In the earlier weblog we remapped a supplier (native) person to a SAML identification supplier federation. In this weblog we’ll remap a tenant (native) person to a SAML identification supplier federation.
As of VCD 10.4.1 remapping a person is on the market solely as an API function. Thus, for all subsequent steps, use an API consumer of your alternative. In my examples under, I’m utilizing Postman to carry out remapping.
Pre-requisite: Make positive the Identity Provider federation to which you need to remap person to is precisely configured.
- Login to VMware Cloud Director as an administrator (tenant or system administrator) and determine the person you need to remap. Here, the person I’m remapping is ‘testuser’. This person is a neighborhood person and owns one vApp named ‘Testuser vApp’ (as proven under).
- Login utilizing the API because the administrator; both utilizing their credentials (native or LDAP), IDP issued tokens (SAML or OAuth) or VCD’s API Token.
API: POST “https”//{api_host}/cloudapi/1.0.0/classes”
- Retrieve the urn id of ‘testuser’ from question customers API.
API: GET “https://{api_host}/cloudapi/1.0.0/users”
Now, utilizing this urn id, fetch full data of the person. Refer to Get User
API: GET “https://{api_host}/cloudapi/1.0.0/users/urn:vcloud:user:746cf0d9-788b-4aef-9fba-76f2ce49d33c”
- Copy full data of the person from earlier step and edit following properties to be used as physique of the next PUT request.
- Update the ‘username’ to mirror the person’s username within the new Identity Provider. While this instance reveals a definite username getting used, it’s doable to have less complicated updates like switching from username to e-mail deal with, and so on.
- Update the ‘providerType’ primarily based on the kind of new Identity Provider. New values of ‘providerType’ could possibly be OAUTH, SAML, LOCAL, LDAP.
Send PUT request for the person to be remapped. Refer to replace person for extra perception on this API.
API: PUT “https://{api_host}/cloudapi/1.0.0/users/urn:vcloud:user:746cf0d9-788b-4aef-9fba-76f2ce49d33c”
The person ‘testuser’ has now been remapped to the tenant’s SAML identification supplier and its username has been remapped to ‘testuser@tenantorg.com’.
The remapped person can now login utilizing Single Sign On.
When logged in because the person after the change:
- The username proven in top-right nook is up to date to their new username
- The sources owned by this person stay unchanged.
Users might be remapped from one IDP federation to a different utilizing the identical course of. If you’re remapping a person to ‘LOCAL’ supplier kind, along with updating the supplier kind replace password within the physique of PUT request.
Upcoming releases would come with enhanced functionalities for this function for a easy transition.
You can discover a demo video to remap a tenant person right here.