{"id":157,"date":"2021-01-30T01:39:52","date_gmt":"2021-01-29T23:39:52","guid":{"rendered":"https:\/\/my-virt.alfadir.net\/?p=157"},"modified":"2021-01-30T01:51:24","modified_gmt":"2021-01-29T23:51:24","slug":"vcenter-7-depreciation-of-iwa","status":"publish","type":"post","link":"https:\/\/my-virt.alfadir.net\/index.php\/2021\/01\/30\/vcenter-7-depreciation-of-iwa\/","title":{"rendered":"vCenter 7 – Depreciation of IWA…"},"content":{"rendered":"\n

Every Friday we have an informal meeting with peoples from VMware PS: Architect, Sr Consultant and Consultant but also TAM and Project manager as well and today we spoke about the depreciation of IWA with vCenter 7 and so the necessity to move to AD FS for upcoming release :<\/p>\n\n\n\n

Deprecation of Integrated Windows Authentication<\/p>

Integrated Windows Authentication (IWA) is deprecated in vSphere 7.0 and will be removed in a future release. For more information, see VMware Knowledge Base article 78506<\/a><\/p><\/blockquote>\n\n\n\n

So we started to have look about how to move from IWA to AD FS and for this I deployed a brand new vCenter 7 on my own labs as many questions arise : How other applications will deal with this change (I mainly thought to Horizon and App Volumes Manager) but also could we still connect using the local vsphere.local domain. Spoiler : Yes it works for both (external apps and using local account) <\/p>\n\n\n\n

Now let see how to configure this \ud83d\ude42<\/p>\n\n\n\n\n\n\n\n

First ensure you have added your AD FS root certificate in the vCenter trust store<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Secondly we need to retrieve the URI from the vCenter :
Go to Menu \\ Administration<\/strong> then Single Sign On \\ Configuration<\/strong>
Click the “i”<\/strong> right to “Change Identity Provider<\/strong>” and copy \/ past information or keep this page open<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now go to you ADFS server, open the AD FS Console and after doing a “right click<\/em>” on Application Group<\/strong>, select “Add Application Group…<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select “Server application accessing a web API”<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Copy and past in Notepad the “Client Identifier<\/strong>“
Copy and past both URI from the vCenter to “Redirect URI<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Click “Generate a shared secret<\/strong>” and copy\/past the secret to Notepad<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Type a name and past the Identifier <\/strong>you copied to Notepad few steps before:<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select “Permit Everyone<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Check “allatclaims<\/strong>” and verify “openid<\/strong>” is already checked <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Control every thing is ok and click Next <\/strong>to complete the wizard<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now we have few change to perform so vCenter will be able to understand what is sent to him and so authenticate your users:
Right click on your vCenter application group and select “Properties<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select the Web-API <\/strong>and click Edit<\/strong>
Select tap “Insuance Transform Rules<\/strong>“
Click “Add Rules<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Give a name like “AD Group with Qualified Long Name<\/strong>“
Select “Active Directory<\/strong>” as Attribute Store
Select “Token-Groups – Qualified by Long Domain Name<\/strong>” as LDAP Attribute
Select “Group<\/strong>” as Outgoing Claim Type
Click OK<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Add another rule :
Give a name like “Subject Claim<\/strong>“
Select “Active Directory<\/strong>” as Attribute Store
Select “User-Principal-Name<\/strong>” as LDAP Attribute
Select “Name ID<\/strong>” as Outgoing Claim Type
Click OK<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

And finally add a third rule :
Give a name like “User Principal Name<\/strong>“
Select “Active Directory<\/strong>” as Attribute Store
Select “User-Principal-Name<\/strong>” as LDAP Attribute
Select “UPN<\/strong>” as Outgoing Claim Type
Click OK<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

That is for AD FS no let’s come back to your vCenter
Go to Menu \\ Administration<\/strong> then Single Sign On \\ Configuration<\/strong>
Click “Change Identity Manager<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Select “Microsoft ADFS<\/strong>“<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Copy your “Client Identifier<\/strong>” from AD FS
Copy your “Shared secret<\/strong>” from AD FS
Specify the OpenID Address who should be : https:\/\/<federation_fqdn>\/.well-known\/openid-configuration<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

File information about the LDAP configuration<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Check everything is fine and click Finish<\/strong><\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now go to Menu \\ Administration<\/strong> then Single Sign On \\ Users and Groups \\ Groups<\/strong>
Click “Add<\/strong>” to add a group
Give a name to your group
In Add Members, select “Microsoft ADFS<\/strong>“
Type the first letters of the group, it should find it
Click “Add<\/strong>“
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Now go to Menu \\ Administration<\/strong> then Access Control \\ Global Permissions<\/strong>
Click “+<\/strong>“
Select Microsoft ADFS in “Domain”
Select your group in “User \/ Group”
Select the role you want to set for this group<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

You can log in using your AD FS Account \ud83d\ude42<\/p>\n\n\n\n

As I wrote before : no issue with Horizon :
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Or with App Volumes
<\/p>\n\n\n\n

\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"

Every Friday we have an informal meeting with peoples from VMware PS: Architect, Sr Consultant and Consultant but also TAM and Project manager as well and...<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-157","post","type-post","status-publish","format-standard","hentry","category-vsphere"],"_links":{"self":[{"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/posts\/157","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/comments?post=157"}],"version-history":[{"count":3,"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/posts\/157\/revisions"}],"predecessor-version":[{"id":186,"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/posts\/157\/revisions\/186"}],"wp:attachment":[{"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/media?parent=157"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/categories?post=157"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/my-virt.alfadir.net\/index.php\/wp-json\/wp\/v2\/tags?post=157"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}