I have been trying out the Azure VMware Solution (AVS) on the VMware HOL and going through the techzone documentation. In this post, we shall take a look into these topics:
Mindmap – Steps for AVS Deployment and Networking
Quick Start Links
Optional – Deploy AVS via Azure Resource Manager Templates
Mindmap for AVS Deployment/Networking
Managed to put together a mindmap on the AVS deployment and networking steps of the service. The idea here is the mindmap acts like an excellent visual representation of what to do during deployment and you can figure out in advance the requirements/steps and pre-requisites.
Here is the PDF version if you would like to download and zoom-in
Optional – Deploying AVS using Azure Resource Manager
We can also deploy the AVS solution via PowerShell and using the Azure Resource Manager (ARM) template. The advantage here is you have slightly more advanced options that are not available via the GUI. (E.g. You can set the desired password for vCenter and NSX)
I hope you will find this helpful information on your AVS journey. Please let me know if I have missed any steps in the mindmap or reference links and I will be happy to update the post.
Many blogs discuss and show in detail how to integrate the Azure Active Directory (AAD) with VMware Workspace ONE Access (WoA) as a 3rd party IDP, and the following are my top post on that topic:
However, in this blog post, I would like to shed more light on the SAML Authentication Flow between the Azure Active Directory (Identity Provider) and VMware Workspace ONE Access (Service Provider). When designing the WoA and AAD integration, the below flow helped me understand what is happening behind the scenes, and I thought of sharing my knowledge with you all.
SAML Authentication Flow
AuthnRequest
Issuer
NameIDPolicy
RequestAuthnContext
SAML Response that AAD sends to WoA
#ProTip – I use a Chrome/Edge extension called SAML-tracer to inspect the SAML responses back and forth within the browser.
SAML Authentication Flow
The diagram below describes the single sign-on sequence. The VMware Workspace ONE Access (the service provider) uses an HTTP Redirect binding to pass an AuthnRequest (authentication request) element to Azure AD (the 3rd party identity provider in case of WoA). Azure AD then uses an HTTP post binding to post a Response element to the cloud service.
S. No.
DescriptionFlow
1.
End-user tries to access the VMware Workspace ONE Access portal
2.
VMware Workspace ONE Access finds the identity provider to authenticate the user
3.
VMware Workspace ONE Access generates a SAML 2.0 AuthnRequest and redirects the user’s browser to the Azure AD SAML single sign-on URL
4.
If the end-user is not signed in, Azure AD authenticates the user using multi-factor authentication & generates a SAML token
5.
Azure AD posts the SAML response to the WoA application via the user’s browser
6.
VMware Workspace ONE Access verifies the SAML Response
7.
VMware Workspace ONE Access completes the end-user sign-in and presents the desktop/app entitlements
Note – I have randomly created the GUID within the XML response just for demonstration purposes.
AuthnRequest
To request a end-user authentication, from WoA portal send an AuthnRequest element to Azure AD. Following is the SAML SAML 2.0 AuthnRequest from WoA portal:
The Issuer element in an AuthnRequest must exactly match one of the ServicePrincipalNames in the cloud service in Azure AD. Typically, this is set to the App ID URI that is specified during application registration. (When the Enterprise Application is created under AAD portal)
This element requests a particular name ID format in the response and is optional in AuthnRequest elements sent to Azure AD. A NameIdPolicy element looks like the following from WoA portal:
The RequestedAuthnContext element specifies the desired authentication methods. It is optional in AuthnRequest elements sent to Azure AD. Azure AD supports AuthnContextClassRef values snippet from WoA portal:
I hope you will find the above information helpful in your journey with AAD/WoA. A small request if you see any scope of improvisation or refinements. I hope you can share it back with me?
Recent Comments