware environments through vCenter Server, using a service account with the minimum vSphere privileges required to manage virtual machines. This article documents the Cloud Manager credential form for VMware vSphere, the minimum vSphere privileges, and common configuration errors.

Info

Our Cloud Manager connects to vCenter Server — not directly to individual ESXi hosts. All VM management operations are routed through the vCenter API (VMware vSphere API / REST). Direct ESXi host connections are not supported.

Info

All API calls from Cloud Manager originate from the Thinfinity® Workspace server. Ensure outbound HTTPS (port 443) is open from that host to the vCenter Server IP or FQDN. See Prerequisites for the full network requirements.

Prerequisites

Before adding VMware credentials in Cloud Manager, the following must be in place on the vSphere side:

  • vCenter Server is deployed and reachable from the Thinfinity Workspace server (HTTPS, port 443 by default).
  • ESXi hosts are managed by vCenter and contain the target VMs.
  • A dedicated vSphere service account exists for Cloud Manager. Cybele Software recommends a dedicated SSO user rather than the built-in administrator@vsphere.local account.
  • A custom vSphere role exists with the privileges listed in Minimum vSphere Privileges below.
  • The role is assigned to the service account on the target Datacenter or VM Folder, with Propagate to children enabled.
  • The vCenter Server SSL certificate is either trusted by the Workspace server, or you are prepared to use the Allow Unverified SSL option (not recommended for production).

For how to create SSO users, custom roles, and permission assignments, refer to the vSphere Security documentation.

Minimum vSphere Privileges

The custom vSphere role must include the following privileges, grouped by category.

Category Privilege Required For
Virtual machine Interaction > Power On All operations
Virtual machine Interaction > Power Off All operations
Virtual machine Interaction > Reset All operations
Virtual machine Interaction > Suspend All operations
Datastore Browse datastore All operations
Global Cancel task All operations
Virtual machine Provisioning > Clone virtual machine VDI/DaaS Models only
Virtual machine Provisioning > Deploy template VDI/DaaS Models only
Virtual machine Config > Add or remove device VDI/DaaS Models only
Datastore Allocate space VDI/DaaS Models only
Network Assign network VDI/DaaS Models only
Resource Assign virtual machine to resource pool VDI/DaaS Models only
Info

For Managed VMs only (no provisioning of new VMs), the privileges marked “VDI/DaaS Models only” can be omitted.

Authentication Method

Cloud Manager authenticates to vCenter with a vSphere SSO username and password. Other authentication mechanisms — vCenter Identity Provider federation, smart card authentication, certificate-based SSO — are not currently supported. Always create a dedicated SSO user with a password for Cloud Manager.

Add the Credentials in Cloud Manager

  1. In Cloud Manager, go to Credentials and click + New.
  2. Select VMware vSphere as the provider.
  3. Fill in the fields below and click Save.

For the full Add / Edit / Delete procedure, see Managing Credentials.

VMware Credential Fields

Field Description
vCenter Host The hostname, FQDN, or IP address of the vCenter Server (e.g., vcenter.example.com or 192.168.1.10). Do not include https:// or a trailing slash.
vCenter Port The HTTPS port on which vCenter listens. Set to 443 for a standard vCenter installation, or to the actual port if vCenter is configured on a non-standard port.
User The vSphere user in domain\username or username@domain format (e.g., vsphere.local\svc-thinfinity-cm).
Password The password for the vSphere user.
Allow Unverified SSL If enabled, Cloud Manager skips SSL certificate validation for the vCenter connection. Only enable this in isolated, fully trusted networks. In production environments, use a valid, trusted certificate on vCenter.
Warning

Enabling Allow Unverified SSL exposes the connection to potential man-in-the-middle attacks. This option should only be used in isolated lab or development environments. For production, configure vCenter with a certificate signed by a trusted CA and leave this option disabled.

Verification

After saving, Cloud Manager validates the credentials by connecting to the vCenter API and listing the VM inventory. If validation succeeds, the credential status shows as Ok.

Common Errors

Error Likely Cause Resolution
Cannot complete login due to incorrect credentials Incorrect username or password. Verify the credentials in the vSphere SSO configuration. Ensure the domain prefix matches (e.g., vsphere.local\username).
Permission to perform this operation was denied The service account lacks one or more required vSphere privileges. Review the role’s privileges against the Minimum vSphere Privileges table.
SSL certificate verification failed The vCenter SSL certificate is self-signed or untrusted. Install a trusted certificate on vCenter, or enable Allow Unverified SSL in non-production environments.
Connection refused / timeout vCenter is unreachable on the specified host and port. Verify network connectivity from the Workspace server to vcenter-host:443. Check firewall rules.
VimFault: InvalidRequest The vCenter Port or Host value is malformed. Ensure no protocol prefix (https://) is included in the vCenter Host field.

Security Recommendations

  • Never use the vCenter administrator account (administrator@vsphere.local) for Cloud Manager. Always use a dedicated service account with the minimum required role.
  • Use a CA-signed certificate on vCenter Server to avoid the need for the Allow Unverified SSL option.
  • Scope permissions to a specific datacenter or folder rather than the root of the vCenter inventory, to limit the blast radius if credentials are compromised.
  • Audit vCenter activity using the vSphere Events and Tasks log, filtering by the Cloud Manager service account.

See Also