in this video I'll explain the identity providers setting within the workspace
one access admin console in previous videos I outline the components of
access using this image but I have to admit I simplified it a little bit to
incorporate Network ranges and external authentication methods such as those
from the connector or third-party identity providers we need something
that ties it all together and in Access this is called identity providers not to
be confused with a function of being an identity provider the function of being
an identity provider is what access performs when access acts as the
identity provider the identity providers we are looking at in this video is
inbound to access itself in other words how users can authenticate into access
you tie user stores authentication methods and network ranges together with
the identity providers setting and then you can reference the authentication
methods within your access policies let's dive a little deeper workspace one
access supports three kinds of identity providers the workspace IDP or the
workspace one access type the built in and lastly the third party type the
workspace IDP identity provider supports the Active Directory Kerberos
authentication method which is one of the authentication methods delivered by
the connector the built in identity provider is the most commonly used one
this identity provider supports all the other authentication methods supported
by either the access service itself or the connector and as the name indicates
the third-party identity provider supports adding an external SAML
identity provider when configuring the identity providers you must also specify
for which user store and network ranges it is
applicable before you can make use of the authentication methods within your
access policies but there is one more thing to cover before we'll have a look
at how this looks like in the real world the system directory and the
authentication method password local directory is needed for your local admin
login the system identity provider is your first identity provider and is
created automatically I highly recommend leaving the system identity provider to
handle the system directory and the password local directory authentication
method do not add the system directory or password local directory to any of
your other identity providers it will only complicate your setup and make a
mess out of your access policies here is my current setup so far I have three
identity providers I've left the system identity provider alone except changed
its network range to only allow the network range LAN I have a third party
IDP allowing for Azure AD to authenticate users into my access tenant
and my main identity provider in this setup is the last one listed the built
in identity provider called identity provider access authentication methods
it has only two of the indication method activated password and radius the cloud
deployment part of the name simply means clients will only talk to the service
during authentication there will be no redirection to the connector looking at
its settings you can see it's tied to my Active Directory synched user store and
allows both of my network ranges I've activated two authentication methods but
I want to add some more but before I do let me show you what authentication
methods I have available at this point in time in my access policies as you can
see I only have five different authentication methods to choose from
now I'll activate some more authentication methods so I can build
more advanced access policies I'll activate the certificate based
authentication method next I need to activate the new authentication methods
within my identity provider I add device compliance and certificate based
authentication method now my main built-in identity provider lists a total
of four authentication methods and now I can make use of the new authentication
methods within my access policies
and while added let's make the access policies a little more relevant advanced
adding chained method of authentication and a proper fallback with this setup
both the certificate and the device compliance check must be successful if
not users will be sent to the fallback method which is Active Directory
username a password as well as Radius
but I'm not quite done for my LAN connected devices I want to offer
seamless Kerberos login no point in prompting for a username and password if
the users already successfully logged in to Active Directory to support Active
Directory Kerberos authentication we need a connector with the Kerberos
authentication service deployed in my case I've already implemented a
connector supporting Kerberos next I need to create a new identity provider
of the type workspace IDP I give it a name and tie it to my user store I
enable only the LAN network range and lastly I have to tell access what URL
to use to redirect users to my connector for Kerberos authentication to work
users devices must communicate directly with the connector my new identity
provider is listed as an identity provider with all its settings and now I
can make use of the Kerberos authentication method within my access
policies
and that was all I hope this video helped explain the identity providers
setting within workspace one access for more technical in-depth assets please
visit techzone.vmware.com