Hi my name is Peter Björk with the VMware Identity Manager 19:03 release the
embedded connector in an on-premises deployment is gone previously we used
the embedded connector to perform certificate based authentication in the
DMZ so now in 1903 we had to change how we support certificate based
authentication we added a new authentication method into the service
it's called Certificate (Cloud Deployment) the name might make you think
it's using some kind of cloud service but it is not (Cloud Deployment) simply
means it is all running in what we call outbound mode in other words your
clients only communicate with the service and not to the connector in this
case the authentication adapter is running all on the service and the
connector is not used at all the new authentication method is easier to setup
than the old one while using a separate port is not a requirement
it is often needed due to the network design which reminds me let's cover a
typical implementation using certificate based authentication when you run VMware
identity manager on-premises you typically front it with a reverse proxy
or load balancer while we do support pass-through most implementation
terminate the TLS session on the proxy / load balancer and then a new session is
created from the load balancer to identity manager this way you only need
a trusted certificate on your load balancer your clients will never
communicate directly to the VMware Identity Manager but re-encrypt
or terminating the TLS session isn't supported when doing certificate based
authentication clients must communicate directly with
the VMware Identity Manager so in order to support this we typically
configure identity manager to redirect the user to another port for certificate
based authentication and this port is configured for pass-through in the load
balancer I will show you how to set this up in a second but first let's have a
look at my demo environment I'm not currently having a load balancer or
proxy deployed but I will pretend I do so I will configure VMware identity
Manager to redirect users to port 7443 but I'll take it one step further I
will pretend I need to use a separate FQDN for this configuration so user
access to the portal will be using the FQDN vidm.pinata.local and for
the certificate based authentication users will be redirected to cert.pinata.local
port 7443 this extra complexity requires me to do a couple
extra steps during the configuration if I could keep the FQDN and even not
having to redirect to a separate port it is just a matter of activating this
Certificate (Cloud Deployment) authentication method and you're done
but now I will have to upload a valid certificate for cert.pinata.local
and I also need to activate the separate FQDN and port here's my identity manager
first I'll activate the certificate cloud deployment authentication method
I do this by activating it and upload the root certificate my user certificates
are signed by this root certificate in my case I'm using my private Microsoft
Certificate Authority I leave all the rest as is but there are many parameters
you can tweak such as how the user is identified within the user certificate
and how to check for revocation and much more
Then I verify that my built-in identity Provider is configured to handle
authentication for my user directory and that the certificate method is activated
Lastly, I have to modify my access policy to use this new authentication method if
I didn't need to redirect the users to a separate FQDN and port I would now have
been finished with the configuration and my users would be able to use a
certificate to access my identity manager but now let's move on and see
what extra steps I'll have to do I open the Appliance settings
here I'll start by uploading a separate certificate to be used for port 7443
this certificate is different than the one for the regular
port 443 traffic in my case I will redirect users to cert.pinata.local
so I have to upload a certificate matching this FQDN the certificate must
be in a PEM encoded format and contain the full chain I upload the
certificate's private key as well the service must be restarted to activate
the new certificate now I need to configure the redirection settings I use
SSH to access my VMware Identity Manager Service appliance
I need to modify the runtime-config settings the parameters I'm looking for
are the components.certauth.host and .port by default these are the configured
FQDN and port. But in my case I'll have to change to cert.pinata.local and port 7443
exit and save the runtime-config file and then restart the service let's see
if this worked here's my client as you can see I have no user certificate that
can be used to authenticate me as a user I launch edge and try to access identity
manager and as you can see I'm denied access in my access policy I didn't
configure a fall back authentication method for my user directory so if I
cannot perform certificate based authentication
I'm simply denied access now let's add a valid user certificate
as you now can see I do have a valid user certificate on my machine let's see
if I'm luckier accessing my identity manager now
aah, much better..
But hang on, what exactly happened here it was so quick it's hard to see let's rewind and
look at each step one by one I typed in vidm.pinata.local the access policy
redirects me to cert.pinata.local port 7443 to perform
certificate based authentication my machine uses my certificate to
authenticate me and then I'm redirected back to the vidm.pinata.local
we can verify that I actually was using certificate based authentication by
looking at the login events
..and that was it..
to learn more please visit https://techzone.vmware.com