so when we have architected all the individual products, as required, the next
very important step is to integrate them. Now there are two integration tasks we need to
consider here one is integrating the different products together to create a
complete platform and then the second is integrating all the components and parts
together to deliver a service that matches those business requirements we identified initially.
A lot more detail on this is given in the reference architecture guide on techzone.vmware.com
Now we will take all those different products we've architected and then
integrate certain points together. We end up with a logical architecture that may
look something like this. In this example I've used cloud-based tenants of
Workspace ONE UEM, Identity Manager and Intelligence.
You may have opted to deploy some of those on-premises, so in this instance
we've got Identity Manager and Workspace ONE UEM delivered on-premises, but you can
mix and match as appropriately. One of the first tasks you have to do in
a platform integration is take Workspace ONE UEM and VMware Identity Manager and
integrate them together. So from the Workspace ONE console we're going to
connect it to our Identity Manager instance. And we're going to go through
the wizard entering the information telling it where our tenant URL whether
that be on-premises or as a cloud-based instance. It will then make sure we got
that connection right and ultimately we'll end up with our AirWatch Cloud
Connectors talking to Workspace ONE UEM and also our Identity Manager Connectors
talking to Identity Manager. So it's important to recognize we need both
services whether they be deployed on separate servers or on the same server
The next integration task we should look at is taking your Horizon
environments, whether that be horizon 7 or horizon cloud service, and integrating
them into Identity Manager to help them populate in the Workspace ONE catalog.
This really provides a great experience for users because they get all the ability
to access, authenticate and launch those applications just as any other resource
And it makes it really simple and easy for the users. From an IT perspective it
allows us certain benefits like doing multi-factor authentication, conditional
access just that we would want to do with any other application.
Full detail and this is given in the reference architecture but really what
we're going to do is add a virtual apps catalog or collection into our Identity
Manager and tell it where our Horizon instances are.
To do this we're going to integrate and configure using Identity Manager and
the Identity Manager connectors will then be told where our horizon pods are and
their job then will be to fetch a list of resources and entitlement and push that
out and populate that into the Identity Manager catalog.
Those Identity Manager Connectors should have already been deployed and made
available as part of the Identity Manager architecture.
If we're using a Identity Manager as a SaaS tenant, a cloud-based tenant.
Our architecture is very very similar. If we're using Horizon Cloud service,
very very similar architecture, we just need those Identity Manager connectors
to be able to connect and talk to the Horizon Cloud node in Azure.
Now let's look at what happens from you launched a resource. So initially let's
look at Horizon 7 on premises. So from the Horizon client, the users going to
select a resource so like a virtual desktop or a published application.
Identity manager is going to generate a SAML assertion and artifact and pass that
back to the the client device. The horizon client then will be instructed
to launch that session. Talk out to the horizon environment via the horizon
connection servers. The authentication will then need to
happen, so the connection servers will do a SAML artifact over to Identity
Manager and receive an assertion back. It will then pass that back down to the
client with all the information of how it's going to connect to the resource.
The Horizon client will then establish the protocol session to the horizon agent
either in the virtual desktop or the RDSH server if we are doing published apps.
If we're doing an external launch, just a couple of
nuances here and the key thing I'll point out here is the use of a unified
access gateway. So in this one I'm demonstrating on-premises VMware
Identity Manager connecting to Horizon 7. So very similar to the first one,
our Horizon client device, our device itself in the browser, will talk to Identity
Manager and in the catalog the user will select a resource and we'll get that
SAML assertion and artifact back down to the Horizon client from Identity Manager.
Horizon client this time will connect via the unified access gateway which
will then communicate to the horizon connection servers. We'll still see the
same SAML artifact and assertion between the connection servers and Identity
Manager and we'll return that authentication token back but it'll come
back via the unified access gateway to the client. The client then will
ultimately form the protocol session but again because it's external it will go
through the Unified Access Gateway.
If we're using Horizon Cloud resources it's very very similar. So we've got
Horizon client here that will again talk to our Identity Manager tenant and it
will choose a resource, launch it returned that SAML assertion and artifact.
We'll then launch the client and talk
through a unified access gateway that runs as part of that Azure service. It
will then talk to our broker, our Horizon Cloud node, which will do a SAML artifact
and assertion between Identity Manager tenant just as we did in horizon 7 between the
broker and Identity Manager. It will then return authentication back
via the unified access gateway and ultimately allow the horizon client to
form a protocol session again via the unified access gateway.
So once we have an integrated platform the next thing we want to move on to is delivering our
integrated services. Our integrated services are really the solutions that
we identified earlier to our use cases, those requirements and ultimately the
business drivers. It's a reason we built this platform.
So one way to look at this is going back to the pictures you drew earlier the
blueprints that describe this solution. Now we've now built a platform is
capable of delivering these solutions but we just need to construct the pieces
put it together and actually deliver it to users. So what we can do is we can
look at the pictures create checklists and then go through the checklist and
actually build up the whole service for the user.
One example I've given here is a desktop service so using a Horizon 7 service
Now that we've identified here is a bunch of requirements from the picture
so the first step would be well how do I get a Windows 10 instant clone. Well I'm
going to need to create a primary VM. I'm going to have to install an operating
system, tune it and ultimately create a pool of instant cloned desktops.
So again we need to go through all those steps to get that piece working. We need
to look at the applications. Some of those might be delivered into that
primary VM but we also identified part of this requirement needing app volumes appstacks.
We need to go through the process of creating those appstacks and entitling
the users. If we included writable volumes again we need to create and
assign those too. Similarly with Thinapps if we identified that as part of the requirement
And lastly for a desktop service we need to look at the profile type data. If we
said we needed a mandatory profile, user environment manager configuration, folder
redirection. This all needs to be created, set up, defined and integrated as part of the service.
For more detail on integrating services and the platform there's
a lot more detail in the reference architecture context on techzone.vmware.com thank you