VMware ESXi
Britive integrates with standalone VMware ESXi hypervisors through the Britive Access Broker. All operations go to the host’s vSphere SOAP API at https://<host>/sdk — no agent on the host, no SSH session from the broker, no extra services to install.
This section covers standalone ESXi only. For ESXi hosts managed through vCenter, see VMware vCenter — the identity model is different (vCenter SSO vs. local accounts) and the JIT pattern grants a role on an existing principal instead of creating a temp user.
Access Patterns
| Pattern | What it does |
|---|---|
| JIT Temp Local Admin | On checkout, creates an ephemeral local account on the ESXi host and grants the Administrator role at the root inventory object. On checkin, removes the role and deletes the account. The same account is usable from the ESXi web UI or SSH (if the host’s SSH service is running). |
| Account Rotation | Rotates the stored secret of an existing local account on the host. The account itself is neither created nor removed. |
| Identity Scan | Enumerates local accounts and groups on the host and writes a Britive Resource Manager scan report so Britive’s identity inventory stays current. |
Tested Versions
| Attribute | Value |
|---|---|
| Platform | VMware ESXi (standalone) |
| Tested versions | ESXi 7.0, 8.0 |
| API | vSphere SOAP at https://<host>/sdk |
| Port | TCP 443 from broker to host |
| Broker runtime | python3 3.8+ (standard library only) |
Licensing Note
Write operations against the vSphere SOAP API — creating users, assigning roles, rotating secrets — require vSphere Standard or higher. Free-edition or unlicensed ESXi disables write API calls after the 60-day evaluation period; the JIT Temp Local Admin and Account Rotation patterns will fail with a SOAP fault on unlicensed hosts. The Identity Scan pattern continues to work because it only reads.
vCenter installs always include a paid license, so vCenter integrations have no licensing concern.
In This Section
- Getting Started — JIT Local Admin
Set up JIT temporary local admin access to a standalone VMware ESXi host using the Britive Access Broker.
- Rotate Local Accounts
Rotate the stored secret of an existing local account on a standalone VMware ESXi host.
- Scan Local Accounts
Enumerate local accounts and groups on a standalone VMware ESXi host into Britive's identity inventory.