Outbound proxy configuration requirements and limitations for VMware Identity Manager

Products

• VCF Operations

Issue/Introduction

When configuring VMware Identity Manager (vIDM) to integrate with Microsoft Entra ID for Single Sign-On (SSO), an outbound HTTP/HTTPS proxy may be required for internet access. Users may experience configuration failures if the proxy host or non-proxy host fields contain unsupported characters or formats.

Symptoms

• Unable to establish SSO connection with Entra ID.
• Proxy settings appear to be ignored or cause service errors.
• catalina.log shows proxy arguments but connection remains unsuccessful.

Environment

VMware Identity Manager (vIDM) 3.3.x

Cause

The vIDM appliance UI has specific validation requirements for proxy fields. Wildcard characters (e.g., * or leading dots) are not supported in the Proxy Host or Non-Proxy Hosts fields.

Resolution

Ensure the proxy configuration follows these strict formatting rules:

1. Proxy Host Field

• Accepted: A complete IPv4 address (e.g., ####.####.####.####) or a fully-qualified domain name (FQDN) with at least two parts (e.g., proxy.example.com).
• Rejected: Single-label hostnames (e.g., proxy), wildcard characters, IPv6 addresses, or parts starting/ending with a hyphen.

2. Non-Proxy Hosts Field (Bypass List)

• Accepted: Complete IPv4 addresses or FQDNs separated by commas.
• Rejected: Wildcard entries (e.g., *.example.com or 10.), leading dots (e.g., .example.com), or entries separated by "|" instead of a comma.

3. Cluster Configuration In a multi-node cluster environment, you must configure the proxy settings on each individual node via the :8443 administration page.

4. Service Restart After applying proxy changes, restart the horizon-workspace service:

service horizon-workspace restart