7.1

What to do next
n
Copy and save the Directories Management service provider metadata that is required to congure the
third-party identity provider instance. This metadata is available either in the SAML Signing Certicate
section of the Identity Provider page.
n
Add the authentication method of the identity provider to the services default policy.
See the Seing Up Resources in Directories Management guide for information about adding and customizing
resources that you add to the catalog.
Managing Authentication Methods to Apply to Users
The Directories Management service aempts to authenticate users based on the authentication methods,
the default access policy, network ranges, and the identity provider instances you congure.
When users aempt to log in, the service evaluates the default access policy rules to select which rule in the
policy to apply. The authentication methods are applied in the order they are listed in the rule. The rst
identity provider instance that meets the authentication method and network range requirements of the rule
is selected and the user authentication request is forwarded to the identity provider instance for
authentication. If authentication fails, the next authentication method congured in the rule is applied.
You can add rules that specify the authentication methods to be used by device type or by device type and
from a specic network range. For example, you could congure a rule requiring users that sign in using
iOS devices from a specic network to authenticate using RSA SecurID and another rule that species all
device types signing in from the internal network IP address to authenticate using their password.
Add or Edit a Network Range
You can manage the network ranges to dene the IP addresses from which users can log in via an Active
Directory link. You add the network ranges you create to specic identity provider instances and to access
policy rules.
Dene network ranges for your Directories Management deployment based on your network topology.
One network range, called ALL RANGES, is created as the default. This network range includes every IP
address available on the Internet, 0.0.0.0 to 255.255.255.255. Even if your deployment has a single identity
provider instance, you can change the IP address range and add other ranges to exclude or include specic
IP addresses to the default network range. You can create other network ranges with specic IP addresses
that you can apply for specic purpose.
N The default network range, ALL RANGES, and its description, "a network for all ranges," are
editable. You can edit the name and description, including changing the text to a dierent language, by
clicking the network range name on the Network Ranges page.
Prerequisites
n
You have congured tenants for your vRealize Automation deployment set up an appropriate Active
Directory link to support basic Active Directory user ID and password authentication.
n
Active Directory is installed and congured for use on your network.
n
Log in to the vRealize Automation console as a tenant administrator.
Procedure
1 Select Administration > Directories Management > Network Ranges.
Chapter 2 Configuring Tenant Settings
VMware, Inc. 111