Category: Workspace ONE
-
Notes from the field: The Kerberos chronicles, the one with certificate-based authentication
If you’ve read my previous Kerberos chronicles blogs you see a trend with the Microsoft patches, hardening updates and with this one the upcoming strong mapping / full enforcement mode of certificate-based authentication. See the following article for explanation: KB5014754—Certificate-based authentication changes on Windows domain controllers – Microsoft Support This one is going to have…
-
Notes from the lab: VMware Workspace ONE and the home-lab setup for one external IP
Just a quick blog for setting up your home-lab and use all the VMware Workspace ONE services on the UAG’s with one external IP. Our starting point is based on the following articles: Unified Access Gateway Appliances Deployed in a Double DMZ (vmware.com) – follow the steps for double DMZ deployment, Minimum/Optional Horizon Protocols and…
-
Notes from the lab: Some magic, integrating Citrix resources with VMware Access
Like my friend Edwin de Bruin explains in his blog(s): Migrating from Citrix Gateway to VMware Access Workspace One: Part one (debruinonline.net) and Migrating from Citrix Gateway to VMware Access Workspace One: Part Two! (debruinonline.net) he expects me to deliver you all some magic. For this blog I’m going to start with the necessary resource…
-
Notes from the field: Microsoft Azure MFA Number Matching and the one with NPS extension
Regarding the upcoming change of Microsoft MFA number matching, some customers started to ask me hey what’s going on? Do we need to do something? Is there any impact for our users? Well, the short answer is yes. The long answer is well it depends, can we live with the current setup or is there…
-
Notes from the field: VMware UEM Apple Registered mode pre-registration not working
On a recent project in which we use VMware UEM in a managed and registered mode of management the latter is experiencing a bug when pre-registering for enrollment is enabled. With closed enrollment enabled all devices need to be registered beforehand, this is a form of security to mandate there is no open enrollment possible.…
-
Notes from the field: The Kerberos chronicles, the one with VMware TrueSSO
After a lengthy and cumbersome troubleshoot on a VMware TrueSSO setup finally had the time to blog this one. In summary the situation with a customer was a working VMware TrueSSO setup which stopped working, after lengthy troubleshooting we opened a support case with VMware and later also with Microsoft. The issue was manifesting in…
-
Notes from the field: The broken VMware Access, UEM, and HUB portal
On a recent project with a customer, we encountered the issue that the VMware integration of the three products would be sort of “broken”. We first observed the issue after implementing the Intelligent Hub Verify rule set and see that this wouldn’t work. The devices and UEM wouldn’t show in the portal and the access…
-
Notes from the field: VMware Access CRL url too long?
This is just a quick post regarding CRL checking in VMware Access. It seems that when you have the “NEW” UI interface enabled there is a bug when you put in a valid CRL location in the lengths of: http://this.ismycrlfilelocation.crl that it would chop the end off and stay at http://this.ismycrlfilelocation and then a faulty…
-
Notes from the lab: Using VMware Access as IdP for Citrix Gateway
I like to fiddle around with possibilities when it comes to SAML, OAUTH authentications. This all started when a customer engineer triggered me with the possibility of achieving an SSO experience with the Citrix NetScaler and using VMware Access as the source of truth for authentication. Well guess what this works! And even for the…
-
Notes from the field: The one that Android said no more local
On one of my projects, we’ve encountered a strange issue regarding domain name resolving. A little background on the canvas painted it’s about a VMware Workspace ONE setup with working web URL’s and UEM enrollments, you name it. We have a nice setup regarding managed devices and these use a per-app VMware tunnel connection to…