hi my name is Peter Bjork in this video I'll walk you through the connectors user
authentication service the user authentication service also known as the
enterprise authentication service adds supports for Active Directory user name
and password authentication as well as RADIUS and RSA SecurID integration you
install the user authentication service on a Windows server where it runs as a
Windows service the user authentication service was introduced with version 2001
of access with it came the change to only support outbound only mode which
means users communicate only with the workspace one access service during
authentication never directly with the connector the user authentication
service should be tied to the system using the built in identity provider
type configuring user authentication service is easy you deploy the service
and then tie it to one or more Enterprise authentication methods such
as password RADIUS or RSA SecurID using the access admin web console then you
must activate the authentication method using an identity provider connecting
your user store and network ranges together once done you can make use of
the authentication methods within your access policies you can easily add more
user authentication services for load balancing and redundancy regarding
sizing of the user authentication service or enterprise authentication
service EAS in short it's much better to scale by adding more nodes rather than
trying to add more hardware to a single node and you can host multiple different
connector services on one and the same Windows machine the user authentication
service logs can be found in the logs folder within the installation folder
you can also run the script gather user auth
service logs to collect all logs into a single
compressed file let's have a look at the flow of communication when using the
authentication methods of the user authentication service the connector
already has the communication channel established with the access service when
users try to gain access to the workspace one access portal and since
outbound only mode is used it is the access service prompting the users to
enter their credentials the service collects the input and sends it via the
communication channel to the user authentication service for validation
now the connector connects to the backend to verify their credentials here
Active Directory but the backend could also be RADIUS or
RSA SecurID once credentials has been successfully validated the connector
notifies the service and the user is allowed access when setting up your
workspace one access from scratch you begin with creating a new connector
instance in the Access admin web console this generates a password-protected
configuration file you copy this file to your windows server and reference it
during the connector installation once installed you go back to the access
admin console and now you can create your enterprise authentication methods
when you create an authentication method you can select which of your connector
instances or service hosts you want to perform the authentication then you
activate the authentication method in the identity provider and lastly you can
start using it within your access policies next let's deploy a new
instance of the user authentication service I've already created a new
connector instance called connector two pinata.local
but it's only running the directory sync service we will add the user
authentication service to this connector my Windows machine already have the
connector installer and the configuration file I run the
installer and add the user authentication service
I have to enter the password protecting the configuration file and then I click
Next
choosing the custom installation option I can add things like an outbound proxy
external syslog server and add a root certificate if my workspace one access
service happens to run a untrusted certificate if the connector doesn't
trust a certificate used by the Access and its service URL it cannot establish the
communication channel with it the user authentication service requires a TCP
port no inbound traffic is made to this port so as long as the port is available
on your system you can happily leave it as is once installed you can see the
service running on your machine next I'll verify the new service is
registered and active in my admin console in my case I want the new
connector service to handle Active Directory user name and password
authentication method therefore I'll add it to my existing configuration
I will test its functionality by disabling user authentication service on
my old connector and then try to authenticate as a regular user
that seems to be working but let's verify by looking at the logs on my new
connector
here you can see the authentication was initiated and the result was successful
before I end I'll activate the authentication service on my old
connector again and that was it please visit techzone.vmware.com for
more technical in-depth content