To enable MFA in Cloud Director, you can use SAML. To do this, follow the steps below.
Azure AD configuration
Create an Active Directory group and synchronize it with Azure Active Directory.
Setting up Azure AD - adding an enterprise application
Add an enterprise application. You can do this by navigating to 'Azure Active Directory' and selecting 'Enterprise Applications'.
Click on 'New application' and select 'Non-gallery Application'.
Click on 'Add' and give the application a name.
Configuring Single Sign-On
To configure Single Sign-On, click on 'SAML'. Then, fill in the requested information.
Cloud Director
Now that the Single Sign-On configuration is set up in Azure, the configuration must be completed in Cloud Director. In the link below, change ‘Customer-ICT’ to your Organization name. Then, download the Metadata (ensure you use the correct location).
https://en1.vcloud.fundaments.nl/cloud/org/Customer-ICT/saml/metadata/alias/vcd
https://pdc2.vcloud.fundaments.nl/cloud/org/Customer-ICT/saml/metadata/alias/vcd
https://ix7.vcloud.fundaments.nl/cloud/org/Customer-ICT/saml/metadata/alias/vcd
https://am2.vcloud.fundaments.nl/cloud/org/Customer-ICT/saml/metadata/alias/vcd
Save the file spring_saml_metadata.xml . Within the VDC, go to the Administration tab:
And choose the SAML option under Identity Providers.
Under ‘Service Provider’, enter the ‘Entity ID’ (ensure it matches the one in Azure under the name Identifier (Entity ID))
Azure SAML configuration
Upload the spring_saml_metadata.xml file in Azure that you just downloaded and saved.
Download the Azure AD Federation metadata XML from the location below in Azure.
Fill in or import the Federation Metadata XML from the Azure Portal that you just downloaded.
Import Users or Groups - Azure AD
Add the users from your Active Directory to Azure. You can also add groups here.
In Cloud Director, choose the group or users assigned under Users and Groups. You can then add rights and roles to the group.
MFA is now enabled by configuring SAML authentication and linking it to Azure AD!
