multiple vcenters - single sso or multiple sso

[tdubb123]

I got 3 vcenters all located in different geographical sites. Is it best to create 3 different sso domains or just one?

If I do just one, then my psc will have to be located in just one site?

can i do a sso domain (vsphere.local) across all 3 sites and have them replicate?

[npadmani]

it best to create 3 different sso domains or just one?

Enhanced Linked Mode lets you view and search across all linked vCenter Server systems and replicate roles, permissions, licenses, policies, and tags. Do you want this, then go for Enhanced Linked mode, which is having one SSO domain and multiple PSCs talking to it. In short when first PSC deployed, new SSO domain got created, from second instance onwards just point it to existing SSO domain. If you create different SSO domain per site, you don't have Enhanced linked mode.

if I do just one, then my psc will have to be located in just one site?

if you do just one SSO domain, No, your PSC doesn't need to be located at one site. I would go with per site at least 1 PSC deployment, may be more for higher availability and load balancing.

can i do a sso domain (vsphere.local) across all 3 sites and have them replicate?

First instance PSC deployment at Site 1, you create vSphere.local as your SSO domain, now at Site 2 and Site 3 when you deploy PSC, don't create domain but join existing vSphere.local domain, this will satisfy Enhanced Linked mode requirements and those multiple site VMDIR will be synching.

[tdubb123]

Thank you. it makes sense. will give it a try. Is there a "master psc" within the sso domain? After I setup another site to join the sso domain and I decide to add a third, do i make it join the first PSC or either existing psc will do?

[npadmani · Accepted solution]

when you deploy third PSC, to join existing SSO domain, either of existing PSC hostname will do. No such concept of master PSC host here.

[tdubb123]

I was able to see enhanced linked mode only by logging in via the web client. but not the thick client. Is this by design?