Simplified Identity Management with Authentik for Holodeck 9.1

Holodeck 9.1 ships Authentik as a first-class service on the Holorouter. Two commands are all it takes to stand up a fully federated identity layer for your VMware Cloud Foundation (VCF) lab — no external LDAP, no manual UI clicks, no secrets scattered across config files.

What is Authentik?

Authentik is a self-hosted, open-source Identity Provider (IdP) that speaks the protocols modern platforms actually use: OIDC, OAuth2, SAML 2.0, and SCIM 2.0. Think of it as the identity backbone you would normally outsource to some third-party vendors — except it runs on your own infrastructure, costs nothing per user, and integrates natively with Kubernetes via a Helm chart.

In Holodeck 9.1, Authentik is deployed inside the Holorouter’s single-node Kubernetes cluster at auth.vcf.lab. It is installed automatically as part of the Set-HoloRouter command, which in turn is part of New-HolodeckInstance command, so by the time your nested VCF deployment starts, the IdP is already healthy and waiting.

Advantages of Authentik

• Open Source and Self-Hosted — Fully open source with no per-seat licensing costs. Runs entirely inside the Holodeck environment on the Holorouter.
• Standards-Based Protocols — Native support for OIDC, OAuth2, SAML 2.0, and SCIM 2.0 — exactly the protocols VCF Operations expects from its external identity provider.
• Fine-Grained Access Policies — Policy engine lets you attach authentication flows, MFA stages, and group-based authorisation rules to each application independently.
• Automated Provisioning — Pushes users and groups to downstream services automatically. No manual account creation in VCF Operations after deployment.
• Kubernetes-Native Deployment — Deployed via Helm in the single-node Kubernetes cluster running on Holorouter. No extra infrastructure or VMs required.

VCF SSO: One Identity Across the Entire Stack

VCF Operations 9.0 introduced a fleet-level Single Sign-On (SSO) layer that federates authentication across every VCF component — vCenter, NSX, VCF Automation, and VCF Operations itself — through a single external identity provider. VCF Operations registers an IdP, exchanges tokens, and uses the IdP to keep its internal user/group directory in sync with the source of truth in the IdP.

Advantages of VCF SSO

• Single Login for the Entire Stack — One identity authenticates across vCenter, NSX Manager, VCF Operations, and VCF Automation.
• Federated Identity — VCF Operations delegates authentication entirely to the external IdP without storing credentials locally.
• Users and Groups Sync — Groups and users are pushed to VCF by IdP and then roles (e.g. vcf_administrator) are assigned directly to synced groups.
• Domain-Based User Routing — Users log in with their domain suffix (e.g. admin@vcf.lab) and VCF SSO routes the authentication request to the matching identity provider automatically.
• Centralised Role Management — RBAC lives in VCF SSO rather than individual component UIs. Add a user to an Authentik group and access propagates everywhere.

The Use Case: Authentik as the VCF SSO Identity Provider

A fresh VCF Operations instance ships with a local administrator account. Any real lab workflow — day-2 automation, multi-operator testing, or CI pipeline runs — needs a proper identity layer. The traditional answer is to connect an external Active Directory, but standing up AD in a lab environment is heavyweight and time-consuming.

Authentik closes that gap. It acts as a lightweight IdP that VCF Operations already knows how to talk to. In Holodeck 9.1, Authentik becomes the OIDC issuer VCF Operations trusts, and SCIM becomes the channel through which Authentik continuously pushes user and group changes into its internal directory. The result is a federated lab identity stack that mirrors production behaviour without the overhead of a domain controller.

What Holodeck configures automatically:

Holodeck provisions the full integration end-to-end — Authentik groups (VCF Administrators), a lab admin user (admin@vcf.lab), an OIDC provider (holodeck) with VCF-compatible redirect URIs, a SCIM provider (scim-holodeck) targeting the VCF Operations SCIMv2 endpoint, and role assignment of vcf_administrator to the synced group — all without opening a browser.

Integrating Authentik with VCF SSO: Two Commands in Holodeck

The entire Authentik–VCF SSO integration is automated through two PowerShell commands exposed by the Holodeck module. Run them in order after your VCF deployment is complete.

Step	Command / Action	What Happens
1 (Pre-requisite)	Set-HoloRouter (part of New-HolodeckInstance)	Deploys Authentik via Helm on the HoloRouter Kubernetes cluster.
2	Initialize-Authentik	Creates groups and users inside Authentik, registers the holodeck OIDC provider, and binds it to the vcf application.
3	Set-VCFSSOConfiguration	Calls the VCF Operations IAM API to create an SSO realm, register Authentik as the IdP, generate a SCIM sync token, trigger SCIM sync, and assign vcf_administrator to the synced group.
4 (Validation)	Login complete	Users navigate to VCF Operations, enter admin@vcf.lab, authenticate via Authentik, and land back with full administrator rights.

Command 1 — Initialize-Authentik

Initialize-Authentik connects to the freshly deployed Authentik instance at auth.vcf.lab and bootstraps everything VCF SSO needs on the IdP side:

What it does	Detail
Creates VCF Administrators group	Superuser-flagged group in Authentik that maps to the vcf_administrator role in VCF Operations.
Creates admin user	admin@vcf.lab, a member of VCF Administrators, used for VCF Operations login after federation is complete.
Registers holodeck OIDC provider	Creates a confidential OAuth2 client with appropriate redirect URI.
Creates vcf application	Binds the OIDC provider to an Authentik application object, enabling the OIDC discovery endpoint that VCF Operations will use.

Invocation:

The command returns the OIDC provider object — containing client_id and client_secret — that is passed directly into Set-VCFSSOConfiguration in the next step.

Command 2 — Set-VCFSSOConfiguration

Set-VCFSSOConfiguration calls the VCF Operations fleet-management IAM API to wire Authentik in as the trusted external IdP and kick off the initial SCIM synchronisation:

What it does	Detail
Acquires VCF Operations OpsToken	Authenticates with VCF Operations API server and obtains the bearer token for every subsequent API call.
Creates SSO realm	Create the VCF identity domain that anchors all federations.
Registers Authentik as OIDC/SCIM IdP	Sends the OIDC discovery endpoint, client_id/secret, and auth.vcf.lab TLS certificate chain to VCF Operations.
Generates SCIM sync token	Obtains an access token that Authentik uses to push users and groups to VCF Operations via SCIMv2.
Triggers Authentik SCIM sync	Configures the scim-holodeck provider in Authentik, then immediately syncs all users and groups into VCF Operations.
Assigns vcf_administrator role	Once the VCF Administrators group appears, it grants the vcf_administrator rights.

Invocation (pass the OIDC provider returned by Initialize-Authentik):

After both commands complete, users can log into VCF Operations at https://ops-a.site-a.vcf.lab with admin@vcf.lab — authenticated by Authentik, authorised by VCF SSO, and carrying full vcf_administrator rights. No browser, no manual UI configuration, no multi-step integration process.