vCenter Server & vCenter Orchestrator 5.1 integration tips

vCenter Server & vCenter Orchestrator 5.1 integration tips

With installing and integrating vCenter Server/ vCenter Orchestrator 5.1 (vCO) virtual appliances on a regular basis I came up with a standard way of doing it. This differs from the minimum / base installation and integration with adding some additional steps that I think are useful for the person who want to setup a development / test vCenter Orchestrator environment. There are many other ways of doing it and even ways to automate this but this document can definitely help you to get started.


Using the virtual appliance version of vCenter Server & vCenter Orchestrator is a convenient way to set up an Orchestration environment without requiring operating system licenses, IT compliance (i.e Anti Virus, other standard software, updates), maintenance (i.e updates, backup).

  • If you prefer to run vCenter Server & vCenter Orchestrator on Windows (Server, 64 bit, check compatible versions) then this document may not be relevant since vCenter Orchestrator 5.1 comes fully installed, configured and integrated with vCenter when using the Windows based installation of vCenter 5.1.
  • If you prefer to use the vCenter Server & vCenter Orchestrator Virtual Appliances then there are a minimal amount of steps to integrate these that are included in this document as well as optional steps providing further benefits.
  • You can also decide on having a mixed environment (i.e vCenter Server 5.1 on windows, vCenter Orchestrator 5.1 Virtual Appliance). If you do so only some sections of this document will be relevant.

The components:

  • VMware vCenter Orchestrator Appliance 5.1.0
  • vCenter 5.1 Server

The vCO appliance is the core requirement to author and test workflows. It provides the orchestration platform including the orchestration engine, plug-in adapters and their library workflows, a workflow designer.

vCenter Server is required for creating workflows automating vCenter operations and also to provide the vSphere Web client that will likely be used to start these workflows. This last functionality requires using the vCenter Server Single Sign On server.

Other components such as ESXi hosts are necessary to operate a virtual infrastructure but are out of scope for this document.

For orchestrating vCloud Director, vCloud Director (1.5 or 5.1) and vCloud Director plug-in for vCO (1.5 or 5.1) are required.

The goal of this tutorial is to deploy a vCenter Orchestrator demo / test / development environment setup with your own credentials.

The demo licenses are valid for 60 days. These can be replaced by purchased licenses (Need at least Standard license level to be able to edit workflows).

Installation & configuration instructions

Import the appliances in either vCloud Director, vCenter, Workstation, Fusion.

Depending on which of these you use you may have the option to set them up with a static IP address. You should do so since this is a both ways integration and an IP changing because of an expired DHCP lease will break the integration and will require fixing it manually. If you do not have the option we will handle this later as an optional step.

If you are on an older version you may not be able to import an OVF file directly. If this is the case use the freely downloadable ovftool (Documentation & product download)

Synchronize the time on the virtual appliances

Since the integration relies on the Single Sign On feature it is really important that the VMs times are synchronized. Single sign on authentication fails when the VM authenticating time is drifting too much from the time on the SSO server.

This step is optional but recommended if the VMs time are not synched (type date in the command line).

There are different ways to accomplish this the easiest one I have found is to add this line to the vCenter Server and vCenter Orchestrator appliance  .VMX file

tools.syncTime = "TRUE"

If the VMs run on different hosts that may not be time synchronized and if the VMs have access to the internet another way is to use a NTP server. To do so log in the appliances (user = root, password = vmware), edit the /etc/ntpd.conf (for example using vi) and add the following lines


Start the vCenter VA.

If you did not setup a static IP & host name before it is recommended to do it before the first appliance configuration, otherwise go to the vCenter VA first configuration section

Set a static IP Address and a hostname

This is an optional step. Using static IP addresses is not required but recommended to avoid loosing the vCenter Server / vCenter Orchestrator both way integration.

In the VM console press <Enter> to log in.

Log in as root / vmware and start yast.


Use the cursor keys to select the network settings.

yast - network settings.png

Use the tab key to edit the network configuration.

yast - edit network.png

Use the tab key to get to "Statically assigned IP Address". Use the space bar to select. Enter your IP Address, subnet mask and hostname. Use the tab key to get to [Next]

yast - set IP.png

Use tab and the cursor key to get to Hostname / DNS and set these. Once done use tab to get to [OK]. yast will save the configuration changes. You can now use tab to get to [Quit].

vCenter VA first configuration

This step is mandatory. It can be automated following this tutorial.

Open a browser on https://IP_ADDRESS:5480. Authenticate with root / vmware

vCenterVA config login.png

The EULA will show up. Accept it and click next.

vCenter VA EULA.png

On the next screen come an interesting note:

vCenter VA Static IP warning.png

I tried that but did not find out how to relaunch the wizard as it seems that as soon as you accept the EULA a variable is set in the server for not restarting the wizard. There is definitely a way to reset this variable but since we have already managed the IP & hostname change we can move on anyway.

Use the "Configure with default settings"

Keep embedded for Database & SSO settings.

Click Next and then Start
Wait it completes or better have a small break.

Create vCO user, group, role and permissions

This step is optional since the vCenter Server Appliance is coming with default root & admin users but recommended so you can authenticate with your own username to create and operate the workflows.

Since vCO will be using vCenter SSO we have the option to create a specific vCO user and group with administrator role and permissions on the vCenter server objects. For this we will use the default System Domain identity. It is possible to add other entities such as Active Directory Domains but is out of scope in this document.

Log in the vSphere web client: https://IP_ADDRESS:9443

vSphere Web Client Login.png

Browse to Administration / Access / SSO Users and Groups
In the Users tab click on the + icon to add an user.
Fill the fields and select Administrator user. Click OK.

SSO New User.png

In the Groups tab click on the + icon to add a vcoadmins group. Click OK.

SSO New Group.png

Select vCO Admins click add principal (the icon with a + and a character).

SSO Add principals 1.png

Add your user and root (Search for your user in System-Domain and root user in localos identity source).

SSO Add principals 2.png

In home / venter / vCenter Servers / your venter Server name select Manage tab and then permission tab
click + to add a permission
Click add.

Select System-Domain
Select vcoadmins and click add and OK.

vCenter VA permissions 1.png

To assigned role select administrator. click OK

vCenter VA permissions 2.png

vCenter Orchestrator Configuration

This step is mandatory. This is the one that provides the vCenter Server to vCenter Orchestrator bidirectional integration.

Start the vCO VA.

Once started follow the "Set a static IP Address and a hostname" section.

Open a browser on https://IP_ADDRESS. This will get you to the vCO greeting page.

vCO VA greeting page.png

Click on the "Orchestrator Configuration" link.

Authenticate with vmware / vmware

vCO VA configuration 1.png

Once you click on Login you will have to enter & verify a new password.

vCO VA configuration 2.png

Click "Apply changes"

On the left section click on the Startup Options Tab. Click on Stop Service.

vCO VA Stop Service.png

The vCenter Orchestrator Appliance is configured to run stand alone. We are going to change its settings so it can use vCenter SSO for authentication and configure the vCenter Server plug-in.

First in the network tab Change the default IP ( to the one you set for vCO. If you did set a host name it will show up in the DNS name field.

vCO VA network config.png

Click on "Apply changes"

Now we need to import the vCenter Server and vCenter SSO certificates. Click on the SSL Trust Manager tab.

In the URL from which to import a certificate enter the IP_of_the_vCenter_Server:443

Click import. This will display the certificate. Click on the import link.

Repeat the operation on IP_of_the_vCenter_Server:7444

Your SSL certificates should look like this:

vCO VA SSL certificates.png

On the left section click on the Authentication tab. You will see that as default the vCO VA is configured for the local LDAP server. Change Authentication mode to SSO Authentication. Enter the IP of the vCenter VA and the root / vmware credential. Click on "Register Orchestrator"

vCO VA SSO Authentication.png

You will be greeted by a

The Orchestrator solution user is registered. You must complete the SSO configuration.

To do so in the "vCO Admin - domain and group" select "SYSTEM-DOMAIN vcoadmins"

As you can see clock tolerance is set to 300 seconds. This should be fine since we synched the two VMs time previously.

vCO VA SSO Configuration.png

Click on Accept Orchestrator Configuration.

On the left section click on the Plug-ins tab. We need to provide a vCO admin user to install the plug-ins when the vCO server will be restarted. Use the user previously created in vCenter SSO. Then we need to enable the vCenter Server plug-in. Check it. Click on Apply changes.

vCO VA Plug-ins config.png

On the left section click on the vCenter Server (5.1.0) tab. Click on the New vCenter Server Host.

Enter the IP of the vCenter host. You can use "Share a unique session" if you want all the operations on vCenter to be performed as the user you provide or use a Session per user if you want to authenticate in vCenter as the user that will authenticate in vCO. In this case you still have to provide an admin credential for the configuration session. Click on "Apply Changes"

vCO VA vCenter Config.png

In order to make all the configuration changes active and in order to install the vCenter plug-in it is necessary to restart the vCO service.

On the left section click on the Startup Options Tab. Click on "Start Service".

Testing the integration

This section is completely optional. It is a walk through the different components to check everything work as expected.

Open the vCO appliance in a browser and click on the "Start Orchestrator Client" link. This will download a Java web start link (works on Linux, MacOS, Windows). Open the file. Alternatively you can download the client for your platform and install it locally. Enter your vCO IP and your credentials.

vCO VA Client start.png

Install / Ignore the certificate. If you manage to log in it means SSO authentication worked. The next step is to create a workflow. This will prove you are part of the vCO Admins group and that you have the right type of license to author workflows. On the workflow tab Right Click on the workflow tree root and select "Add folder". Name the folder as you want.

vCO Create folder.png

Now right click on the folder and slect "new workflow". Name it "Create Datacenter".

vCO create workflow.png

Our workflow will call a library workflow with changing the workflow presentation to allow this workflow to be used contextually on the vCO inventory. This is called "wrapping" a workflow and is a good alternative to change the original workflow as it permits to have several different versions based on the same one. Also most Library workflows are read only so wrapping them is a good choice and a better one than duplicating the library workflows because you will not benefit from Library workflow updates.

Go on the Schema tab, drag and drop the "Workflow Element from the "Generic" Palette on the left to the blue arrow on the schema.

vCO drop wf on schema.png

Now choose the Create Datacenter workflow version 0.2.0 with typing "create datacenter" in the filter field.

vCO Create Datacenter workflow.png

vCO 5.1 will ask you if you want to propagate the create datacenter input and outputs to your workflow. Click on Setup.

vCO input wizard.png

Just let the default and click promote.

vCO input promote.png

At this point our workflow is doing the same thing as the library "Create Datacenter" workflow. One difference is the presentation properties. To propagate these to our workflow richt click on the Create Datacenter workflow, select synchronize, synchronize presentation.

vCO synchronize parameters.png

Now if you go to the Presentation tab of the main workflow and click on the folder input and on the Properties tab you will see that it is set as a "Mandatory input". If you click on the left icon with the + sign you can add the "Show in inventory" property. This is the one needed to have this input contextual to inventory objects.

vCO show in inventory.png

Click ok, save the workflow. vCO 5.1 will ask you to add to version history. You can click increase version.

vCO save and increase version.png

Now switch to the inventory tab. Unfold the inventory. if it works vCO has access to vCenter. Right Click on the Datacenters Folder and select the Create Datacenter workflow. This will start the workflow you have just created.

vCO create datacenter1.png

The parent folder is already selected. Just enter a name.

vCO create datacenter2.png

Once submited you can reload the inventory by right clicking / refresh on the Datacenters folder. If the workflow completed successfully (meaning you have the right level of permissions to create a datacenter in vCenter) you will see your datacenter and the subfolders.

vCO Datacenter in inventory.png

Now let's check What we have in vCenter. Log in the vSphere web client: https://vCenter_IP_ADDRESS:9443. This time you will log with the user you have created and not with the root account.

vCenter VA log in.png

Now Click on the vCO home. You will be getting to this page. You can see:

  • that you have 1 vCO server registered.
  • the recent Create Datacenter task in the right.

This mean that the vSphere server talks to vCO. Now let's start te workflow we have created.

vCenter VA vCO home.png

Click on workflows. Then in the search field type datacenter. Right click / Run a workflow on the "Create Datacenter" workflow that has no description (it is usually good practice to put your own description)

vCenter VA create datacenter workflow.png

If this is the first time you run a workflow you may be prompted for approving permission for token delegation. Approve & remember decision.

vCenter VA token.png

The workflow will prompt you for Patent Datacenter folder and for a datacenter folder name. vCenter use container folders for each object and hide these in the user interface. vCO display these in the inventory. Click + to set the folder.

vCenter VA create datacenter workflow 2.png

Instead of spending time browsing you can use the filter tab that will list all the datacenter folders. We have a single one. Select it.

vCenter VA create datacenter workflow3.png

Set a name and finish.

vCenter VA create datacenter workflow4.png

Once the workflow is finished you can go to vCenter home and check for the datacenters. You will find the two datacenter created by vCO workflow: one started from the vCO client and one from the vSphere web client.

vCenter VA check datacenters.png

Since you have been reading all of this here is a bonus : If you create a cluster you can right click on it to see all possible actions. At the end you will see "All vCenter Orchestrator actions". There are some vCO workflows that have been set to be contextual to vCenter objects.

vCenter VA contextual workflow.png

If you want to make your own workflow contextual to the vCenter objects you can do so with going in the "Manage" tab of vCenter Orchestrator home.

A workflow can be contextual to a single object or a list of objects of the same type.

vCenter VA add contextual workflow.png

So now you have everything you need to extend vSphere Web client with any functionality you can build in a vCO workflow so basically anything you can imagine.


Great article.

Just want to add to the Synchronize the time on the virtual appliances section:

The best way for me to accomplish time synchronization is

1. Configure all your ESXi servers to synchronize with NTP server:

  • In vSphere select the ESXi host, Configuration tab, Time Configuration, click Properties link;
  • click NTP client enabled;
  • click Options, make sure you select Start and stop with host as a Startup Policy;
  • In the same dialog go to NTP Settings and add all your NTP servers;
  • click Restart service to apply changes;
  • confirm  all dialogs (make sure the time and date in the Time Configuration  dialog is close enough to the real time, otherwise the NTP client will  need too much time to catch up or can even refuse to work).

2.  In vSphere for all your VMs select the VM -> Edit Settings, Options  tab, VMware Tools and check Synchronize guest time with host, then click  OK.

This way all the ESXi hosts will be synchronized  with the NTP servers and all your VMs will be synchronized with the host  (you need vmware tools running in the VM).

It is important also to synchronize your workstation's time (where your run the vCO client) with the NTP server.

Some additional reads: Verifying time synchronization across an ESX/ESXi host

environment Installing and Configuring NTP on an ESX host Guide to configure NTP on ESX servers Time Synchronization in Guests Deployed from OVF Templates

did all of this, but the vSphere Web Client can't see my orchestrator. I can create the Datacenter, so vco can talk to and manipulate vcenter, but the web client doens't see any registered orchestrators, and the workflow area is empty.

There are only two steps needed to register vCO in the vSphere Web Client:
1. Register SSO successfully. (it looks like you have done this part if you can create a datacenter)
2. Register vCenter (if vco as an appliance, configured by default on windows)
Note: The most important sentence of the tutorial for that part is:
In this case you still have to provide an admin credential for the configuration session. Click on "Apply Changes"
Basically, you need to provide username/password in the configurator for the vCO to register in vCenter.
So, if you can browse vCenter inventory objects inside vCO designer (it looks like you ca do that), the only thing is to check again the vCenter configuration for username/password.
Please, let me know if you still have the issue. I will be very interested to find out more and to make it work.

about 60 seconds after I wrote this message, the Orchestrator showed up. This behavior is in keeping with all the other devices in my life that start to work properly immediately after I ask someone to help fix them.

Thanks for the quick reply, no further help required.

Just in additon for trobuleshooting purposes, the most important part for the vSphere Web Client to discover vCO is for vCO to register as an extenssion of vCenter. This is happening after vCO is configured with SSO first and then the username/password are supplied to the vCenter configuration.

In order to make sure that vCO is register as an extenssion, follow the documenation for “Check Whether Orchestrator Is Successfully Registered as an Extension”:

Thanks for this doc. Saves me a few times already!

I have a VCO appliance, an SSO Cluster on their own boxes, and vCenter on its own box( With inventory service). I have successfully registered VCO with SSO and with vCenter. I am able to run workflows against vCenter from the VCO client.

However, VCO does not display in the vSPhere web client.

Any ideas?

Did you check the previous comment pointing to this link:

Make sure that vCO is register as an extension manager in vCenter. There two ways to check this out - the link above or via the vSphere web client - extenssions.

Before that, make sure that you go to vCO Configurator/vCenter plugin, enter admin username/password and update the configuration again. This will make sure that the extenssion registration is up to date with certificates, ips and synched time.

I have verified that it is registered as an extension in vCenter.

As I mentioned, the registration could be out of sync. You need to make sure you apply the vCenter configuration again with providing admin username/password. Please make sure you do this step to take this check out of the way. Once you do that, it might have some caching in the vSphere UI.

If this is still not working then I am not sure what might be the issue. The next step would be to open Service Request with logs provided.

Can't see your script here, but same error is raised if you type System.Log instead of System.log or simliar typos on this object

Please look at this or share your script

Thanks man. Got the error.


I followed this to a T and I still can't see the vCO registered in vCenter Web Client. I can run workflows against the vCenter in the Orchestrator Client without issue, so I know the communications are working. Do you know of any error logs to look at so I can try to figure out what the issue is?

Also, when I go to register the server I get this error:



Version history
Revision #:
1 of 1
Last update:
‎09-04-2012 01:34 PM
Updated by: