2V0-21.23 Question 184
Single answerAn organization is planning to configure identity federation in their vSphere environment to enable Single Sign-On (SSO) using their corporate identity provider (IdP). They want to ensure that users can authenticate using SAML 2.0 and have role-based access control (RBAC) for vSphere objects. Which prerequisite must be met before configuring identity federation in this scenario?
- A
vCenter Server must be configured with an external Platform Services Controller.
- B
The corporate identity provider (IdP) must support SAML 2.0 protocol.
- C
The vSphere environment must be upgraded to vSphere 6.0 or later.
- D
A dedicated Active Directory domain must be created for vSphere users.
Show answer and explanation
Correct answer: B
Explanation
Identity federation in vSphere allows integration with external identity providers (IdPs) for Single Sign-On (SSO). A critical requirement for this setup is that the external IdP must support the SAML 2.0 protocol. This ensures secure communication and authentication during the federation process. Other options, such as using an external Platform Services Controller or creating a dedicated AD domain, are not prerequisites for identity federation in modern vSphere environments.
- A. Incorrect.
Incorrect. vCenter Server no longer requires an external Platform Services Controller as of vSphere 7.0, and identity federation does not depend on this configuration.
- B. Correct.
Correct. To configure identity federation, the corporate identity provider (IdP) must support the SAML 2.0 protocol, which is required for secure authentication in vSphere using an external IdP.
- C. Incorrect.
Incorrect. While upgrading to a newer version of vSphere is beneficial, identity federation requires at least vSphere 7.0, not vSphere 6.0. This option is outdated and irrelevant to the specific requirement.
- D. Incorrect.
Incorrect. There is no requirement to create a dedicated Active Directory domain for vSphere users when configuring identity federation. The focus is on using an external IdP with SAML 2.0 support.