Pulling Entity ID for CloudHealth SSO Migration SAML
search cancel

Pulling Entity ID for CloudHealth SSO Migration SAML

book

Article ID: 372461

calendar_today

Updated On:

Products

CloudHealth

Issue/Introduction

As of August 2024 CloudHealth will be migrating to a new Service Provider which will require you to update your SSO connection within the platform and provide 3 values:

  • Sign In Endpoint field - This will match the value you currently have configured within the platform.

  • Signing Certificate - This will match the value you currently have configured within the platform.

  • Issuer (Entity ID) - This value will need to be pulled from your SAML app itself we have documented the steps for a number of the common Identity Providers below. 

In general, however this value will be present in the SAML app's Federation Metadata document. Each SAML app will have a Federation Metadata URL that gives access to this document. 
Before proceeding to move to the AuthHUB SAML option please copy and make a note of the existing Sign In Endpoint, and Signing Certificate as you may need to copy these back in, in addition to the Issuer (Entity ID) which is the new field you will need to add.

Cause

 

Resolution

We've documented steps on how to pull the Entity ID for the most common Identity Providers here.

To pull the Federation Metadata document and pull out the Entity ID to use with the issuer field please follow the steps below:

Azure AD / Entra ID

  1. Within the Azure Portal available via - https://portal.azure.com/ navigate to Azure Active Directory / Entra ID -



  2. Select Enterprise Application across the left navigation bar, and locate the Enterprise Application associated with Single Sign On for CloudHealth and select the application. 



  3. Within the Enterprise Application select Single Sign On across the left navigation bar, within this section navigate down to the SAML Certificates section which will contain the "App Federation Metadata Url" field.



  4. Copy the URL and open the URL within a web browser, this will display an XML document, you will need to pull the Entity ID for use with the "Issuer" field from this XML document.

    The field will be labelled as "entityID=<entity ID URL>" and will sit within the "EntityDescriptor" element see example below:



  5. Use the value contained within the entityID= field between the  " " characters to populate the Issuer field within CloudHealth -> Setup -> Admin -> Single Sign On when using the AuthHUB SAML option in the dropdown. 

    Note: Azure AD SAML setups will require additional steps be taken regarding the claim rules in order for the migration to complete successfully and allow users to sign in, please find these documented here - https://knowledge.broadcom.com/external/article?articleNumber=374392 

 

Okta 

    1. Within the Okta Portal navigate to the Admin Portal, from there select Applications -> Applications

    2. From the Applications section select the application associated with Single Sign On for CloudHealth. Within the application select the "Sign On" tab. Within that tab pull the Federation Metadata URL from the "Metadata URL" field highlighted below. 



    3. Copy the Federation Metadata URL pulled in Step 2. and open it within a web browser. You will need to pull the Entity ID for use with the "Issuer" field from this XML document.

      The field will be labelled as "entityID=<entity ID URL>" and will sit within the "EntityDescriptor" element see example below:



    4. Use the value contained within the entityID= field between the  " " characters to populate the Issuer field within CloudHealth -> Setup -> Admin -> Single Sign On when using the AuthHUB SAML option in the dropdown. 

Onelogin

  1. Sign into your Onelogin tenant, and navigate to the administration console via



  2. Selection Applications across the top nav



  3. Within the applications list select the SAML application associated with Single Sign On for CloudHealth. Within that application navigate to the SSO tab as per the below image.

  4. Within the page displayed locate the "Issuer URL" field highlighted in the below image. Copy this URL as it is the entity ID for the SAML application you have configured with CloudHealth. 




  5. Use the value copied in step 4 within the Issuer field within CloudHealth -> Setup -> Admin -> Single Sign On when using the AuthHUB SAML option in the dropdown. 


Once you have completed pulling the entity ID please refer back to  https://docs.vmware.com/en/VMware-Tanzu-CloudHealth/SaaS/using-and-managing-vmware-tanzu-cloudhealth/GUID-managing-sso.html#how-to-migrate-to-authhub-saml-2 to complete the migration.

Note: Azure AD SAML setups will require additional steps be taken regarding the claim rules in order for the migration to complete successfully and allow users to sign in, please find these documented here - https://knowledge.broadcom.com/external/article?articleNumber=374392 

 

Powered by Wolken Software