2V0-21.23 Question 107
Select 3An organization wants to configure identity federation for its VMware vSphere environment to allow users to log in using their corporate identity provider (IdP). Which of the following steps are necessary to successfully implement this configuration?
- A
Ensure the corporate IdP supports SAML 2.0 and is accessible by the vSphere environment.
- B
Configure vSphere to use the corporate IdP as an external Platform Services Controller (PSC).
- C
Generate and upload the SAML metadata file from the corporate IdP to the vSphere environment.
- D
Enable vSphere Single Sign-On (SSO) and map corporate IdP groups to vSphere roles.
- E
Disable the vSphere SSO domain to exclusively use the corporate IdP for authentication.
Show answer and explanation
Correct answers: A, C, D
Explanation
To configure identity federation in vSphere, it is essential to ensure compatibility with SAML 2.0, exchange metadata for establishing trust, and map IdP groups to vSphere roles to assign permissions. The configuration complements vSphere Single Sign-On (SSO) rather than replacing it, and no external PSC is involved in this process.
- A. Correct.
Correct. Identity federation in vSphere requires the corporate IdP to support SAML 2.0, as it is the protocol used for authentication integration.
- B. Incorrect.
Incorrect. vSphere does not use external Platform Services Controller (PSC) for identity federation; PSC functionality is embedded within vCenter Server in modern versions.
- C. Correct.
Correct. Uploading the SAML metadata file to vSphere is a crucial step to establish trust between the corporate IdP and the vSphere environment.
- D. Correct.
Correct. vSphere SSO must be enabled, and corporate IdP user groups need to be mapped to vSphere roles to grant appropriate permissions.
- E. Incorrect.
Incorrect. vSphere SSO is not disabled when configuring identity federation; instead, it coexists with the corporate IdP to provide fallback options.