Skip to main content

Integrate with VMware Cloud Foundation

Support level: Community

What is VMware Cloud Foundation?​

VMware Cloud Foundation (VCF) is a private cloud platform that combines vSphere compute, vSAN storage, NSX networking, and fleet management into a single integrated stack.

-- https://www.vmware.com/products/cloud-infrastructure/vmware-cloud-foundation

Preparation​

The following placeholders are used in this guide:

  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

This guide uses VCF Single Sign-On with a Generic OIDC identity provider, which requires VMware Cloud Foundation 9.0 or later. VCF Single Sign-On is configured in VCF Operations and uses the VCF Identity Broker to authenticate users across the VCF fleet. Before starting, verify that VCF Operations can reach authentik's OIDC endpoints and review the VCF Single Sign-On prerequisites.

authentik configuration​

To support the integration of VMware Cloud Foundation with authentik, you need to create a scope mapping and an application/provider pair in authentik. VCF requires a domain claim that identifies the domain users log in with, which authentik does not send by default.

Create a domain scope mapping​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click New Property Mapping.

  3. Select Scope Mapping and click Next.

  4. Set the following values:

    • Mapping Name: VCF domain

    • Scope name: profile

    • Expression: replace company with the domain that users will use to log in.

      return {
          "domain": "company",
      }

  5. Click Create.

Create an application and provider​

Redirect URI changes in authentik 2026.5

In authentik versions earlier than 2026.5, all Redirect URIs are automatically treated as Authorization type. If you are using one of these older authentik versions, add only the Authorization URL to your Redirect URIs and do not configure a Post Logout URI.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Temporarily add a Redirect URI of type Strict Authorization as https://temp.temp. You will replace this with the redirect URI generated by VCF.
      • Select any available signing key.
      • Note the Client ID and Client Secret values because they are required later.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

  3. Click Submit to save the new application and provider.

  4. Open the OAuth2/OpenID provider that you created and note the OpenID Configuration URL value because it is required later.

VMware Cloud Foundation configuration​

Configure the identity provider​

  1. Log in to VCF Operations as an administrator.
  2. In the top navigation bar, click Manage, then navigate to Fleet Management > Identity & Access.
  3. Open VCF SSO Overview. If you are creating the first VCF SSO configuration:
    1. Open the Get Started with SSO tab and click Configure SSO.
    2. On the Prerequisites tab, confirm each checkbox and click Submit.
    3. On the Configure VCF SSO page, click Start next to Choose deployment mode, select a deployment mode, and click Configure.
  4. On the Configure VCF SSO page, click Start next to Configure Identity Provider.
  5. Select Generic OIDC from the list and click Next.
  6. Click Configure to configure the VCF Identity Broker.
  7. On the Identity Provider Configuration screen, configure the following settings:
    • IDP Display Name: authentik
    • Client Identifier: enter the Client ID value from authentik.
    • Shared secret: enter the Client Secret value from authentik.
    • OpenID Address: enter the OpenID Configuration URL value from authentik.
    • List of domains: enter the domain that users will log in with. This value must match the domain claim from the scope mapping that you created in authentik.
  8. Copy the Redirect URI value shown in the wizard and save it for the next section.
  9. Click Next.

Update the authentik provider​

  1. Return to the authentik Admin interface.
  2. Navigate to Applications > Providers and open the OAuth2/OpenID provider that you created.
  3. Click Edit.
  4. Replace the temporary Redirect URI value with the Redirect URI value from VCF. Use the Strict matching mode and Authorization redirect URI type.
  5. Add the VCF domain scope mapping that you created earlier to the selected Scopes.
  6. Click Update.

Configure user and group provisioning​

  1. Return to the VCF Single Sign-On wizard.
  2. On the User/Group Provisioning Method screen, select Just-In-Time Provisioning (JIT) and click Next.
  3. On the Group Provisioning screen, select Just-In-Time Group Provisioning and click Next.
  4. On the Domain(s) screen, add the domain that users will log in with and click Next.
  5. On the Attributes screen, confirm that preferred_username, email, given_name, family_name, groups, and domain map to claims with the same names, then click Next. The authentik profile and email scopes provide these claims, and the VCF domain scope mapping adds domain.
  6. On the Review screen, review the configuration and click Finish.
  7. On the Configure User and Group Provisioning screen, click Done.
  8. If the VCF Identity Broker is version 9.1 or later, click Test Login, click Next, and complete the authentik login flow. After VCF validates the login, click Done.
  9. Click Finish Setup, then click Continue.

Enable single sign-on and assign roles​

VCF Single Sign-On does not grant permissions by default. With JIT provisioning, users and groups become available for role assignment after their first login.

On VCF 9.1 or later:

  1. On the VCF SSO Overview page, open the single sign-on configuration that you created.
  2. Open the Component Configuration tab and enable single sign-on for each VCF component that users should access.
  3. Attempt an SSO login to provision the user and groups.
  4. Return to the single sign-on configuration, open the Access Management tab, select the provisioned users or groups, and click Assign.
  5. Select the role and its scope, click Apply, then click Assign.

On VCF 9.0, enable single sign-on for each component from the VCF SSO configuration and attempt an SSO login to provision the user and groups. Then log in to each configured component with a local administrator account and assign the required service roles.

Configuration verification​

To confirm that authentik is properly configured with VMware Cloud Foundation, open VCF Operations and sign in using single sign-on. Complete the authentik flow and confirm that VCF Operations opens with the expected role.

Resources​