Category: VMware

I built sso-users—a lightweight Go application that connects directly to the VMware Directory Service (vmdir) over LDAPS and reports local SSO users together with their password expiration status.

The project was originally created for VMware Cloud Foundation (VCF) 9 environments, but it should works anywhere the vCenter SSO directory is available over LDAP.

Where to find it -> here in repository musil/vSphere_scripts on GitHub.

Why I Built It

When performing security reviews or compliance audits, one of the recurring questions is:

• Which local SSO accounts exist?
• Are any passwords already expired?
• Which accounts never expire?
• Are any accounts disabled or locked?

Some of the questions can be answered by PowerCLI and the VMware.vSphere.SsoAdmin module. But not all. I wanted something that:

• runs anywhere
• has zero PowerShell dependencies
• is easy to automate
• can be integrated into monitoring systems
• exposes the data over a simple REST API

So I wrote sso-users in Go.

What It Does

The application connects securely to vmdir using LDAPS and retrieves local SSO accounts.

For every user it calculates password expiration based on the directory attributes and displays information including:

• Username
• User Principal Name (UPN)
• Disabled state
• Locked state
• Password never expires
• Password last changed
• Password expiration date (if is not set to password never expire)
• Days remaining until expiration (if is not set to password never expire)

Instead of relying on the vSphere UI, the tool reads the information directly from LDAP, making it fast and script-friendly. (GitHub)

Flexible Output

The CLI supports multiple output formats depending on your workflow.

For administrators:

• Human-readable table output

For automation:

• JSON output

This makes it easy to integrate with:

• monitoring systems
• scheduled compliance reports
• inventory scripts
• CI/CD pipelines

Built-in REST API

Besides the CLI, sso-users can also run as a small HTTP service.

The API is protected with a bearer token and exposes:

• /health
• /api/v1/users

This makes it straightforward to integrate with dashboards, Grafana, custom portals, or other internal tooling without repeatedly invoking the CLI. (GitHub)

Security First

Security was one of the design goals.

The application:

• supports interactive password prompts
• can read credentials from environment variables
• avoids logging passwords or API keys
• supports trusted TLS certificates
• allows -insecure only for internal or lab environments with self-signed certificates

It also avoids placing passwords in shell history whenever possible. (GitHub)

Why Go?

Go is a great fit for infrastructure tools.

The resulting binary is:

• cross-platform
• fast
• easy to distribute
• dependency-free

Release builds are available for:

• Linux (amd64)
• Windows (amd64)
• macOS (Apple Silicon)

Open Source

The project is completely open source, and I hope it becomes useful for VMware administrators, consultants, and anyone responsible for auditing vCenter environments.

Feedback, bug reports, feature requests, and pull requests are always welcome.

Happy automating!