RedditPP Mascot

RedditPP

r/vmware • … • u/dirtymatt

VMware Identity Manager 19.03 with 3rd party SAML authentication

I'm trying to setup VMware Identity Manager to allow a 3rd party SAML identity provider to provide single sign on to Horizon, but am running into an issue that so far VMware tech support has not been able to help with. I can get the authentication to work just fine with a single IDM appliance configured, but I want to setup 3 IDM appliances behind a VMware Unified Access Gateway cluster for redundancy, and this is where things go wrong. When I update the FQDN to the UAG load balanced hostname for the IDM in the appliance configuration, the URLs in the SAML metadata are not changing to reflect the new hostname. After a lot of digging and decompiling and general poking about, it looks like this value is set by a configuration parameter named gatewayHostName, but I can't figure out how exactly that's getting set.

Update:

Turns out the problem was that the UAG was re-writing the Host: header to the value of the downstream server instead of the load balanced FQDN. I'm also pretty sure that the UAG was not sending X-Forwarded-For. My ultimate fix was to put the IDMs behind HAProxy with HAProxy doing SSL termination and using the source balancing method, that solved the problem immediately, and also let me do some nice things like redirect http to https.

— 0