6.0.3

Required Setup
You have to perform integration tasks for both vCenter Single Sign-On and the service that is using vCenter
Single Sign-On.
1 Export the vCenter Single Sign-On metadata and register vCenter Single Sign-On as an identity
provider into the other service provider.
2 Export the metadata of the other service provider and import them into vCenter Single Sign-On.
If you are using vRealize Automation as the service provider, see the vRealize Automation documentation
for details.
N The service must fully support the SAML 2.0 standard or integration does not work.
Add a SAML Service Provider
You add a SAML service provider to vCenter Single Sign-On, and add vCenter Single Sign-On as the
identity provider to that service. Going forward, when users log in to the service provider, the service
provider authenticates those users with vCenter Single Sign-On.
Use this process if you want to integrate the Single Sign-On solution that is included with VMware vRealize
Automation 7.0 and later with the vCenter Single Sign-On identity provider, or if you are working with
another external SAML Service Provider.
The process involves importing the metadata from your SAML service provider into vCenter Single Sign-
On, and importing the vCenter Single Sign-On metadata into your SAML service provider so the two
providers share all data.
Prerequisites
The target service must fully support the SAML 2.0 standard.
If the metadata do not follow the SAML 2.0 metadata schema precisely, you might have to edit the schema
before you import it. For example, if you are using an Active Directory Federation Services (ADFS) SAML
service provider, you have to edit the metadata before you can import them. Remove the following non-
standard elements:
fed:ApplicationServiceType
fed:SecurityTokenServiceType
You cannot currently import SAML IDP metadata from the vSphere Web Client.
Procedure
1 Export the metadata from your service provider to a le.
2 Import the service provider's metadata into vCenter Single Sign-On.
a Log in to the vSphere Web Client as [e-mail] or as another user with vCenter
Single Sign-On administrator privileges.
Users with vCenter Single Sign-On administrator privileges are in the Administrators group in the
vsphere.local domain.
b Browse to Single Sign-On > .
c Select the SAML Service Providers tab.
d In the Metadata from your SAML service provider eld, click Import and paste the XML strings
into the dialog, or click Import from File to import a le and then click Import.
vSphere Security
46 VMware, Inc.