This document supports the version of each product listed and
supports all subsequent versions until the document is replaced
by a new edition. To check for more recent editions of this
document, see http://www.vmware.com/support/pubs.
EN-000227-03
vCenter Orchestrator Installation and Configuration Guide
You can find the most up-to-date technical documentation on the VMware Web site at:
http://www.vmware.com/support/
The VMware Web site also provides the latest product updates.
If you have comments about this documentation, submit your feedback to:
VMware is a registered trademark or trademark of VMware, Inc. in the United States and/or other jurisdictions. All other marks
and names mentioned herein may be trademarks of their respective companies.
VMware, Inc.
3401 Hillview Ave.
Palo Alto, CA 94304
www.vmware.com
2 VMware, Inc.
Contents
Updated Information5
About This Book7
Introduction to VMware vCenter Orchestrator9
1
Key Features of the Orchestrator Platform 9
Orchestrator User Roles and Related Tasks 10
Orchestrator Architecture 11
Orchestrator System Requirements13
2
Hardware Requirements for Orchestrator 13
Operating Systems Supported by Orchestrator 13
Supported Directory Services 14
Browsers Supported by Orchestrator 14
Orchestrator Database Requirements 14
Level of Internationalization (i18n) Support 14
Orchestrator Components Setup Guidelines17
3
vCenter Server Setup 17
Directory Services Setup 17
Orchestrator Database Setup 18
Enable Support for MySQL Databases on Windows 18
MySQL Database Parameters 19
Orchestrator Configuration Maximums 19
VMware, Inc.
Installing Orchestrator21
4
Install vCenter Server and Orchestrator 21
Install Orchestrator Standalone 23
Upgrade Orchestrator with vCenter Server25
5
Upgrade Orchestrator Standalone27
6
Upgrading Orchestrator Applications After Upgrading vCenter Server29
7
Uninstall Orchestrator31
8
Configuring Orchestrator33
9
Start the Orchestrator Configuration Service 34
Log In to the Orchestrator Configuration Interface 34
3
vCenter Orchestrator Installation and Configuration Guide
Change the Default Password 35
Revert to the Default Password for Orchestrator Configuration 35
Configure the Network Connection 36
Orchestrator Network Ports 36
Change the Default Configuration Ports on the Orchestrator Client Side 38
Import the vCenter SSL Certificate 39
Configuring LDAP Settings 39
Generate the LDAP Connection URL 40
Import the LDAP Server SSL Certificate 41
Specify the Browsing Credentials 42
Define the LDAP Lookup Paths 43
Define the LDAP Search Options 44
Common Active Directory LDAP Errors 44
Password Encryption and Hashing Mechanism 45
Configure the Database Connection 45
Database Connection Parameters 46
Identify the SQL Server Authentication Type 47
Server Certificate 47
Import a Server Certificate 47
Create a Self-Signed Server Certificate 48
Obtain a Server Certificate Signed by a Certificate Authority 48
Export a Server Certificate 49
Change a Self-Signed Server Certificate 49
Configure the Default Plug-Ins 50
Define the Default SMTP Connection 51
Configure the SSH Plug-In 51
Configure the vCenter 4.0 Plug-In 52
Remove a Plug-In 53
Access Rights to Orchestrator Server 54
Import the vCenter Server License 54
Start the Orchestrator Server 55
Activate the Service Watchdog Utility 55
Unwanted Server Restarts 56
Export the Orchestrator Configuration 56
Orchestrator Configuration Files 57
Import the Orchestrator Configuration 58
Configure the Maximum Number of Events and Runs 58
Install an Application 59
Start a Published Web View 59
Change the Web View SSL Certificate 60
Define the Server Log Level 60
Where to Go From Here63
10
Index65
4 VMware, Inc.
Updated Information
This vCenter Orchestrator Installation and Configuration Guide is updated with each release of the product or
when necessary.
This table provides the update history of the vCenter Orchestrator Installation and Configuration Guide.
RevisionDescription
EN-000227-03
EN-000227-02
EN-000227-01
n
Added a user role in “Orchestrator User Roles and Related Tasks,” on page 10.
n
Updated Step 1 in “Log In to the Orchestrator Configuration Interface,” on page 34.
n
Added reference to VMware Technical Publications glossary in “About This Book,” on page 7.
n
Updated “Install vCenter Server and Orchestrator,” on page 21.
n
Added information about supported directory service types in “Directory Services Setup,” on
page 17.
n
Corrected the note in Step 7 in “Generate the LDAP Connection URL,” on page 40.
n
Corrected the instructions in Step 3 and Step 4 in “Define the LDAP Lookup Paths,” on page 43.
n
Added a prerequisite in “Configure the Database Connection,” on page 45.
n
Added a prerequisite in “Start the Orchestrator Server,” on page 55.
n
Added a new topic, Chapter 10, “Where to Go From Here,” on page 63.
n
Added a procedure about restoring the default administrative password in “Revert to the Default
Password for Orchestrator Configuration,” on page 35.
n
Added instructions about changing the communication ports on the Orchestrator client side in “Change
the Default Configuration Ports on the Orchestrator Client Side,” on page 38.
n
Added information about using SSL with LDAP in “Import the LDAP Server SSL Certificate,” on
page 41.
n
Added instructions about deleting a plug-in in “Remove a Plug-In,” on page 53.
n
Added instructions about changing the SSL certificate for Web views in “Change the Web View SSL
Certificate,” on page 60.
VMware, Inc. 5
vCenter Orchestrator Installation and Configuration Guide
RevisionDescription
EN-000227-00 Updates for the release of Orchestrator 4.0.1:
n
Added information about the supported versions of directory service types in “Supported Directory
Services,” on page 14.
n
Added information about internationalization support in “Level of Internationalization (i18n)
Support,” on page 14.
n
Added instructions about installing Orchestrator with the vCenter Server installer in “Install vCenter
Server and Orchestrator,” on page 21.
n
Added details about the location of the vCenterOrchestrator.exe file in “Install Orchestrator
Standalone,” on page 23.
n
Added information about upgrading Orchestrator in Chapter 6, “Upgrade Orchestrator Standalone,”
on page 27 and Chapter 5, “Upgrade Orchestrator with vCenter Server,” on page 25.
n
Added new topics about configuring the Orchestrator components in Chapter 3, “Orchestrator
Components Setup Guidelines,” on page 17.
n
Added information about the supported configuration maximums for Orchestrator in “Orchestrator
Configuration Maximums,” on page 19.
n
Removed information about enabling support for Oracle on Windows, because Orchestrator now
includes the Oracle database driver.
n
Added port numbers to the list in “Orchestrator Network Ports,” on page 36.
n
Added information and an example about using Global Catalog with Active Directory in “Generate the
LDAP Connection URL,” on page 40.
n
Added information about customizing the LDAP search queries in “Define the LDAP Search
Options,” on page 44.
n
Added a list of the most common LDAP authentication errors in “Common Active Directory LDAP
Errors,” on page 44.
n
Added instructions about using Windows authentication in “Configure the Database Connection,” on
page 45.
n
Added a prerequisite for using an Oracle database in an internationalized environment in “Configure
the Database Connection,” on page 45.
n
Added instructions about identifying the SQL Server authentication type in “Identify the SQL Server
Authentication Type,” on page 47.
n
Added instructions about importing a server certificate in “Import a Server Certificate,” on page 47.
n
Added instructions about enabling the Orchestrator service watchdog in “Activate the Service
Watchdog Utility,” on page 55.
n
Added troubleshooting information in “Unwanted Server Restarts,” on page 56.
n
Added instructions about changing the SSL certificate used for Web views in “Change the Web View
SSL Certificate,” on page 60.
n
Added information about uninstalling Orchestrator in Chapter 8, “Uninstall Orchestrator,” on
page 31.
EN-000192-01
n
Removed OpenLDAP from the list of supported directory services in “Supported Directory
Services,” on page 14.
n
Added information about unsupported database types and full partition warning in “Orchestrator
Database Setup,” on page 18.
n
Added a note about an unsupported directory service type in Step 3 in “Generate the LDAP Connection
URL,” on page 40.
n
Added information about the methods Orchestrator uses to store passwords in “Password Encryption
and Hashing Mechanism,” on page 45.
n
Added instructions about how to remove a self-signed server certificate in “Change a Self-Signed Server
Certificate,” on page 49.
EN-000192-00 Initial release of Orchestrator 4.0.
6 VMware, Inc.
About This Book
The VMware vCenter Orchestrator Installation and Configuration Guide provides information and instructions
about installing, upgrading and configuring VMware® vCenter Orchestrator.
Intended Audience
This book is intended for advanced vCenter administrators and experienced system administrators who are
familiar with virtual machine technology and datacenter operations.
VMWare Technical Publications Glossary
VMware Technical Publications provides a glossary of terms that might be unfamiliar to you. For definitions
of terms as they are used in VMware technical documentation, go to
http://www.vmware.com/support/pubs.
Document Feedback
VMware welcomes your suggestions for improving our documentation. If you have comments, send your
feedback to docfeedback@vmware.com.
Technical Support and Education Resources
The following technical support resources are available to you. To access the current version of this book and
other books, go to http://www.vmware.com/support/pubs.
Online and Telephone
Support
Support Offerings
VMware Professional
Services
VMware, Inc. 7
To use online support to submit technical support requests, view your product
and contract information, and register your products, go to
http://www.vmware.com/support.
Customers with appropriate support contracts should use telephone support
for the fastest response on priority 1 issues. Go to
http://www.vmware.com/support/phone_support.html.
To find out how VMware support offerings can help meet your business needs,
go to http://www.vmware.com/support/services.
VMware Education Services courses offer extensive hands-on labs, case study
examples, and course materials designed to be used as on-the-job reference
tools. Courses are available onsite, in the classroom, and live online. For onsite
pilot programs and implementation best practices, VMware Consulting
vCenter Orchestrator Installation and Configuration Guide
Services provides offerings to help you assess, plan, build, and manage your
virtual environment. To access information about education classes,
certification programs, and consulting services, go to
http://www.vmware.com/services.
8 VMware, Inc.
Introduction to VMware vCenter
Orchestrator1
VMware vCenter Orchestrator is a development and process-automation platform that provides a library of
extensible workflows to allow you to create and run automated, configurable processes to manage the VMware
vCenter infrastructure as well as other VMware and third-party technologies.
Orchestrator exposes every operation in the vCenter Server API, allowing you to integrate all of these
operations into your automated processes. Orchestrator also allows you to integrate with other management
and administration solutions through its open plug-in architecture.
This chapter includes the following topics:
n
“Key Features of the Orchestrator Platform,” on page 9
n
“Orchestrator User Roles and Related Tasks,” on page 10
n
“Orchestrator Architecture,” on page 11
Key Features of the Orchestrator Platform
Orchestrator is composed of three distinct layers: an orchestration platform that provides the common features
required for an orchestration tool, a plug-in architecture to integrate control of subsystems, and a library of
workflows. Orchestrator is an open platform that can be extended with new plug-ins and libraries, and can be
integrated into larger architectures through a SOAP API.
The following list presents the key Orchestrator features.
Persistence
Central management
Check-pointing
Versioning
VMware, Inc. 9
Production grade external databases are used to store relevant information,
such as processes, workflow states, and configuration information.
Orchestrator provides a central way to manage your processes. The application
server-based platform, with full version history, allows you to have scripts and
process-related primitives in one place. This way, you can avoid scripts without
versioning and proper change control spread on your servers.
Every step of a workflow is saved in the database, which allows you to restart
the server without losing state and context. This feature is especially useful for
long-running processes.
All Orchestrator Platform objects have an associated version history. This
feature allows basic change management when distributing processes to
different project stages or locations.
vCenter Orchestrator Installation and Configuration Guide
Scripting engine
Workflow engine
Policy engine
Web 2.0 front end
The Mozilla Rhino JavaScript engine provides a way to create new building
blocks for Orchestrator Platform. The scripting engine is enhanced with basic
version control, variable type checking, name space management and
exception handling. It can be used in the following building blocks:
n
Actions
n
Workflows
n
Policies
The workflow engine allows you to capture business processes. It uses the
following objects to create a step-by-step process automation in workflows:
n
Workflows and actions that Orchestrator provides.
n
Custom building blocks created by the customer
n
Objects that plug-ins add to Orchestrator
Users, other workflows, a schedule, or a policy can start workflows.
The policy engine allows monitoring and event generation to react to changing
conditions in the Orchestrator server or plugged-in technology. Policies can
aggregate events from the platform or any of the plug-ins, which allows you
to handle changing conditions on any of the integrated technologies.
The Web 2.0 front end allows you to integrate Orchestrator functions into Webbased interfaces, using Web views. For example, you can create Web views that
add buttons to start workflows from a page in your company's Intranet. It
provides a library of user customizable components to access vCO orchestrated
objects and uses Ajax technology to dynamically update content without
reloading complete pages.
Security
Orchestrator provides the following advanced security functions:
n
Public Key Infrastructure (PKI) to sign and encrypt content imported and
exported between servers
n
Digital Rights Management (DRM) to control how exported content might
be viewed, edited and redistributed
n
Secure Sockets Layer (SSL) encrypted communications between the
desktop client and the server and HTTPS access to the Web front end.
n
Advanced access rights management to provide control over access to
processes and the objects manipulated by these processes.
Orchestrator User Roles and Related Tasks
vCenter Orchestrator provides different tools and interfaces based on the specific responsibilities of the two
global user roles: Administrators and End Users.
Administrators
This role has full access to all of the Orchestrator platform capabilities. Basic
administrative tasks include the following items:
n
Installing and configuring Orchestrator
n
Managing access rights for Orchestrator and applications
n
Importing and exporting packages
n
Enabling and disabling Web views
10 VMware, Inc.
Orchestrator
database
vCenter
Orchestrator
Client application
vCenter
Server
browser accessweb service
workflow library
vCenterVI3WMIXMLSSHJDBC SMTP
3rd-party
plug-in
directory
services
workflow engine
Chapter 1 Introduction to VMware vCenter Orchestrator
n
Running workflows and scheduling tasks
n
Managing version control of imported elements
n
Creating new workflows and plug-ins
Developers
This role has full access to all of the Orchestrator platform capabilities.
Developers are granted access to the Orchestrator client interface and have the
following responsibilities:
n
n
n
End Users
Users in this role are granted access to only the Web front end. They can run
and schedule workflows and policies that you make available in a browser by
using Web views.
Orchestrator Architecture
Orchestrator contains a workflow library and workflow engine to allow you to create and run workflows that
automate orchestration processes. You run workflows on the objects of different technologies that Orchestrator
accesses through a series of plug-ins.
Orchestrator provides a standard set of plug-ins, including a plug-in to VMware vCenter Server, to allow you
to orchestrate tasks in the different environments that the plug-ins expose.
Orchestrator also presents an open architecture to allow you to plug in external third-party applications to the
orchestration platform. You can run workflows on the objects of the plugged-in technologies that you define
yourself. Orchestrator connects to a directory services server to manage user accounts, and to a database to
store information from the workflows that it runs. You can access Orchestrator and the workflows and objects
it exposes through the Orchestrator client interface, through a Web browser, or through Web services.
Creating applications to extend the Orchestrator platform functionality
Automating processes by customizing existing workflows and creating
new workflows and plug-ins
Customizing Web front ends for these processes, using Web 2.0
Figure 1-1 shows the architecture of Orchestrator.
NOTE The VMware Infrastructure 3 and Microsoft plug-ins are not installed by default.
VMware, Inc. 11
vCenter Orchestrator Installation and Configuration Guide
12 VMware, Inc.
Orchestrator System Requirements2
Your system must meet the technical requirements that are necessary to install and configure VMware vCenter
Orchestrator.
This chapter includes the following topics:
n
“Hardware Requirements for Orchestrator,” on page 13
n
“Operating Systems Supported by Orchestrator,” on page 13
n
“Supported Directory Services,” on page 14
n
“Browsers Supported by Orchestrator,” on page 14
n
“Orchestrator Database Requirements,” on page 14
n
“Level of Internationalization (i18n) Support,” on page 14
Hardware Requirements for Orchestrator
Make sure your system meets the minimum hardware requirements before you install Orchestrator.
n
2.0GHz or faster Intel or AMD x86 processor. At least two CPUs are recommended. Processor requirements
might differ if your database runs on the same hardware.
n
4GB RAM. You might need more RAM if your database runs on the same hardware.
n
2GB disk space. You might need more storage if your database runs on the same hardware.
n
A free static IP address.
Operating Systems Supported by Orchestrator
Orchestrator offers support for several operating systems.
n
Windows Server 2008 Datacenter, 64-bit
n
Windows Server 2008 Enterprise R2, 64-bit
n
Windows Server 2008 Enterprise SP1, 64-bit
n
Windows Server 2008 Standard, 64-bit
n
Windows Server 2008 Datacenter, 32-bit
n
Windows Server 2008 Enterprise, 32bit
n
Windows Server 2008 Standard, 32bit
n
Windows Server 2003 R2 SP2, 32-bit
VMware, Inc.
13
vCenter Orchestrator Installation and Configuration Guide
n
Windows Server 2003 R2 SP2, 64-bit
n
Windows Server 2003 R2, 32-bit
Supported Directory Services
Orchestrator requires a working LDAP server on your infrastructure.
Orchestrator supports these directory service types.
n
Windows Server 2003 Active Directory
n
Windows Server 2008 Active Directory
n
Novell eDirectory Server 8.8.3
n
Sun Java Directory Server Enterprise Edition (DSEE) Version 6.3
Browsers Supported by Orchestrator
The Orchestrator user interface requires a Web browser.
You must have one of the following browsers to connect to Orchestrator.
n
Microsoft Internet Explorer 6.0 and 7.0
n
Mozilla Firefox 3.0.x
Orchestrator Database Requirements
Orchestrator requires you to have a database that is separate from the standard vCenter database.
NOTE Because of CPU and memory use, you should consider hosting the Orchestrator database and the
Orchestrator server on different machines from the same datacenter. Make sure at least 1GB of free disk space
is available on each machine.
The following database types are supported by Orchestrator:
n
Microsoft SQL Server 2008 Enterprise Edition x64 (10.0.1600)
n
Microsoft SQL Server 2005 Enterprise Edition x32 (9.0.3042)
Orchestrator is compliant with i18n level 1. Although Orchestrator is not localized, it can run on a non-English
operating system and handle non-English text.
Non-ASCII Character Support in Orchestrator
Table 2-1 displays the level of internationalization compliance and limitations in Orchestrator GUI data entries.
Table 2-1. Non-ASCII Character Support
Support for Non-ASCII Characters
Input and
Item
ActionYesNoNoNo
CategoryYesYes--
14 VMware, Inc.
Description
FieldName Field
Output
ParametersAttributes
Chapter 2 Orchestrator System Requirements
Table 2-1. Non-ASCII Character Support (Continued)
Support for Non-ASCII Characters
Input and
Description
Item
Configuration elementYesYes-No
PackageYesYes--
PolicyYesYes--
Policy templateYesYes--
Resource elementYesYes--
Web viewYesYes-No
WorkflowYesYesNoNo
Workflow presentation display group
and input step
FieldName Field
YesYes--
Output
ParametersAttributes
CAUTION You cannot use non-ASCII characters in the filename when you export Orchestrator objects. This is
due to a third party limitation.
Non-ASCII Character Support for Oracle Databases
To store characters in the correct format in an Oracle database, set the NLS_CHARACTER_SET parameter to
AL32UTF8 before configuring the database connection and building the table structure for Orchestrator. This
setting is crucial for an internationalized environment.
VMware, Inc. 15
vCenter Orchestrator Installation and Configuration Guide
16 VMware, Inc.
Orchestrator Components Setup
Guidelines3
To enhance the availability and scalability of your Orchestrator setup, install Orchestrator on a server different
from the server on which vCenter Server runs. Separating Orchestrator from vCenter Server makes it possible
to adjust the operating system to meet the specific recommendations for each service.
This chapter includes the following topics:
n
“vCenter Server Setup,” on page 17
n
“Directory Services Setup,” on page 17
n
“Orchestrator Database Setup,” on page 18
n
“Orchestrator Configuration Maximums,” on page 19
vCenter Server Setup
Increasing the number of vCenter Server instances causes Orchestrator to manage more sessions. Each active
session implies activity on the corresponding vCenter and too many active sessions can cause Orchestrator to
experience timeouts when more than 10 vCenter connections occur.
NOTE Run only one vCenter Server on a virtual machine. You can run multiple vCenter instances on different
virtual machines in your Orchestrator setup if your network has sufficient bandwidth and latency. If you are
using LAN to improve the communication between Orchestrator and vCenter, a 100Mb line is mandatory.
Directory Services Setup
Orchestrator requires a connection to an LDAP server on your infrastructure.
The supported directory service types are: Active Directory, eDirectory, and Sun Java System Directory Server.
OpenLDAP is not supported and can only be used for testing and evaluation purposes.
Connect your system to the LDAP server that is physically closest to your Orchestrator server and avoid
connections to remote LDAP servers. Long response times for LDAP queries can lead to slower performance
of the whole system.
To improve the performance of the LDAP queries, keep the user and group lookup base as narrow as possible.
Try to limit the users to targeted groups that are going to need access, rather than to whole organizations with
many users who are not going to need access. Depending on the combination of database and directory service
you choose, the resources you need can vary. For recommendations, see third-party documentation.
VMware, Inc.
17
vCenter Orchestrator Installation and Configuration Guide
Orchestrator Database Setup
Orchestrator requires a database to store workflows and actions.
Orchestrator server supports Oracle and Microsoft SQL Server databases and provides experimental support
for MySQL and PostgreSQL. You can use MySQL and PostgreSQL for testing and evaluation purposes.
NOTE The driver for MySQL is not installed with Orchestrator. For details about enabling support for this
database type, see “Enable Support for MySQL Databases on Windows,” on page 18.
The way in which your database is set up can affect Orchestrator performance. Install the database on a virtual
machine other than the one on which Orchestrator is installed. This method avoids the JVM and DB server
having to share CPU, RAM, and IOs.
Storing your database plug-ins in a database separate from the one that Orchestrator uses allows more
modularity when upgrading the system. A dedicated database instance allows you to perform upgrades and
maintenance without impacting other products.
The location of the database is important because almost every activity on the Orchestrator server triggers
operations on the database. To avoid latency in the database connection, connect to the database server that is
closest to your Orchestrator server and that is on the network with the highest bandwidth.
The size of the Orchestrator database varies depending on the setup and how workflow tokens are handled.
Allow for approximately 50K per vCenter Server object and 4KB per workflow run.
CAUTION Make sure that at least 1GB of free disk space is available
n
on the virtual machine where the database is installed
n
on the virtual machine where the Orchestrator server is installed
Insufficient disk storage space might result in unwanted behavior of the Orchestrator server and client.
Enable Support for MySQL Databases on Windows
To use a MySQL database, you must download the driver and copy it to the appropriate locations. The
Orchestrator installer does not install drivers for MySQL databases.
Procedure
1Download the latest MySQL driver from http://dev.mysql.com/downloads/connector/j/.
2Extract the downloaded archive.
3In the extracted folder, locate the mysql-connector-java-