Loading

×Sorry to interrupt
Uncaught ReferenceError: addCTracking is not defined
throws at https://kb.vmware.com/resource/KM_TealiumTrackingJS?v=0.5:100:1

Refresh

Cookie Preference Center

General Information on cookies

When you visit our website, we use cookies to ensure that we give you the best experience. This information does not usually directly identify you, but it can give you a more personalized web experience. Because we respect your right to privacy, you can choose not to allow some types of cookies by clicking on the different category headings to find out more and change your settings. However, blocking some types of cookies may impact your experience on the site and the services we are able to offer. Further information can be found in our

Cookie Policy.

Strictly Necessary

Strictly Necessary

Always Active

Strictly Necessary

Strictly necessary cookies are always enabled since they are essential for our website to function. They enable core functionality such as security, network management, and website accessibility. You can set your browser to block or alert you about these cookies, but this may affect how the website functions. For more information please visit www.aboutcookies.org or www.allaboutcookies.org.

Cookie Details‎

Performance

Performance

Performance

Performance cookies are used to analyze the user experience to improve our website by collecting and reporting information on how you use it. They allow us to know which pages are the most and least popular, see how visitors move around the site, optimize our website and make it easier to navigate.

Cookie Details‎

Please confirm your settings by refreshing the page.

Functional

Functional

Functional

Functional cookies help us keep track of your past browsing choices so we can improve usability and customize your experience. These cookies enable the website to remember your preferred settings, language preferences, location and other customizable elements such as font or text size. If you do not allow these cookies, then some or all of these services may not function properly.

Cookie Details‎

Advertising

Advertising

Advertising

Advertising cookies are used to send you relevant advertising and promotional information. They may be set through our site by third parties to build a profile of your interests and show you relevant advertisements on other sites. These cookies do not directly store personal information, but their function is based on uniquely identifying your browser and internet device.

Cookie Details‎

Advertising Cookies

Consent Leg.Interest

Select All Vendors

Select All Vendors

Select All Hosts

Select All

Clear Filters

Information storage and access

Apply

Confirm My Choices Reject All Allow All

My Subscriptions

Loading

Knowledge Base

How to enable OpenID Connect in ADFS 2016 for vCenter Server (78029)

Last Updated: 4/2/2020Categories: InformationalTotal Views: 37526Language:
Chinese (Simplified)Portuguese (Brazil)JapaneseSpanishEnglish

26 like this article

Subscribe to get an email
newsletter with new updates

26 people found this helpful Please provide article feedback:

Details

In order to establish a relying party trust between your vCenter server and your ADFS provider, identifying information and a shared secret must be established between them. This is done by creating an OpenID Connect configuration in ADFS known as an Application Group, which consists of a Server application and a Web API. Both of these components together specify the vCenter redirect URIs that need to be invoked during authorization code flows as well as permissions, scopes, claims, and a client identifier and shared secret that vCenter uses to communicate with your ADFS server.

Solution

The steps to create an Application Group in ADFS are described below. Note that the following steps were derived from Active Directory Federation Services for Windows Server 2016.

Open the AD FS Management console (Server Manager → Tools → AD FS Management)

Right-click Application Groups and select Add Application Group; alternatively, select Application Groups and select Add Application Group from the list of available actions under the Action menu bar or the Actions pane

Enter a Name and optionally a Description for the new application group

In the Template list, under Client-Server applications, select the Server application accessing a web API type. Click Next

Make note of the Client Identifier. This ID will be needed in a later step as well as in the vCenter Identity Provider configuration

Enter the vCenter Redirect URIs that were given in the vCenter Identity Provider configuration. These Redirect URIs must be exact; otherwise, the vCenter login may not work with ADFS. Click Next

Check the option to Generate a shared secret, copy the value to the clipboard, and save it in a secure place. This will be needed in the vCenter Identity Provider configuration. Click Next

Add an Identifier value that is equal to the Client Identifier generated above. Click Next

Under Choose an access control policy, select Permit everyone. Click Next

On the Configure Application Permissions page, under Permitted scopes, make sure openid and allatclaims are checked. Click Next

Review the summary and click Next to create the Application Group

Click Close to complete the wizard

The Application Group is now created and should be listed in the Application Groups pane. In order to populate the user tokens with the appropriate information during OAuth exchanges, some additional configuration steps are needed to transform Active Directory data into token claims.

Right-click the newly created Application Group and select Properties; alternatively, select the newly created Application Group and select Properties from the list of available actions under the Action menu bar or the Actions pane

Select the Web API entry under Applications and click Edit

Go to the Issuance Transform Rules tab and add each of the following three rules

Group Rule

Click Add Rule

Under Claim rule template, select the option Send LDAP Attributes as Claims and click Next

Enter a name for the claim rule such as AD Group With Qualified Long Name

Under Attribute store, select Active Directory

In the mapping table on the first row, under the LDAP Attribute column, select the Token-Groups - Qualified by Long Domain Name option

In the mapping table on the same row, under the Outgoing Claim Type column, select the Group option and click Finish

Subject Rule

Click Add Rule

Under Claim rule template, select the option Send LDAP Attributes as Claims and click Next

Enter a name for the claim rule such as Subject Claim

Under Attribute store, select Active Directory

In the mapping table on the first row, under the LDAP Attribute column, select the User-Prinicipal-Name option

In the mapping table on the same row, under the Outgoing Claim Type column, select the Name ID option and click Finish

UPN Rule

Click Add Rule

Under Claim rule template, select the option Send LDAP Attributes as Claims and click Next

Enter a name for the claim rule such as User Principal Name

Under Attribute store, select Active Directory

In the mapping table on the first row, under the LDAP Attribute column, select the User-Prinicipal-Name option

In the mapping table on the same row, under the Outgoing Claim Type column, select the UPN option and click Finish

Click OK to save and close the updated Web API properties

Click OK again to close the Application Group properties

OpenID Configuration URL

In order to configure ADFS federation in your vCenter Server, you will need to know your ADFS server's OpenID Configuration URL. This is the standard OpenID Connect (OIDC) Discovery Endpoint that advertises OIDC metadata information about an OAuth identity provider. It is a well-known address that is typically the issuer endpoint concatenated with the path “/.well-known/openid-configuration”. For example: https://adfsserver01.corp.local/adfs/.well-known/openid-configuration

To obtain the OpenID Address for your ADFS server:

Open a PowerShell terminal on your ADFS server as an Administrator

Execute the following command:

Get-AdfsEndpoint | Select FullUrl | Select-String openid-configuration

Copy the URL that is returned (select only the URL itself, not the closing bracket or the initial "@{FullUrl=" part)

Use this URL whenever vCenter asks for the OpenID Address

Detectable by VMware SkylineTM

Actions

Copy

link to clipboard
copied!

Print

Language:
Chinese (Simplified)Portuguese (Brazil)JapaneseSpanishEnglish

Attachments

Additional Resources

KB
•
End Of General Availability of the Free vSphere Hypervisor (ESXi 7.x and 8.x) (2107518)

KB
•
Download and Install VMware Fusion (2014097)

KB
•
アレイから削除された後、動的に検出されたターゲットがユーザー インターフェイスに残る (78041)

Results 1-3 of 3

Ask The Community

Get answers quickly from VMware experts in the community

Post Subject

CONTINUE IN COMMUNITIES

Related Products:

VMware vCenter Server

Related Versions:

VMware vCenter Server 7.0.x

Take Our Survey

Support Assistant