Integrating A Cloud Instance Of VMware Identity Manager With Active Directory

In a previous post I detailed how to integrate a local AD environment with a Cloud based instance of  AirWatch using AirWatch Cloud Connector.   For this post, I'm going to demonstrate how to integrate a local AD environment with a Cloud instance of vIDM using the VMware Identity Manager Connector.  Getting vIDM Connector deployed and integrated with the local AD environment is a prerequisite for getting vIDM integrated with on premises Horizon.



Above is an excellent graphic detailing the capabilities of the VMware Identity Manager Connector.  As with the AirWatch Cloud Connector, it allows for a successful integration between your on premises environment and SaaS environment without having to poke holes in any firewalls.   All that's required for the integration between the vIDM SaaS instance and the vIDM Connector is out bound 443 connectivity from the vIDM Connector to the SaaS instance of vIDM.

Installing The vIDM Connector

Hop on your target Windows server for the vIDM Connector and run the Windows based installer. 



Click next on the welcome screen.



Select the default destination folder.



Enter a hostname for this Connector server.  



Skip the outbound proxy configuration unless it's relevant for you.   Then at the next screen specify that you want to run the connector service as a domain user account and enter in the relevant credentials. 



Click on the install button to begin the installation. 



Upon successful completion you'll the, "Installation Wizard Completed," message. 



After clicking finish, you'll be presented with a message box providing guidance on configuring the connector.  Go with the Yes option to get the configuration page automatically loaded up for you. 



Click next.



Set an admin password for the connector. 



At the next screen, you'll get prompted for an activation code.  You need to grab the code from the cloud based vIDM instance.



Log into your vIDM environment. Navigate to to Identity & Access Management --> Setup --> Connectors.   You'll see the unactivated connector. 



Click on the view activation code option.



You're going to cut and paste this activation code back into the connector setup wizard. 



If things go well, you'll get the, "Setup is complete," message. 



Now under Connectors within the  vIDM admin console you'll see more info populated about the connector.



Next, we have to associate this connector with a directory.

Binding To Your Local Active Directory Environment 

Before creating your AD directory, ensure you have the following attributes enabled under your users settings.  If you don't set this properly ahead of time, you wont be able to change it after creating the directory.  (To make changes to enabled attributes, you'd have to blow the directory away and recreate it.  So just take care of it properly ahead of time.)

After confirming your attributes are straight, proceed to Identity & Access Management --> Manage --> Directories.  

Click Add Directory. 

Select the option for, "Add Active Directory over LDAP/IWA."

Add the name of your directory.  Ensure your vIDM Connector is selected as the Sync Connector.  Choose Yes for, "Do you want this Connector to also perform authentication."  Then,  scroll down a bit and you'll get prompted for an account to bind with.    Enter the bind account name in a user principal name format.   So something like, username@your_domain.com.  

Hit Save & Next. 

Next, select the relevant domain. 



Confirm proper attributes are selected. 



Enter the group DNs to sync.



Enter the user DNs to sync. 



Click on Sync Directory.



Confirm the sync operation completed. 



By default, after creating a directory and and associating it with our vIDM Connector, you're connector can authenticate AD  user in inbound mode, which involves users directly connecting against the vIDM connector located on the trusted network.    Here's what a login looks like in environment when the connector is setup in outbound mode.   After selecting I want to authenticate to the LAB.LOCAL domain, I'm redirected to a url for the enterprise connector.  So here's the initial login to my SaaS instance. 



After selecting to login to my AD domain, my browser is redirected to the vIDM Connector I've just setup, entconnect.lab.local.  In my environment, I haven't setup a certificate yet, so I initially get this error regarding the SSL cert on my vIDM Connector.  



After clicking to continue to the website, I get a login screen for my local AD environment. 



After entering in my domain credentials properly, I'm successfully logged into my Workspace One portal.



If you want folks to authenticate directly against vIDM in cloud, rather than directly against the vIDM connector, you can enable outbound mode.

Setting Up Outbound Mode 

We can enable outbound mode by associating our new Connector with the Built-In identity provider.   Navigate to Identity And Access Management --> Manage --> Identity Providers. 

Click on the hyperlink for Built-in.  Select the relevant directory and network ranges.  Then scroll down. 



Under Connectors, select your new vIDM Connector.   Then click on the, "Add Connector," button. 

You'll now have the option to select Connector Authentication Methods.  Select the option for, "Password (cloud deployment)." 

After changing your access policy rules to use the Password (cloud deployment) authentication option, you'll have the ability to authenticate against the AD environment directly from your SaaS instances, without having your browser redirected to the vIDM Connector.  Your transition to outbound mode is complete. 

With your vIDM Connector integration with your local AD environment complete, you can now proceed to integrate vIDM with your on premise Horizon environment according to these instructions, Integrating A Cloud Instance Of VMware Identity Manager With On Premise Horizon.

Integrating A Cloud Instance Of Workspace One UEM (AirWatch) With Active Directory

You can easily integrate an Active Directory environment with cloud hosted AirWatch using the AirWatch Cloud Connector.  The AirWatch Cloud Connector can sync users and groups from the on premises AD environment to your AirWatch environment.   It can also handle AD authentication into that environment from AirWatch managed endpoints. 

While the ACC can handle AD integration for both vIDM and AirWatch, because we're looking to integrate with Horizon, we have to manage vIDM's integration with AD through the vIDM Connector, not the ACC.  So, for the ACC deployment in this post we're just going to focus on getting AirWatch integrated with AD.   In the next post I'll cover getting vIDM integrated with AD using the vIDM Connector.  

Deploying The AirWatch Cloud Connector

To get the deployment started, navigate to your Workspace One UEM console directly from the Windows server your installing ACC on.   Once logged in, go to Groups And Settings --> All Settings --> System --> Enterprise Integration --> Cloud Connector.   From there select override, then select, "Enabled," for, "Enable AirWatch Cloud Connector."  

Next, click on the download link for the AirWatch Cloud Connector installer.  You'll get prompted for a certificate password.  Enter in an easy to remember 6 character or longer password.



Then click on the download button.  The installer is less than 20 megs, so it shouldn't take long to download.   Once it's downloaded locally to your Windows server, go ahead and start the install.



You'll see the welcome screen.  Click next.



Go ahead and accept the default install folder.



Enter in the certificate password you entered in earlier when downloading the ACC installer.



Leave the outbound proxy option unchecked. (Unless you have a proxy.)  Then click install to proceed with the installation. 



At completion, you'll see:



Finally, we can now test connectivity from the AirWatch environment to the connector.  From the VMware Enterprise Systems Connector section under Enterprise Integration, beneath the download link is a test button.   If all goes well after clicking the button you'll get the message, "AirWatch Cloud Connector is active."



Now, with the AirWatch Cloud Connector in place, we can start to integrate the Workspace One UEM environment with the local Active Directory environment.

Binding To The Local AD Environment

Navigate to Groups And Settings --> All Settings --> System --> Enterprise Integration --> Directory Services.   Select the directory type, enter in the name of a domain controller and port number.  



After scrolling down, enter in the bind user credentials and domain name.  



Navigate to the user tab.   Enter in a base DN for your users.



Navigate to the Group tab.   Enter in a base DN for your groups. 



Finally, you can test the directory integration by clicking on the Test Connection button.  If all goes well, you'll get the message, "Connection successful with the given server name, bind user name and password."



Now, with the local directory added, you can go to Accounts --> List View, then click Add.  You'll be able to add an AD account from your local AD directory. 



After clicking Add User, select Directory as the user type.   Enter in the username of the AD account you'd like to add. 



After clicking on check name, a bunch of AD attributes from that account will be auto populated.



Click save.  The imported AD account will now show up under users in list view.



You can further test out the integration by enrolling a device using the domain users credentials.  Here's a screen shot from the enrollment process on my iPad.



After providing my AirWatch server and group id, I'm prompted for credentials. 



After entering in the AD credentials there's a prompt to install the MDM profile on the device.



Now you should be able to see the device in the Workspace One UEM console.



At this point, the integration of the Workspace One UEM tenant with the local Active Directory environment is complete.   Next, we can integrate vIDM as detailed in this next post,  Integrating A Cloud Instance Of VMware Identity Manager With Active Directory.

Cloud Options For Accelerating Workspace One Adoption In Traditional Horizon Environments

Cloud options for VMware Identity Manager and Workspace One UEM (AirWatch) make it easy to quickly extend the benefits of Workspace One to on premise Horizon environments.   Leveraging these SaaS based instances we can essentially layer Workspace One functionality on top of existing Horizon environments with little disruption and minimal up front work. 

This is part 1 of a 7 part series that details an integration between cloud based vIDM, cloud based AirWatch and a traditional Horizon on premise deployment.  The ultimate aim is to simplify and secure mobile access for Horizon users with features like a unified access portal, automated device configuration, SSO and conditional access based on device compliance.

Deployment Overview

SaaS instances of vIDM and AirWatch integrate with a customers environment through the deployment of special connectors on premise.   System requirements for these connectors are negligible, and more importantly, their network requirements are incredibly simple.  To communicate with SaaS instances of AirWatch and vIDM,  connectors only need 443 outbound access to them.  So, typically, they can communicate with these cloud environments without any firewall changes.   For display protocol connectivity to the  Horizon environment, Unified Access Gateway (UAG) is used to proxy connections from the outside world to the internal instance of Horizon.  

Getting It Done 

I've created 6 separate posts that detail the process for integrating traditional on premises Horizon deployments with cloud instances of AirWatch and vIDM.   With the SaaS instances already provisioned and prerequisites lined up properly, you could get these procedures completed in an afternoon.  Here are the different procedures in the order I would recommend their execution:

Integrating A Cloud Instance Of Workspace One UEM (AirWatch) With Active Directory
Integrating A Cloud Instance Of VMware Identity Manager With Active Directory
Integrating A Cloud Instance Of VMware Identity Manager With On Premise Horizon
Integrating Cloud Instances Of Workspace One UEM (AirWatch) And VMware Identity Manager
Configuring Mobile SSO For iOS In Workspace One UEM (AirWatch)
Securing Access To Horizon Through AirWatch Based Device Compliance

Further Detail

The deployment detailed in these posts uses Horizon 7.5, the September 2018 release of VMware Identity Manger Cloud and Workspace One UEM 1810.   Through the use of connectors we're able to integrate both the Workspace One UEM (AirWatch) and vIDM SaaS instances with on premise environments.  For Workspace One UEM, we'll use the AirWatch Cloud Connector for AD integration.  For vIDM, were going to use the vIDM connector for integration with both AD and Horizon on premises environment.   After completing the deployment and configuration of the 2 connectors, we'll integrate the vIDM and AirWatch environments by populating vIDM with API keys and certificates for the AirWatch tenant.  Then we'll enable features like the unified app catalog and device compliance.  To get started,  proceed with this first recipe, Integrating A Cloud Instance Of Workspace One UEM (AirWatch) With Active Directory.