Stikkordarkiv: Workspace ONE Access

How to add Active Directory using vRealize Suite Lifecycle Manager

You can do this from both vIDM (Workspace One Access) appliance or from the vRealize Suite Lifecycle Manager (vRSLCM) appliance. Changes done in one will sync to the other. In this walkthrough I will configure AD integration using vRSLCM.

Walkthrough

First you need to login as admin@local and go to Identity and Tenant Management then to Directories and Add Directory. Choose Active directory over LDAP

Insert your details as shown in picture below. when you have added all the details click the Test Connection button. If all is green you are good if not you need to start troubleshooting. Start with verifying that all the details indeed are correct.

On the next screen verify that it has found the correct domain and click Save And Next

On the Attribute page you can choose to go with det defaults shown in this picture or you can make changes if needed. Click Save and Next.

In the Group Selection section you must add a DNs for the groups you want to synchronize into vIDM. If you for some reason only want to add users you can do that in the next section. When you are satisfied with your selection click Save and Next.

Select any users you want to sync that is not in any of your synced groups and click Save and Next

In this next section a dry run will be performed and you will get a summary of the users and groups that will be synced and a warning if any of the users don’t contain the required attributes and therefor cannot be synchronized. If you are not satisfied you can always click Back button and do changes. When you are happy click Sync and Complete.

Summary

You can now use AD users and groups within Identity Manager.
It can be smart to go through the directory settings inside the vIDM appliance after setup to change Sync Frequency and other settings. By default the sync is once pr week.

True SSO

If you want to go further and enable true SSO for your users take a look at How to enable True SSO for vRealize Suite logins.

How to enable true SSO for vRealize suite logins

If you have vRealize Suite license it is a good chance that you have deployed a vRealize Suite Lifecycle Manager and the included Identity Manager appliance. If not you probably should! You will have a nice portal for all your vRealize URLs with SSO, but you do not have true SSO all the way from your windows client to your vRealize applications. Users still have to login to the portal each time they want to use it. Here is a quick write up on how to enable kerberos authentication to achieve true SSO.

Attention
If you have vIDM 3.3.3 and 3.3.4 this feature is not working with the embedded connector. please upgrade to 3.3.5 where it is working again.

In this blog I will walk you through how to setup true SSO, but first to some prerequisites.

vIDM portal

Prerequisites

How to setup true-SSO in VMware Identity Manager

If all prerequisite are met we can start the setup. But before we can configure the adapter we need to join the appliance to the domain. Login to your Identity Manager with admin user and go to Identity & Access Management and then Setup

Under Available Actions click Join Domain and Insert username and password to join the domain. You can leave Organizational unit (OU) of domain to join blank or
If you want the machine placed directly in the correct OU, just add the details for your environment. Example: OU=Computers,OU=LAB,DC=lab,DC=vedaa,DC=net

When that is done we can continue and enable KerberosIdpAdapter
Make sure you still are at Identity & Access Management and Setup as before.
Under Worker click on your appliance FQDN and then Auth Adapters

Now click on KerberosIdpAdapter check the box Enable Windows Authentication and click Save. Close the current browser tab.

Go back to Identity & Access Management but this time stay on Manage and click on Policies. Select the default_access_policy_set and click edit

Click next og 2 Configuration and then click on All Ranges (Device Type Web Browser)

Edit the policy by first clicking ADD FALLBACK METHOD. Then change the order of the logins as shown below. First Kerberos then Password and last Password (Local Directory) then click Save, and then Next and Save.

True SSO should now be working form the VMware side of things. If it is not working take a look at thees additional steps.

Additional settings

Here is some additional steps you might need to perform if it is not working. First make sure that vIDM URL is part of local intranet zone. If it is not add it by following thees steps.

In Windows search for Internet Options
In Internet Options, click the Security tab.
On the Security page, select Local intranet.
Click Sites and add your vIDM URL to the list of websites.

It it is still not working verify that Integrated Windows Authentication is enabled.

In the Internet Options window, click the Advanced tab. In the Settings list, under Security, select Enable Integrated Windows Authentication.

Reference

https://docs.vmware.com/en/VMware-Workspace-ONE-Access/3.3/rn/VMware-Identity-Manager-335-Release-Notes.html

VMware vRealize og vCloud Suite kampanje

Fra 01.09.2020 startet VMware en kampanje med 50% rabatt på nykjøp og oppgradering til vRealize og vCloud Suite. Kampanjen varer til 22.01.2021 og er en gyllen mulighet til å få produktene i pakken til en rabattert pris.

Hva er i vRealize Suite standard pakken

vRealize Suite Standard inneholder fire tjenester. vRealize Suite Lifecycle Manager med VMware Identity Manager, vRealize Operations Manager og vRealize Log Insight.

Produktene i vRealize Suite Standard
Produktene i vRealize Suite Standard

vRealize Suite og vCloud Suite pakkene er helt lik med unntak av at vCloud Suite inneholder vSphere Enterprise plus.

vRealize Suite Standard VS vCloud Suite Standard
vRealize and vCloud Suite Pakkene
vRealize SuitevCloud Suite
vRealize Suite Lifecycle ManagervRealize Suite Lifecycle Manager
vRealize Operations ManagervRealize Operations Manager
vRealize Log InsightvRealize Log Insight
VMware Identity ManagerVMware Identity Manager
vSphere Enterprise Plus


Hva kan vRealize Suite brukes til

vRealize Suite inneholder verktøyene du trenger for å full oversikt og kontroll i datasenteret ditt, on-prem eller i sky. For mer info se VMware sine produktsider. Eller sjekk ut noen av VMware innleggene mine

VMware Identity Manager portal satt opp med SSO til alle tjenestene i vRealize Suite I tillegg til NSX og vRealize Network Insight
VMware Identity Manager portal satt opp med SSO til alle tjenestene i vRealize Suite I tillegg til NSX og vRealize Network Insight

Hvem kan utnytte rabatten?

De fleste kan utnytte denne rabatten da den gjelder på ny kjøp av vRealize Suite og oppgradering for dem med eksisterende vRealize Operations Standard lisenser (pr CPU)
Man kan også benytte rabatten ved oppgradering av vSphere lisenser til vCloud Suite, se listen under for detaljer.

ProduktnummerProdukt Beskrivelse
VR19-STD-PROVMware vRealize Suite 2019 Standard (Per PLU) Promo
CL19-STD-PROVMware vCloud Suite 2019 Standard Promo
CL19-STD7-STD-UG-PROUpgrade: VMware vSphere 7 Standard to vCloud Suite 2019 Standard Promo
CL19-ENT7-STD-UG-PROUpgrade: VMware vSphere 7 Enterprise to vCloud Suite 2019 Standard Promo
CL19-EPL7-STD-UG-PROUpgrade: VMware vSphere 7 Enterprise Plus to vCloud Suite 2019 Standard Promo
VR19-OSTC-STD-UG-PROUpgrade: VMware vRealize Operations 8 Standard (Per CPU) to VMware vRealize Suite 2019 Standard (Per PLU) Promo
vRealize og vCloud Suite oppgraderingsvalg

Referanser

https://www.vmware.com/se/promotions/2020-vrealize-suite.html
https://blogs.vmware.com/management/2020/08/vrealize-vcloud-suite-promo.html
https://www.vmware.com/products/vrealize-suite.html

Passord fri hverdag med VMware Workspace One Access

Workspace One

Jeg har enda tilgode å møte noen som syntes det er gøy å logge inn i mange forskjellige løsninger. Man kunne håpet at man var kommet lenger, men dessverre er det fremdeles mange som må slite med en haug med forskjellige brukernavn og passord.

For noen dager siden fikk jeg en god opplevelse ved å få på plass full «Single Sign-On» fra Windows klient via portal og inn applikasjonen uten å oppgi et eneste bruksnavn eller passord. Produktet benyttet heter VMware Workspace One Access.

Workspace ONE Access kan settes opp i eget datasenter eller kjøpes som en SAAS tjeneste fra VMware.

Katalogen

Workspace ONE Access applikasjonen inneholder en katalog man kan fylle med snarveier til alle selskapets applikasjoner og desktops. Den støtter interne og eksterne nettsider, Citrix Publiserte Applikasjoner samt Horizon desktops lokalt eller i skyen.

Løsningen Inneholder også over 100 ferdig konfigurerte SAAS tjenester for SAML mot tjenester som Office 365, Google Apps, Dropbox, AWS, Salsforce, Webex m.m.

I tillegg til SAML 2.0 og 1.1 støtter den også WSFed 1.2 og OpenID Connect mot tjenesten du skal ta inn i løsningen og på andre siden kan den kobles mot AD, ADFS, AAD, Okta, og Ping. Dette gjør at man kan skape en bro mellom flere identitets kilder og applikasjoner og på den måten kunne gi passord fri tilgang til brukene gjennom Workspace One portalen.

Under er et bilde av hvordan samlingen av linker og applikasjoner kan se ut. Her brukt sammen med vRealize Suite Lifecycle Manager for å samle å gi passord fri tilgang til disse VMware tjenestene.

Samling av snarveier i Workspace ONE Access katalogen med Single Sign-on til alle vRealize produktene og NSX.

Man kan også enkelt styre tilgang til hver enkelt link, sette på godkjenning for utvalte programmer og begrense tilgang til spesifikke applikasjoner basert på forskjellige kriterier. Det er også støtte for MFA.

Hva mer kan Workspace ONE Access?

Det er mye mer Workspace One Access kan brukes til som jeg ikke har vært innom her, se video under for en dyperer gjennomgang.

VMware Workspace One Access: End-User Experience – Feature Walk-Through

VMware Workspace ONE Access: End-User Experience – Feature Walk-through

Gratis prøveperiode ut Juli 2020 pga Korona

VMware gir for tiden utvidet testperiode for dem som ønsker å prøve ut Workspace One
https://www.vmware.com/solutions/business-continuity.html

Dokumentasjon

Produktsidenhttps://www.vmware.com/products/workspace-one/access.html
TechZonehttps://techzone.vmware.com/resource/workspace-one
VMware Docs https://docs.vmware.com/en/VMware-Workspace-ONE-Access/index.html

Limitations when using Workspace One Access for «free» with vRSLCM?

Workspace One Access or vIDM «Content Catalog» vRealize shortcuts with SSO login

When you install vRealize Suite Lifecycle manager It comes with the Workspace One Access (VMware Identity Manager) And in this appliance you get a lot of options and no limitations in any way. So it is up to you to avoid using any features that you are not allowed to use. If you do then you might be in breach of the EULA.

So I went on a google search for answers to this question and boy I can tell you that it is not straight forward. I have also tried to get VMware to give me a statement or point me to the correct documentation where they say what I can and can’t do.

Why is this an issue?

As I said you are not limited in any way and you could use all its functionality. But if you do you would then be in breach og the EULA according to an VMware Product Manager. So a problem arises, you could easily be in a breach without knowingly doing so.

After some investigation I was pointed to the VMware Product Guide where the following is stated.

Official documentation

Workspace ONE Access feature. A license to use VMware NSX Data Center (any edition) or NSX Cloud (any edition) includes an entitlement to use the Workspace ONE Access feature, but only for the following functionalities:

  • directory integration functionality of Workspace ONE Access to authenticate users in a user directory such as Microsoft Active Directory or LDAP
  • conditional access policy
  • single-sign-on integration functionality with third party Identity providers to allow third party identityproviders’ users to single-sign-on into NSX
  • two-factor authentication solution through integration with third party systems. VMware Verify,VMware’s multi-factor authentication solution, received as part of Workspace ONE Access, may not beused as part of NSX, and
  • single-sign-on functionality to access VMware products that support single-sign-on capabilities.

A license to use VMware vRealize Log Insight includes an entitlement to use the Workspace ONE Access feature, but only for the following functionalities:

  • directory integration functionality of Workspace ONE Access Standard to authenticate users in a user directory such as Microsoft Active Directory or LDAP
  • conditional access policy
  • single-sign-on integration functionality with third party Identity providers to allow third party Identityproviders’ users to single-sign-on into vRealize Log Insight
  • two-factor authentication solution through integration with third party systems. VMware Verify,VMware’s multi-factor authentication solution, received as part of the Workspace ONE Access feature,may not be used as part of vRealize Log Insight, and
  • single-sign-on functionality to access VMware products that support single-sign-on capabilities.

So is this now solved?

The quick answer is NO, when you look at the text I would interpret it to only apply if I have NSX and or Log insight license. Not for vRA, vRops, vRNI, vRB and vRSLCM. I would also argue that there is a problem with the wording. If you look at point 4 and 5 and the inclusion of , and at the end, does it imply that point 5 is also not allowed?

And what about when they first say «but only for the following functionalities« and then inside a point they say «may not be used« What may not be used?

That I may not use single sign on with anything else than NSX and vRLI?
«single-sign-on functionality to access VMware products that support single-sign-on capabilities»

I honestly don’t know that to get out of this other than it doesn’t apply to this use case and that it is a shoehorn attempt to make a text fit something it is not meant to fit.

Other Clues?

When you look at the VMware download page for Identity Manger 3.3.1 it clearly stated what it can be used for. But it doesn’t go into details.
«Download VMware Identity Manager 3.3.1 (for vRA, vRops, vRLI, vRB, vRNI, NSX only)«

If any of you have any insight on this please give me an update.

To be continued…..