Hello, I am Pim van de Vis, Staff Solution Engineer at VMware End User Computing.
Welcome to this operational tutorial on integrating VMware Dynamic Environment Manager with Microsoft
OneDrive for Business.
This is the third video in a series of four videos which are part of the tutorial that
can be found on VMware TechZone.
This video will show how to install the Workspace ONE Access connector to enable Kerberos in
the authentication flow.
And this video will guide you through the configuration of Workspace ONE Access to synchronize
users from Active Directory, add the Office 365 federation app and change the Access policy
rules.
In the 2nd video the federation has been configured and the correct permissions for the Dynamic
Environment Manager agent to access OneDrive for Business have been configured.
The next step is to enable Kerberos in the authentication flow.
This is enabled through a feature of the Workspace ONE Access connector, so this will be installed.
After that, this video will cover the configuration steps needed in Workspace ONE Access to allow
seamless authentication for internal clients.
Let’s get started!
Start with installing the VMware Workspace ONE Access Connector.
This is wizard driven and can be started by going to ‘Integration’ – ‘Connectors’
and click on ‘New.’
Choose the latest version of the connector and use the provided link to download the
installer for the connector from myware.com.
Next step is to download the configuration JSON file.
Choose a password to protect this file and continue to download.
Close the wizard and start the installation of the Workspace ONE Access connector.
Make sure the ‘Kerberos Auth Service’ component gets installed.
Select the downloaded JSON configuration file and provide the chosen password.
In this case a custom installation will be performed to show the available options.
A trusted root certificate is typically only needed for on-prem installations of Workspace
ONE Access.
Cloud hosted Access instances already have a public trusted certificate.
Make sure the required ports are accessible.
The Kerberos Auth Service will use port 443 and requires an SSL certificate.
In this case the internal Certificate Authority has created a certificate.
Provide the password to allow the installation of the SSL certificate.
Last step is to select a service account that will be used to run the Kerberos Auth Service
and the Workspace ONE Access connector will be installed.
After the installation has completed, go back to the Workspace ONE Access web console, and
refresh the connector status screen.
It should show all green Health checkboxes for the connector components.
Now add the Active Directory as an identity directory for Workspace ONE Access.
This step will synchronize all on-prem Active Directory users accounts to Workspace ONE
Access.
Go to ‘Directories’ and choose Add Active Directory.
Type the directory name and select ‘Active Directory over Integrated Windows Authentication.’
Provide the Bind User Details and click Save and Configure.
Check which User Attributes are mapped and make sure the objectGUID is mapped.
Select which users and groups are synchronized.
Service accounts, administrator accounts, etc. might not be needed in Access, so the
same principle as with the Azure Ad Connect Tool applies: it is recommended to only synchronize
the OU’s that contain the users and groups that are needed in Workspace ONE Access.
Specify the Sync Frequency and start the synchronization.
Go to ‘Accounts’ to check if all accounts are synchronized successfully.
Go back to ‘Integrations’ and select ‘Connector Authentication Methods.’
Choose ‘New’ and add Kerberos authentication.
If multiple Workspace ONE Access Connectors are installed behind a load balancer, make
sure to switch ‘Enable Redirect’ to ‘yes.’
Now a new Workspace Identity Provider can be added based on Kerberos Authentication.
Go to ‘Identity Providers,’ click ‘Add Identity Provider’ and select ‘Create
Workspace IDP.’
Provide an IDP name, select the user’s directory that can authenticate using this IDP, put
the ‘Authentication’ method to ‘Kerberos’ and select which network this IDP can be accessed
from.
Since we only want to allow Kerberos for internal clients, select only the Local Area Network.
This video will also show how to create a new network range.
Last step is to provide the IDP hostname, which is the FQDN of the load balancer or
the server where the Workspace ONE Access connector is installed.
Now, let’s add the “Office365 with Provisioning” app to Workspace ONE Access to allow seamless
authentication into Office 365.
Go to ‘Resources,’ ‘New,’ search for ‘365’ and select the ‘Office365 with
Provisioning’ app.
To allow Single Sign On to Office 365, only two values need to be provided: ‘tenant’,
which should contain the federated domain name, and ‘issuer’ which should contain
the URL to the Workspace ONE Access tenant.
In this case the ‘default_access_policy_set’ will be used.
Save the application and assign it.
In this case the app will be assigned to ‘all users.’
Make sure the Deployment Type is set to ‘Automatic’
The last step of this video is to change the Access Policy to use the Kerberos authentication
when needed.
The Kerberos Auth service requires inbound connectivity while the other services do not.
This means the VDI desktops running Dynamic Environment Manager need a line of sight to
this connector hosted on an internal server.
To support this, the Access Policy will be configured so that only internal clients will
use the Kerberos Authentication IDP.
Go to ‘Resources,’ ‘Policies’ and select ‘Network Ranges.’
Add a new range and specify the IP subnet for your internal clients.
To make sure the internal clients can be identified by the originating IP address, X-Forwarded-For
needs to be enabled.
For SAAS hosted Workspace ONE Access tenants, a workaround is to add the external IP address
of the firewall to the Network Ranges.
More information on this can be found in the documentation.
Now edit the ‘default_access_policy_set’ or create a new policy set.
Configure the users ‘network range’ to ‘LAN’ and select ‘Kerberos’ as the
first authentication method.
Make sure to do this for the device types ‘Windows 10’ and ‘Web Browser’.
Optionally you can define fallback authentication methods or create multiple access policy sets
to support all authentication requests in the organization.
To conclude this video two checkboxes, need to be configured to make authentication to
Workspace ONE Access seamless: ‘Show the System Domain on Login Page’ needs to be
disabled and ‘Hide “Change to a different domain” Link on Login Page’ must be enabled.
Thanks for watching this video.
I hope to see you on the fourth and final video of this series.