7.2

c Click the + icon under the Policy Rules heading to add a new rule.
Use the fields on the Add a Policy Rule page to create a rule that specifies the appropriate
primary and secondary authentication methods to use for a specific network range and device.
For example, if the user's network range is "My Machine", and the user needs to access content
from "All Device Types," then, for a typical deployment, that user must authenticate using the
following method: ADFS Username and Password.
d Click Save to save your policy updates.
e On the Default Policy page, drag the new rule to the top of the table so that it takes precedence
over existing rules.
5 Using the Active Directory Federated Services management console, or another appropriate tool, set
up a relying party trust relationship with the vRealize Automation identity provider.
To set up this trust, you must import the Directories Management metadata that you previously
downloaded. See the Microsoft Active Directory documentation for more information about
configuring Active Directory Federated Services for bi-directional trust relationships. As part of this
process, you must do the following:
n
Set up a Relying Party Trust. When you set up this trust, you must import the VMware Identity
Provider service provider metadata XML file that you copied and saved
n
Create a claim rule that transforms the attributes retrieved from LDAP in the Get Attributes rule
into the desired SAML format. After you create the rule,. you must edit the rule by adding the
following text:
c:[Type == "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/emailaddress"]
=> issue(Type = "http://schemas.xmlsoap.org/ws/2005/05/identity/claims/nameidentifier", Issuer
= c.Issuer, OriginalIssuer = c.OriginalIssuer, Value = c.Value, ValueType = c.ValueType,
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/format"] =
"urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress",
Properties["http://schemas.xmlsoap.org/ws/2005/05/identity/claimproperties/spnamequalifier"] =
"vmwareidentity.domain.com");
Configure SAML Federation Between Directories Management and SSO2
You can establish SAML federation between vRealize Automation Directories Management and systems
that use SSO2 to support single sign on.
Establish federation between Directories Management and SSO2 by creating a SAML connection
between the two parties. Currently, the only supported end-to-end flow is where SSO2 acts as the Identity
Provider (IdP) and Directories Management acts as the service provider (SP).
For SSO2 user authentication, the same account must exist in both Directories Management and SSO2.
Minimally, the UserPrincipalName (UPN) of the user has to match on both ends. Other attributes can
differ as they are required to identify the SAML subject.
For local users in SSO2, such as [e-mail], corresponding accounts must also exist in
Directories Management, where at least the UPN of the user matches. Create these accounts manually
or with a script using the Directories Management local user creation APIs.
Configuring vRealize Automation
VMware, Inc. 104