vSphere Single Sign-On (SSO) provides secure authentication and authorization services for VMware Cloud Foundation components, including vCenter Server and Platform Services Controller (PSC). In a consolidated architecture deployment of VMware Cloud Foundation, the vSphere SSO configuration is shared across all the workload domains.

To ensure that subsequent workload domains can use the same identity sources as an external identity source registered in a consolidated architecture, the administrator needs to replicate the vSphere SSO configuration. This can be achieved by configuring the same identity sources for vSphere SSO across all the workload domains.

Configuring IWA (Integrated Windows Authentication) or LDAPS (Lightweight Directory Access Protocol over SSL) as an identity source is a part of configuring the vSphere SSO configuration for identity sources.

Keeping the pre-configured defaults does not guarantee that the subsequent workload domains will use the same identity sources as the external identity source registered in a consolidated architecture.

References:

VMware Cloud Foundation Operations and Administration Guide: https://docs.vmware.com/en/VMware-Cloud-Foundation/index.html

VMware vSphere Security Guide: https://docs.vmware.com/en/VMware-vSphere/7.0/vsphere-security-guide.pdf

To ensure that any subsequent workload domains can be accessed using the same identity sources, it is necessary to replicate the vSphere SSO configuration across all the workload domains in a consolidated architecture deployment. This can be achieved by replicating the vSphere SSO configuration between the primary and additional SDDC Manager instances. This ensures that all the workload domains registered with the SDDC Manager will be able to consume resources and services from the same identity sources without any additional configuration in each individual workload domain.