Skip to content

vBlog.nl

All about technology

Menu
  • Home
  • VMware Cloud Director
  • vSphere
  • Automation
    • PowerCLI
    • PowerShell
    • Terraform
  • NSX
  • Horizon DaaS
  • About Us
Menu

vCloud SAML authentication using Azure AD

Posted on May 7, 2020

So today I will show you how to setup vCloud SAML authentication using Azure AD. You can also use on prem AD’s with ADFS but I do not have that available at the moment. And as Azure AD services get used more and more I figured this would be a nice thing to try.

So lets get started shall we? First of let me tell you the components involved that I used to make this setup work:

  • vCloud Directory 10.0.0.15449638
  • Azure AD Premium P2

Table of Contents

  • Setting up Azure AD
      • Adding an Enterprise application
      • Adding users and or groups
      • Setting up Single sign on
  • Setting up vCloud
  • Testing the login
  • Group authentication not working

Setting up Azure AD

Adding an Enterprise application

First lets get started with configuring Azure AD. Once I am logged in to the Azure portal I will have to add an Enterprise application. To do so I have to go over to “Azure Active Directory‘” and select “Enterprise applications“.

Now I click on “New application” and I select “Non-galery application”.

Next I give the application a name and click on “Add” to add the application.

In the new window that opens I have to complete a couple of steps to get things up and running.

Adding users and or groups

First I add the user that will be able to login to vCloud. If you do not have a user created yet now is the time to do this.
I already have a user created so I simply add the user by clicking on “Assing users and groups”.

And now I Add the user

As you can see I added the user “VCD”

Setting up Single sign on

Next up I have to setup Single sign on.

I now select “SAML” to actually start the SAML configuration.

In the newly opened setup page I need to add the metadate information from vCloud. This information is something that I can find in vCloud director so lets open up vCloud and go to Administration –> Identity providers –> SAML

Now I will add the identity ID by clicking “Edit” and filling out the vCloud tenant URL as the id like so:

After I click on save I can download the Metadata by clicking on the Metadate link.

Now I have to go back to the Azure portal and upload the Metadata information I just downloaded.

In the newly opened config sceen I entered the location of the previsously downloaded file and clicked “Add“


Now I need to add some user/group parameters that vCloud can validate (see the VMware vCloud documentation for more info). I do this by clicking on the “User Attributes & Claims” edit button.


Here I have to add some additional claims. So I click on “Add new claim” and I add the “user.assignedroles” claim

Fill in the “Name” for the claim: Roles
Fill in the “Namespace” for the claim: http://schemas.xmlsoap.org/ws/2005/05/Roles
Select the user.assignedroles from the drop down menu for Source attribute and click “Save“

Next up is user.email (this will be the second user.email claim).


Fill in the “Name” for the claim: Username
Fill in the “Namespace” for the claim: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/UserName
Select the user.email from the drop down menu for “Source attribute” and click “Save“

And finally I have to add a “Group claim“.

Select “All groups” and click “Save“



Now All i need to do is download the Azure AD metadata and import it into vCloud.
To do so I go back to the “SIngle Sign on with SAML” by clicking on the link in Azure.

Now download the “Federation Metadata XML” file.


Setting up vCloud

So now that I am all done with the Azure AD part I can finally get vCloud ready.

To do this I need to go back to the SAML configuration page I visited earlier and upload the metadata file I just downloaded.

Administration –> Identity providers –> SAML –> Identity provider –> Enable the check box –>Upload metadate file –> Save

Now all that is left to do for me is to add the user I created earlier and see if I can login to vCloud using Azure AD.

To do so I go to “Users” and select “Import Users“

Now I have to add the user I created earlier in the Azure AD like so:

Enter the user name and select the Role for the user

Testing the login

Yes success !! I am able to login to vCloud using SAML authentication with Azure AD as the authentication source.

If you need to login without SAML authentication just go the the vCloud tenant URL and add /login to the end of the URL.

Group authentication not working

I also tried to use groups instead of users but I run into SSO problems with vCloud, I keep getting SSO authentication failed returns from vCloud.

If you have any suggestions or ideas on how to also authorise groups please leave a command down below so I can try to make it work with not only Users but also with Groups from Azure AD.

If you like this article and want to know more about vCloud please have a look at our other vCloud related articles by clicking here.

 12,693 total views,  17 views today

Share on Social Media
twitter facebook linkedin reddit emailwhatsapptelegram

4 thoughts on “vCloud SAML authentication using Azure AD”

  1. Jitse Hijlkema says:
    May 8, 2020 at 4:29 pm

    Thanks for your article.
    I configured this as test-case and your instructions were very helpful.
    After setting up I also tried to use Groups but that’s not working because of unrecognizable Groups SAML return attribute.
    I din’t found a way to get the SAML response from Azure right, but found a ‘workaround’:

    To prevent ‘pre-staging’ users in vCD you can create a group, like ‘Admins’ in vCD with the correct role.
    When you configure Azure to send the attribute ‘Groups’ with value “Admins” you’re done.

    Now you can assign the Azure application to users without having to create users inside vCD by hand.

    Reply
    1. Arjen Kloosterman says:
      October 22, 2020 at 8:01 am

      Thanks Jitse, I will give this a try.

      Glad the article was useful.

      Reply
  2. Petri Uusitalo says:
    May 22, 2020 at 6:03 pm

    Customize the name of the group claim to “Groups” in Azure AD (it’s case sensitive).

    Then import group object id instead of group name in vCloud.

    Reply
  3. Pascal Saul says:
    February 26, 2021 at 2:47 pm

    @Arjan: after long debugging I found out that not all information in the blog are copy & paste proof.

    @Petri: indeed, well found

    User Attributes & Claims:
    Groups => user.groups
    http://schemas.xmlsoap.org/ws/2005/05/identity/claims/UserName => user.mail
    http://schemas.xmlsoap.org/ws/2005/05/identity/Roles => user.assignedroles

    Group Claims
    Customize the name of the group claim: Groups

    Manage claim
    Name: UserName
    Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity/claims
    Source attribute: user.mail

    Name: Roles
    Namespace: http://schemas.xmlsoap.org/ws/2005/05/identity
    Source attribute: user.assignedroles

    You can individual import a user based on email address or import the group by the Azure “Object Id”. After logging in for the first time by a user which is in the group they will automatically added under Users as well.

    I must admit that the VMware documentation is quite poor. Everything works now at last 🙂

    Reply

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Recent articles

  • VMware Cloud on AWS with FSx for NetApp ONTAP December 28, 2022
  • Workspace ONE Access – Change certificate December 22, 2022
  • UI themes for VMware Cloud Director 10.4.1 and later December 16, 2022
  • VMware Tanzu Kubernetes Grid December 15, 2022
  • Workspace One Access – Not logged in to server FQDN. Please invoke Save before Sync December 12, 2022
  • NSX Edge configuration has failed. 1G hugepage support required. December 7, 2022
  • Horizon DaaS – Unable to connect to Desktop November 24, 2022
  • How to: Request and Install a Lets Encrypt Wildcard SSL on VMware Cloud Director 10.4 October 17, 2022
  • New and improved vSAN 8 explained September 24, 2022
  • How to update a stand alone ESXi host September 13, 2022

Tags

Automation bootstrapping Container Service Extension Credential Manager Desktone.log ESXi EUC EXi GPU Horizon DaaS Instant-Clone Logging NSX nsx-t PowerCLI PowerShell Putty Raspberry PI SSL Tanzu Terraform update vcd-cli vCenter vCloud vCloud Availability vCloud Director VDI vGPU VMware VMworld vSAN vSphere vVols workspace one Zerto

VMware Cloud Provider Blog

  • NSX ALB Licensing with VMware Cloud Director
    by Jaikishan Tayal on March 27, 2023 at 10:33 am

    History of NSX ALB and VCD Licensing: From version 10.2, VMware Cloud Director began supporting NSX-T Advanced Load Balancer (AVI Load Balancer). This integration has become crucial for Cloud Services Providers, allowing them to provide their customers with a range of Load Balancing services (LBaaS) for Virtual Data Center workloads and Tanzu containers. Before the … Continued The post NSX ALB Licensing with VMware Cloud Director appeared first on VMware Cloud Provider Blog.

  • VMware vSAN 8 Update 1 for Cloud Services Providers
    by Christopher Wong on March 24, 2023 at 3:00 pm

    Recently, VMware announced the upcoming release of vSAN 8 Update 1. This latest update enhances vSAN’s capabilities and functionality with additional improvements for performance, data durability, and integration. Cloud Services Providers who are leveraging the capabilities of vSAN 8 can expect to see additional benefits in these areas as they deploy this upcoming release into … Continued The post VMware vSAN 8 Update 1 for Cloud Services Providers appeared first on VMware Cloud Provider Blog.

  • Terraform VMware Cloud Director Provider 3.9.0 – Beta early access build
    by Guy Bartram on March 24, 2023 at 11:06 am

    The release time for version 3.9.0 of Terraform VMware Cloud Director Provider is approaching,and for the first time, we’re releasing a beta, so users can try the new features and give helpful feedback that will improve the final release. What is a “beta” build? A beta build is a preliminary release of an intended new … Continued The post Terraform VMware Cloud Director Provider 3.9.0 – Beta early access build appeared first on VMware Cloud Provider Blog.

  • VMware Cloud Director Object Storage Extension 2.2.1
    by Astha Sharma on March 16, 2023 at 5:45 pm

    Object Storage Extension 2.1.1 The post VMware Cloud Director Object Storage Extension 2.2.1 appeared first on VMware Cloud Provider Blog.

  • Architecting VMware Cloud Director Availability Solution in a Multi-Cloud Environment
    by Nikolay Patrikov on March 15, 2023 at 1:09 pm

    Building a cloud based on VMware Cloud Director or Cloud Director service requires a considerable amount of deployment decisions for Cloud Providers concerning the infrastructure behind their services. They can operate fully on-premises within their data centers or combine them with any of the hyperscalers in a hybrid way. These design decisions affect the DRaaS … Continued The post Architecting VMware Cloud Director Availability Solution in a Multi-Cloud Environment appeared first on VMware Cloud Provider Blog.

©2023 vBlog.nl | Design: Newspaperly WordPress Theme