7.1

n
Create a claim rule that transforms the aributes retrieved from LDAP in the Get Aributes rule
into the desired SAML format. After you create the rule,. you must edit the rule by adding the
following text:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier",
Issuer = c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType =
c.ValueType,
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifie
r"] = "vmwareidentity.domain.com");
Configure SAML Federation Between Directories Management and SSO2
You can establish SAML federation between vRealize Automation Directories Management and systems
that use SSO2 to support single sign on.
Establish federation between Directories Management and SSO2 by creating a SAML connection between
the two parties. Currently, the only supported end-to-end ow is where SSO2 acts as the Identity Provider
(IdP) and Directories Management acts as the service provider (SP).
For SSO2 user authentication, the same account must exist in both Directories Management and SSO2.
Minimally, the UserPrincipalName (UPN) of the user has to match on both ends. Other aributes can dier
as they are required to identify the SAML subject.
For local users in SSO2, such as [e-mail], corresponding accounts must also exist in
Directories Management, where at least the UPN of the user matches. Create these accounts manually or
with a script using the Directories Management local user creation APIs.
Seing up SAML between SSO2 and Directories Management involves conguration on the Directories
Management and SSO components.
Table 2‑4. SAML Federation Component Configuration
Component Configuration
Directories Management Congure SSO2 as a third-party Identity Provider on Directories Management and
update the default authentication policy. You can create an automated script to set up
Directories Management.
SSO2 component Congure Directories Management as a service provider by importing the
Directories Management sp.xml le. This le enables you to congure SSO2 to use
Directories Management as the Service Provider (SP).
Prerequisites
n
Congure tenants for your vRealize Automation deployment. See “Create Additional Tenants,” on
page 136.
n
Set up an appropriate Active Directory link to support basic Active Directory user ID and password
authentication.
n
Log in to the vRealize Automation console as a tenant administrator.
Procedure
1 Download SSO2 Identity Provider metadata through the SSO2 user interface.
a Log in to vCenter as an administrator at https://<cloudvm-hostname>/ .
b Click the Log in to vSphere Web Client link.
c On the left navigation pane, select Administration > Single Sign On > .
Configuring vRealize Automation
86 VMware, Inc.