7.1

Integrating Alternative User Authentication Products with Directories
Management
Typically, when you initially congure Directories Management, you use the connectors supplied with your
existing vRealize Automation infrastructure to create an Active Directory connection for user ID and
password based authentication and management. Alternatively, you can integrate Directories Management
with other authentication solutions such as Kerberos or RSA SecurID.
The identity provider instance can be the Directories Management connector instance, third-party identity
provider instances, or a combination of both.
The identity provider instance that you use with the Directories Management service creates an in-network
federation authority that communicates with the service using SAML 2.0 assertions.
When you initially deploy the Directories Management service, the connector is the initial identity provider
for the service. Your existing Active Directory infrastructure is used for user authentication and
management.
The following authentication methods are supported. You congure these authentication methods from the
administration console.
Table 2‑8. User Authentication Types Supported by Directories Management
Authentication Types Description
Password (on-premise deployment) Without any conguration after Active Directory is congured,
Directories Management supports Active Directory password authentication. This
method authenticates users directly against Active Directory.
Kerberos for desktops Kerberos authentication provides domain users with single sign-in access to their
apps portal. Users do not need to sign in again after they sign in to the network.
Certicate (on-premise
deployment)
Certicate-based authentication can be congured to allow clients to authenticate
with certicates on their desktop and mobile devices or to use a smart card adapter
for authentication.
Certicate-based authentication is based on what the user has and what the person
knows. An X.509 certicate uses the public key infrastructure standard to verify
that a public key contained within the certicate belongs to the user.
RSA SecurID (on-premise
deployment)
When RSA SecurID authentication is congured, Directories Management is
congured as the authentication agent in the RSA SecurID server. RSA SecurID
authentication requires users to use a token-based authentication system. RSA
SecurID is an authentication method for users accessing Directories Management
from outside the enterprise network.
RADIUS (on-premise deployment) RADIUS authentication provides two-factor authentication options. You set up the
RADIUS server that is accessible to the Directories Management service. When
users sign in with their user name and passcode, an access request is submied to
the RADIUS server for authentication.
RSA Adaptive Authentication (on-
premise deployment)
RSA authentication provides a stronger multi-factor authentication than only user
name and password authentication against Active Directory. When RSA Adaptive
Authentication is enabled, the risk indicators specied in the risk policy set up in
the RSA Policy Management application. The Directories Management service
conguration of adaptive authentication is used to determine the required
authentication prompts.
Mobile SSO (for iOS) Mobile SSO for iOS authentication is used for single sign-on authentication for
AirWatch-managed iOS devices. Mobile SSO (for iOS) authentication uses a Key
Distribution Center (KDC) that is part of the Directories Management service. You
must initiate the KDC service in the VMware Identity Manager service before you
enable this authentication method.
Chapter 2 Configuring Tenant Settings
VMware, Inc. 101