VMware Identity Manager(vIDM 3.3.x) on Azure Active Directory With JIT Provisioning

Products

• VCF Operations/Automation (formerly VMware Aria Suite)

Issue/Introduction

This article describes how to configure single sign-on (SSO) between Microsoft Entra ID (previously Azure Active Directory (AD)) as a third-party IdP to provide seamless authentication into VMware Identity Manager.

Environment

What is JIT (Just-In-Time) provisioning?

JIT provisioning automates the creation of user accounts for web applications. It leverages the SAML (Security Assertion Markup Language) protocol to transfer data from the identity provider to the web applications. Upon a new user's initial login attempt to an authorized app, the identity provider transmits the necessary information to the app for the account creation process.

Resolution

1. Log in to your Azure Portal (https://portal.azure.com), select Microsoft Entra ID, find Enterprise Applications in the list under Manage, and then click New Application.
   
2. Select Enterprise applications.
3. Create your own application.
   
4. Click Create.
5. Click Single Sign On.
   
6. Select SAML to start configuring the app.
   
7. Go to VMware Identity Manager > Catalog > Web apps > Settings > Click SP metadata.
   
   Make a note of the entity ID and Reply URL.
   • Identifier = EntityID Value from the .xml file
   • Reply URL = The POST Value from the Assertion Consumer Service in .xml
   
   
8. In the Azure app, edit the SSO.
   
9. Edit attributes and claims.
   
   A stumbling block occurs when Microsoft Entra ID automatically populates the claims name with a URL. It is crucial for these to precisely match the Access Attribute names, including capitalization. Make sure you remove these pre-populated claim entries.
   
10. Download Federation Metadata XML.
    
11. Assign users to your application. Navigate to Users and Groups and assign it to your users. Any user assigned to this application is automatically provisioned in VMware Identity Manager.
    
12. Ensure that you populate the email in the properties of the assigned user.
    
13. Go to VMware Identity Manager and create a third-party IDP.
    
14. Paste and process your metadata (Federation Metadata). In the Name ID Format, change the NameID value to userPrincipalName.
    
15. Enable Just-In-Time user provisioning.
    
16. In Authentication Method, fill in the below information:
    • Authentication Methods – Azure-Password (Any Name)
    • SAML Context – urn:oasis:names:tc:SAML:2.0:ac:classes:unspecified
    
    If it is not unspecified, you might hit an error: AADSTS75011: Authentication method 'MultiFactor, PasswordlessPhoneSignIn' by which the user authenticated with the service doesn't match requested authentication method 'Password'.
    
    
17. Add this Microsoft Entra ID authentication method to your default policy and save it.
    Navigate to Identity & Access Management > Policies > default_access_policy_set > Rule 1 (Web Browser):
    • Select authenticate using as: EntraID Password
    • Fallback method: Password (Local Directory)
18. Once this setup is done, launch your VMware Identity Manager URL in incognito mode to be redirected to Azure AD.
19. Log in to VMware Identity Manager to verify the users are provisioned from Microsoft Entra ID to VMware Identity Manager.
    
    

Additional Information

NOTE: Whenever we change certificate on Microsoft Entra ID we will have to reprocess the idp metadata in vIDM or else saml validation will fail.

JIT Group Provisioning in vIDM 3.3.7 is not supported. This feature is only available on the SaaS version of vIDM/Workspace One