7.3

Table Of Contents

Managing Authentication Methods to Apply to Users

The Directories Management service attempts to authenticate users based on the authentication

methods, the default access policy, network ranges, and the identity provider instances you configure.

When users attempt to log in, the service evaluates the default access policy rules to select which rule in

the policy to apply. The authentication methods are applied in the order they are listed in the rule. The first

identity provider instance that meets the authentication method and network range requirements of the

rule is selected and the user authentication request is forwarded to the identity provider instance for

authentication. If authentication fails, the next authentication method configured in the rule is applied.

You can add rules that specify the authentication methods to be used by device type or by device type

and from a specific network range. For example, you could configure a rule requiring users that sign in

using iOS devices from a specific network to authenticate using RSA SecurID and another rule that

specifies all device types signing in from the internal network IP address to authenticate using their

password.

Add or Edit a Network Range

You can manage the network ranges to define the IP addresses from which users can log in via an Active

Directory link. You add the network ranges you create to specific identity provider instances and to access

policy rules.

Define network ranges for your Directories Management deployment based on your network topology.

One network range, called ALL RANGES, is created as the default. This network range includes every IP

address available on the Internet, 0.0.0.0 to 255.255.255.255. Even if your deployment has a single

identity provider instance, you can change the IP address range and add other ranges to exclude or

include specific IP addresses to the default network range. You can create other network ranges with

specific IP addresses that you can apply for specific purpose.

Note The default network range, ALL RANGES, and its description, "a network for all ranges," are

editable. You can edit the name and description, including changing the text to a different language, by

clicking the network range name on the Network Ranges page.

Prerequisites

You have configured tenants for your vRealize Automation deployment set up an appropriate Active

Directory link to support basic Active Directory user ID and password authentication.

Active Directory is installed and configured for use on your network.

Procedure

1 Select Administration > Directories Management > Network Ranges.

Configuring vRealize Automation

VMware, Inc. 137