Integrating Keycloak with VMware Identity Manager.

Products

• VMware Smart Assurance

Issue/Introduction

How to integrate keycloak to broker authentication requests to VMware Identity Manager.

Environment

10.x

Resolution

Keycloak can used to broker authentication requests from client applications like VMware Telco Cloud Service Assurance to an Identity Provider like VMware Identity Manager. Using VMware Identity Manager as the common identity provider enables Single Sign-On capabilities for client applications like vRealize Operations Manager and VMware Telco Cloud Service Assurance.

Steps:

Step 1 : Configure keycloak As Identity Broker

1. Login using keycloak admin console to keycloak UI at https://<ingress-service:port>/auth/.
2. Click on "Identity Providers"  link under the NGINX realm.
3. Select "SAML V2" under the "Add Provider" selection box.
4. Input the following fields
   1. Alias - A unique string
   2. Display Name - This String will be displayed as a button on the login Screen. Use a use friendly name, for example "Sign-in with SSO".
   3. Under "Import External IDP config" text area
      1. Import a downloaded file from vIDM here.
         1. Steps to download Identity Provider file
            1. Login to VMware Identity Manager as Admin user.
            2. Navigate to administrator console
            3. Navigate to Settings sub-menu under Catalog tab.
            4. Select SAML Metadata.
            5. Copy the contents in the link "Identity Provider (IdP) metadata into a local file. Save to a local file as Eg: "ldp.xml"
         2. Select the ldp.xml file and import
         3. Verify the IDP metadata is successfully loaded, a success message will be displayed.
         4. Save the configuration.**

Step 2: Configure VMware Identity Manager as Identity Provider

1. Login to VMware Identity Manager as admin user.
2. Navigate to administrator console.
3. Select Catalog tab
4. Under Catalog tab Create a New Web application.
5. Provide the following fields to the New SaaS application wizard
   1. Name : A Unique Name
   2. Configuration:
      1. Auth Type : SAML 2.0
      2. Configuration: URL/XML
      3. Copy paste the SP metadata from keycloak into the URL/XML text area.
         1. Steps to get the SP metadata
            1. Login using keycloak admin credentials keycloak UI at https://<ingress-service:port>/auth/
            2. Under "Identity Providers" select the previously configured Identity provider (as Step 1 procedures above)
            3. Right click on the "Endpoints" Value files "SAML 2.0 Service Provider MEtadata" and copy contents to clipboard or file.
      4. Under Application Parameters click on Advanced and add Custom Attribute mapping.
         1. Name = groupName
         2. Value = ${groupNames}
      5. Complete the remaining wizard steps with defaults and click "save and assign"
      6. Here we provide the vIDM users who require to access VMware Telco Cloud Service Assurance.
         1. Add the required users and click save.

Step 3: Configure First Login Flow

1. Login using keycloak admin credentials to keycloak UI at https://<ingress-service:port>/auth/
2. Click Authentication link under NGINX realm and select the flow tab.
3. Under "flow" tab select "First Broker Login".
4. Set "Review Profile" option to disabled.

Step 4: Creating Identity Provider Mapper in Keycloak

1. Login using keycloak admin credentials to keycloak UI at https://<ingress-service:port>/auth/
2. Navigate to the provisioned Identity Provider instance (eg:"Sign-in with SSO") under the Identity providers link in NGINX realm.
3. Click Edit option and select the Mappers tab.
4. Click Create to provision a new mapper.
5. Enter the following details...
   1. A unique name to the mapper
   2. Sync Mode Override: force
   3. Mapper Type:Attribute Importer
   4. Attribute Name : groupName
   5. User Attribute Name : vIDMgroups.
6. Click save.

Step 5: Creating Protocol Mappers in Keycloak Clients

The following steps need to be done for all clients in keycloak such as operation-ui, nginx, grafana and kibana.

1. Login using keycloak admin credentials to keycloak UI at https://<ingress-service:port>/auth/
2. Click Clients link on the navigation panel under NGINX realm.
3. Edit the required client (eg: operation-ui)
4. Click on the Mappers tab.
5. Click Create button to add a new protocol mapper.
6. Enter the following details
   1. Name : A unique name
   2. Mapper Type: User Attribute.
   3. User Attribute : vIDMgroups
   4. Token Claim Name : ldapgroups
   5. Claim type: String
   6. Add To ID token: ON
   7. Add to access token : ON
   8. Add to userInfo: ON
   9. Multivalued: ON
7. Click save,
8. Repeat step 3 and 6 for additional users, eg. operation-ui, nginx, grafana and kibana clients.