-
Notifications
You must be signed in to change notification settings - Fork 68
/
azure-ad-sso-config.html.md.erb
76 lines (53 loc) · 3.89 KB
/
azure-ad-sso-config.html.md.erb
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
---
title: Configuring Azure Active Directory as a SAML Identity Provider
owner: Identity
---
This topic describes how to configure single sign-on (SSO) between Microsoft Azure Active Directory (Azure AD) and VMware Tanzu Kubernetes Grid Integrated Edition (TKGI).
## <a id='prerequisites'></a> Prerequisites
To configure Azure AD to designate Tanzu Kubernetes Grid Integrated Edition as a service provider,
you must have an Azure AD Global Administrator account.
## <a id='configure-saml'></a> Configure SAML in Azure AD
To configure Azure AD as a SAML identity provider for Tanzu Kubernetes Grid Integrated Edition, do the following:
1. Log in to Azure AD as a Global Administrator.
1. Navigate to **Azure Active Directory**.
1. Under **Create**, click **Enterprise application**.
1. Under **Add your own app**, select **Non-gallery application**. Enter a **Name** and click **Add**.
1. Navigate to **Azure Active Directory** > **Enterprise applications**.
1. Click your app and then click **Single sign-on**.
1. Under **Select a single sign-on method**, select **SAML**.
1. Under **Set up Single Sign-On with SAML**, click the pencil icon for **Basic SAML Configuration**.
1. Configure the following fields:
<table>
<tr>
<th>Field</th>
<th>Instructions</th>
</tr>
<tr>
<td><strong>Identifier (Entity ID)</strong></td>
<td>Enter <code>TKGI-API:8443</code>.<br>
For example: <code>api.tkgi.example.com:8443</code></td>
</tr>
<tr>
<td><strong>Reply URL</strong></td>
<td>Enter <code><span>https</span>://TKGI-API:8443/saml/SSO/alias/TKGI-API:8443</code>.<br>
For example: <code>https://api.tkgi.example.com:8443/saml/SSO/alias/api.tkgi.example.com:8443</code></td>
</tr>
<tr>
<td><strong>Sign on URL</strong></td>
<td>Enter <code><span>https</span>://TKGI-API:8443/saml/SSO/alias/TKGI-API:8443</code>.<br>
For example: <code>https://api.tkgi.example.com:8443/saml/SSO/alias/api.tkgi.example.com:8443</code></td>
</tr>
</table>
<p class="note"><strong>Note:</strong> <%= vars.recommended_by %> recommends that you use the default settings for the fields that are not referenced in the above table.</p>
1. Click the pencil icon for **User Attributes & Claims**.
1. Configure your user attributes and claims by doing the procedures in [How to: Customize claims issued in the SAML token for enterprise applications](https://docs.microsoft.com/en-us/azure/active-directory/develop/active-directory-saml-claims-customization) in the Microsoft Azure documentation. By default, Tanzu Kubernetes Grid Integrated Edition uses the <code>EmailAddress</code> name identifier format.
1. Configure your group attributes and claims by doing the procedures in the [Configure group claims for SAML applications using SSO configuration](https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-group-claims#configure-group-claims-for-saml-applications-using-sso-configuration) section of _Configure group claims for applications with Azure Active Directory (Public Preview)_ in the Microsoft Azure documentation.
1. Under **SAML Signing Certificate**, copy and save the link address for **App Federation Metadata Url** or download **Federation Metadata XML**. You use the Azure AD metadata to configure SAML in the Tanzu Kubernetes Grid Integrated Edition tile.
For more information, see [Connecting Tanzu Kubernetes Grid Integrated Edition to a SAML Identity Provider](configuring-saml.html).
