7.0

5 Using the Active Directory Federated Services management console, or another appropriate tool, set
up a relying party trust relationship with the vRealize Automation identity provider.
To set up this trust, you must import the Directories Management metadata that you previously
downloaded. See the Microsoft Active Directory documentation for more information about
configuring Active Directory Federated Services for bi-directional trust relationships. As part of this
process, you must do the following:
n
Set up a Relying Party Trust. When you set up this trust, you must import the VMware Identity
Provider service provider metadata XML file that you copied and saved
n
Create a claim rule that transforms the attributes retrieved from LDAP in the Get Attributes rule
into the desired SAML format. After you create the rule,. you must edit the rule by adding the
following text:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer
= c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType,
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] =
"vmwareidentity.domain.com");
Configure SAML Federation Between Directories Management and SSO2
You can establish federation between vRealize Automation Directories Management and systems that
use SSO2.
Establish federation between Directories Management and SSO2 by creating a SAML connection
between the two parties. Currently, the only supported end-to-end flow is where SSO2 acts as the Identity
Provider (Idp) and Directories Management acts as the service provider (SP).
For users to be authenticated by SSO2, the same account must exist in both Directories Management
and SSO2. At least the UserPrinicpalName (UPN) of the user has to match on both ends. Other attributes
can differ as they are required to identify the SAML subject.
For local users in SSO2, such as [e-mail], corresponding accounts must be created in
Directories Management as well (where at least the UPN of the user matches). For now, this must be
done manually or by a script using the Directories Management local user creation APIs.
Setting up SAML between SSO2 and Directories Management involves configuration on the Directories
Management and SSO components.
Configuring vRealize Automation
VMware, Inc. 91