Hi my name is Peter Björk and I'm a senior staff architect at VMware in this
video I will explain the enhancements in support of third-party identity
providers that we added in VMware Identity Manager version 19.03. With the
19.03 release we now support receiving the user identifier in a SAML assertion
not only in the subject statement but also in the attribute statement this
allows us to support a broader range of third-party identity providers typically
when you add a third-party identity provider the user identifier is passed
in the subject statement once the user is authenticated VMware Identity Manager
can send the user forward with a new SAML assertion but there are some
identity providers who will not send the user identifier in the subject they
typically send a persistent or transient nameID with a value that doesn't
correspond to a user within VMware identity manager instead what can be
used to identify the user is sent in the attribute statement of the SAML
assertion to demonstrate how to set this up and how it works I've deployed two
VMware identity managers one is called vidm.pinata.local local and the other is
called vidm2.pinata.local vidm acts as the third-party identity
provider into the vidm2 let's start by looking at vidm.pinata.local here
I've created integration with vidm2 by adding it as a SAML application in the
catalog I've made sure to configure the subject and nameID value so that it
will not identify the user for the vidm2 expanding the Advanced section you can
scroll down to the custom attributes mapping here you can specify what VMware
Identity Manager will send in the SAML assertion as attributes I've specified
first name last name and email I specified the format to
basic and then make sure I mapped each attribute to the correct user attribute
within vidm looking at vidm 2 as you can see I have different applications in
this catalog I've integrated with vidm by adding it as a third-party identity
provider since the nameID in the subject statement is not to be used I've
enabled the “Identify User Using – SAML Attribute” setting I configured which
attribute to use for user identification I must make sure the format is the same
as in the SAML sent by the third-party identity provider I type the attribute
name and then with what local attribute it will try to match the value I
specified the vIDM_PW as the authentication method then I need to
make sure that my access policies use this authentication method let's verify
the SAML integration between the two I start on the vidm.pinata.local in
this case I'm using Firefox so I can use my favorite SAML debugging tool, SAML Tracer
I login as test user 1
as you can see I get single signed on into the vidm2 in SAML tracer you can
see one message identified as a SAML message here you can see the subject
statement and the nameID being persistent and with a random value that
does not match any of my users in vidm2 looking further down you find the
attribute statement here we received first name last name and finally the
email in our integration the email is the unique attribute that identifies the
user in the vidm2 and that was it to learn more please visit https://techzone.vmware.com