Be the first to hear the latest EUC news. Enter your email to join.

Support Multiple Authentication Use Cases with VMware Identity Manager (vIDM)

Author: Camilo Lotero

Camilo Lotero is a Senior Technical Marketing Manager at VMware End-User Computing (EUC) focusing in Identity and Access Management. He has been with VMware for 5 years in various teams including Technical Support, Sales Engineering and Technical Marketing. Camilo has served as a technical advisor for clients across all different market verticals, as well as provide technical enablement across different teams within VMware. Camilo holds a degree in Industrial and Systems Engineering from the Georgia Institute of Technology.

Share This Post On

VMware Identity Manager‘s framework enables it to simultaneously cover several different authorization and authentication use cases. vIDM’s flexibility stems from the relationship between its core components. Its directories, identity providers, and authentication policies can support a wide range of authentication methods.

Review the role of each component below:

In vIDM , directories, identity providers, and authentication policies can support a wide range of authentication methods.

Directories

A vIDM tenant can contain several user directories, each with different schemas and sync sources.

  • Schema – Attributes that populate to each user profile. Includes the subset of attributes required to create a user within that directory.
  • Source of Truth – Location users sync from.

Take a more detailed look at the primary ways to populate a directories:

vIDM supports multiple directories that can mix and match, providing a wide range of supported authentication methods

Identity Providers

There are three main types of identity providers (IDPs). A vIDM tenant can create and maintain multiple identity providers of each type.

vIDM supports multiple IDP providers that can mix and match , providing a wide range of supported authentication methods

 

Authentication Policies

An authentication policy evaluates an authentication request’s set of conditions, and provides one or more supported authentication methods based on the evaluated conditions. This is often referred to as conditional access.

Authentication Methods

Support for authentication methods differs between identity providers. For example:

vIDM-Directory-IDP-Authentication-Methods-Requirements.png
vIDM Authentication Workflow

This authentication workflow demonstrates the role each core vIDM component plays during authentication. 

Take a closer look at how vIDM's components interact during authentication.

1. Discover the user’s directory.

The vIDM tenet’s directory configuration determines the discovery process:

  • In a Single-Directory configuration the authentication request defaults to the configured directory.
  • In a Multiple-Directory configuration the end user selects the directory from a drop-down menu.

2. Discover the Identity Provider.

vIDM uses the selected directory and the request’s source network to:

  • Evaluate which identity providers can confirm the incoming request’s credentials.
  • Evaluate the authentication methods supported for this request.

3. Select Authentication Policy.

vIDM evaluates request conditions:

  • Evaluates the request’s target application, source network, client type, etc.
  • Selects the first authentication policy that meets these conditions.

4. Select Authentication Method.

vIDM evaluates the policy against the request:

  • Evaluates the authentication policy’s available authentication methods.
  • Evaluates the authentication methods the incoming request supports.
  • Selects the first authentication method that meets these conditions. If the policy does not contain any authentication methods the incoming request supports, the request fails.

5. Authorization.

vIDM evaluates user permissions against the request.

  • Evaluates if the authenticating user can access the requested application.
  • Grants or denies access.

vIDM Authentication FAQ

How do I enable multi-factor authentication?

Associate a user directory with multiple identity providers to enable multi-factor authentication. This requires users to supply credentials to more than one identity provider to access resources.

Can I assign multiple directories to a single IDP?

A single identity provider could validate user credentials from multiple directories. For example, you can use vIDM Connector to sync with multiple Active Directories.

Should I limit my IDP's availability?

Configure your identity provider’s availability to remain open to all networks, or only accept requests from defined networks. Consider limiting availability to incoming requests in the following scenarios:

  • The identity provider can only accept requests from within the internal networks
  • There are different identity providers located across regions.

How do I support authentication for users from different directories and networks?

Configure authentication policies with multiple authentication methods to handle credentials for a given application’s different users. That way, if one authentication method fails for a user, the policy can use the next available method.

Related:

468 ad