You must generate SAML metadata on the Unified Access Gateway appliance and exchange metadata with the server to establish the mutual trust required for smart card authentication.
The Security Assertion Markup Language (SAML) is an XML-based standard that is used to describe and exchange authentication and authorization information between different security domains. SAML passes information about users between identity providers and service providers in XML documents called SAML assertions. In this scenario, Unified Access Gateway is the identity provider and the server is the service provider.
Prerequisites
- Configure the clock (UTC) on the Unified Access Gateway appliance so that the appliance has the correct time. For example, open a console window on the Unified Access Gateway virtual machine and use arrow buttons to select the correct time zone. Also verify that the ESXi host's time is synchronized with an NTP server. Verify that Open VM Tools, which is running in the appliance virtual machine, synchronizes the time on the virtual machine with the time on the ESXi host.
- Obtain a SAML signing certificate that you can use to sign the Unified Access Gateway metadata.
- If you have not done so already, convert the SAML signing certificate to PEM-format files and convert the
.pemfiles to one-line format. See Convert Certificate Files to One-Line PEM Format.
Procedure
-
In the admin UI, click Identity & Access from the left navigation pane.
-
In the SAML Settings card, click Configure.
-
Click the SAML Identity Provider Settings section.
-
Select Provide Certificate.
-
To add the Private Key file, click Select and browse to the private key file for the certificate.
-
For add the Certificate Chain file, click Select and browse to the certificate chain file.
-
Click Save.
-
In the Hostname text box, enter the hostname.
-
(Optional) Turn on the Enable Host Based Issuer toggle to use the Hostname you provided in step 8 as the issuer host in the downloaded IDP metadata. If you turn off this toggle, the default value of AP.LOCAL is used as the issuer host.
-
Click Download to generate the identity provider settings metadata.
The Identity Provider Settings metadata is provided.
What to do next
See Creating a SAML authenticator used by other service providers and Copy service provider SAML metadata.
Was this page helpful?