esxi_ad_auth

ESXi native Active Directory join via SOAP/pyVmomi.

Covers the 912-controls requirement ESXi.enable-ad-auth_adv: allow ESXi hosts to join an Active Directory domain natively — i.e. sending the AD credentials directly to the host rather than going through the vSphere Authentication Proxy (CAM). The CAM path is a separate control and is shipped as vcf_esxi_auth_proxy (ESXi.enable-auth-proxy).

The join is done through the host’s configManager.activeDirectoryAuthentication managed object:

  • .info -> HostActiveDirectoryInfo with joinedDomain, trustedDomain, domainMembershipStatus and smbFileShares.

  • .JoinDomain_Task(domainName, userName, password) — direct join with plaintext AD credentials.

  • .LeaveCurrentDomain_Task(force=True/False) — leave.

On hosts that have never been joined some ESXi builds surface a 503 from the HostAuthenticationManager backing service when .info is dereferenced. On VCF 9.1 GA the situation is even simpler — the activeDirectoryAuthentication attribute is missing from configManager entirely until the host joins its first domain. Both surfaces are treated as “not joined” rather than failing the read.

saltext.vcf.clients.esxi_ad_auth.get_ad_state(opts, host, profile=None)[source]

Return the AD-join state for host.

{
    "joined": bool,
    "domain": str | None,
    "trusted_domains": list[str],
    "membership_status": str | None,
    "smb_file_shares": str | None,
}

Never raises for the “never-joined” case — returns {"joined": False, "domain": None, ...}.

saltext.vcf.clients.esxi_ad_auth.join_domain(opts, host, domain_name, username, password, profile=None)[source]

Join host to domain_name natively using AD credentials.

Calls HostActiveDirectoryAuthentication.JoinDomain_Task with the supplied credentials. Returns the task moId; callers that need to block should wrap in saltext.vcf.utils.vim.wait_for_task().

saltext.vcf.clients.esxi_ad_auth.leave_domain(opts, host, force=False, profile=None)[source]

Leave the current AD domain via LeaveCurrentDomain_Task.