1. Click System
2. Click Enterprise Integration
3. Click VMware Identity Manager
4. Scroll down to the Certificate section
5. Click Enable

1. Scroll back down to the Certificate section again.
2. Click the Export button.

The Certificate (VidmAirWatchRootCertificate.cer) will be saved in the Downloads folder.  You will need this certificate in an upcoming step.

Click on the VMware Workspace ONE tab to return to the VMware Identity Manager Administration Console.

1. Click Identity & Access Management.
2. Click on Authentication Methods section.
3. Click on the Edit icon for Mobile SSO (for iOS).

1. Enable the Enable KDC Authentication check box.
2. Click the Select File button for the Root and Intermediate CA Certificates.

1. Select the Downloads folder.
2. Select the VidmAirWatchRootCertificate.cer file that was downloaded previously.
3. Click Open.

Click OK in the confirmation dialog box.

1. Confirm the Certificate was uploaded.
2. Click Save.

1. Click Identity Providers
2. Click Built-in

1. Scroll down to the bottom of the page to find the KDC Certificate Export section.
2. Click the Download Certificate link.

The Certificate (KDC-root-cert.cer) will be saved in the Downloads folder.  You will need this certificate in an upcoming step.

1. Click Configuration.
2. Click Add Policy Rule.

1. Select ALL RANGES for the If a user's network range is dropdown.
2. Select iOS for the and user accessing content from dropdown.
3. Select Authenticate using... for the Then perform this action dropdown.
4. Select Mobile SSO (for iOS) for the then the user may authenticate using dropdown.
5. Select Password (Local Directory) for the If the preceding method fails or is not applicable, then dropdown.

1. You may need to scroll down to find the Save button.
2. Click Save.

1. Click and drag the Mobile SSO (for iOS) handle to the top of the list.  This causes our Mobile SSO (for iOS) Policy to be processed first.
2. Click Save.

1. You may need to scroll down to find the Save button.
2. Click Save.

If necessary, close the Settings page that was left open on a previous step by clicking on the X.

1. Click Devices
2. Click Profiles & Resources
3. Click Profiles
4. Hover the mouse over Add
5. Click Add Profile

Click Apple iOS.

1. Click General.
2. Enter "iOS Identity KDC Cert" in the Name field.
3. Scroll down if needed.
4. Click in the Assigned Groups field and a list of groups will appear.
5. Click All Devices ([email protected]).

1. Click the Credentials payload.
2. Click Configure.

1. Ensure Upload is selected for the Credential Source field.
2. Click Upload.

Click Choose File in the Add popup.

1. Click the Downloads folder.
2. Select the KDC-root-cert.cer file by clicking on it.
3. Click Open.

Click Save.

1. Scroll down to find the <--> SCEP payload.
2. Click <--> SCEP.
3. Click Configure.

1. Select AirWatch Certificate Authority for the Credential Source dropdown.
2. Select AirWatch Certificate Authority for the Certificate Authority dropdown.
3. Select Single Sign On for the Certificate Template dropdown.

1. Scroll down to view the Single Sign-On payload.
2. Click Single Sign-On.
3. Click Configure.

1. Enter a friendly name like "testsso" in the Account Name field.
2. Enter the "{EnrollmentUser}" lookup value in the Kerberos Principal Name field.
3. Enter "VIDMPREVIEW.COM" in the Realm field.
   
   NOTE - The value for Realm is case sensitive and it needs to be all upper case.
   
4. Select "SCEP #1" from the Renewal Certificate dropdown.

1. Scroll down until you see the URL Prefixes and Applications sections.
2. Enter your VMware Identity Manager URL (https://{tenantName}.vidmpreview.com) in the URLs field.
   NOTE - This is the VMware Identity Manager URL you received in the email when starting the lab and also the VMware Identity Manager URL you've logged into during previous lab steps.
3. Enter "com.apple.mobilesafari" for the Application Bundle ID field.
4. Click Save & Publish.

Click Publish.