2V0-21.23 Question 183
Select 3An administrator is tasked with configuring identity federation for their vSphere environment to enable Single Sign-On (SSO) using an external identity provider. They want to integrate their environment with a third-party identity provider supporting OpenID Connect (OIDC). Which of the following steps must the administrator perform to complete the configuration?
- A
Generate a SAML metadata file from the vCenter Server and upload it to the identity provider.
- B
Obtain the client ID and client secret from the identity provider for OIDC integration.
- C
Configure the Identity Federation settings in vCenter Server with the identity provider’s OIDC endpoint and required credentials.
- D
Enable two-factor authentication (2FA) in the identity provider before configuring identity federation.
- E
Verify that the vCenter Server is using an SSL certificate trusted by the identity provider.
Show answer and explanation
Correct answers: B, C, E
Explanation
To configure identity federation with an OIDC-compliant identity provider, the administrator must obtain the client ID and client secret from the identity provider and configure these credentials along with the OIDC endpoint in the Identity Federation settings in vCenter Server. Additionally, the vCenter Server must use an SSL certificate trusted by the identity provider to ensure secure communication. SAML metadata and 2FA are not relevant for this specific OIDC-based scenario.
- A. Incorrect.
SAML metadata is used for SAML-based integrations, not OpenID Connect (OIDC). Since the scenario specifies OIDC, this step is not relevant.
- B. Correct.
For OIDC integration, the client ID and client secret are required to establish trust and authenticate the vCenter Server with the identity provider.
- C. Correct.
The Identity Federation settings in vCenter Server must be configured with details such as the OIDC endpoint and credentials (client ID and client secret) to enable the federation.
- D. Incorrect.
While enabling 2FA might improve security, it is not a mandatory step for configuring identity federation using OIDC in vSphere.
- E. Correct.
For successful communication between the vCenter Server and the identity provider, the vCenter Server must use an SSL certificate trusted by the identity provider.