1. Click System
2. Click Enterprise Integration
3. Click VMware Identity Manager
4. Click Configuration
5. Scroll down to the Certificate section
6. Click Enable

1. Scroll back down to the Certificate section
2. Click the Export button
3. Click Close (X) to exit the Workspace ONE Access Configuration settings page

The Certificate file (VidmAirWatchRootCertificate.cer) will be saved in the Downloads folder.  You will need this certificate in an upcoming step.

1. Click Identity & Access Management
2. Click Authentication Methods
3. Click on the Edit icon for Mobile SSO (for iOS)

1. Enable the Enable KDC Authentication check box.
2. Click the Select File button for Root and Intermediate CA Certificates

1. Select the Downloads folder
2. Select the VidmAirWatchRootCertificate.cer file that was downloaded
3. Click Open

Click OK in the confirmation dialog box.

1. Confirm the Certificate was uploaded
2. Click Save

1. Click Identity Providers
2. Click Built-in

1. Scroll down to the bottom of the page to find the KDC Certificate Export section
2. Click the Download Certificate link

The Certificate (KDC-root-cert.cer) will be saved in the Downloads folder.  You will need this certificate in an upcoming step.

1. Click Configuration
2. Click Add Policy Rule

You will now configure a new Access Policy Rule to allow your iOS devices in any network range to authenticate using the Mobile SSO (for iOS) authentication method you configured.  As a backup, you will allow users to enter their Password to also authenticate to the Workspace ONE catalog.

1. Select ALL RANGES for If a user's network range is
2. Select All Device Types for and user accessing content from
3. Select Authenticate using... for Then perform this action
4. Select Mobile SSO (for iOS) for then the user may authenticate using
5. Select Password (AirWatch Connector) for If the preceding method fails or is not applicable

1. Scroll down until you see the option to SAVE.
2. Click SAVE to continue.

1. Click and drag the Mobile SSO (for iOS) handle to the top of the list.  This causes our Mobile SSO (for iOS) Policy to be processed first.
2. Click NEXT

Click SAVE to apply the new Access Policy changes.

You have now successfully configured the Mobile SSO (for iOS) authentication method in Workspace ONE Access and setup your Access Policies to authentication your iOS devices using this authentication method!

1. Click Devices
2. Click Profiles & Resources
3. Click Profiles
4. Click Add
5. Click Add Profile

Click Apple iOS

1. Enter iOS Identity KDC Cert in the Name field
2. Click in the Smart Groups field and a list of smart groups will appear
3. Click All Devices ([email protected])

1. Enter Credentials in the payload search box
2. Click the Credentials payload
3. Click Configure

1. Select Upload for the Credential Source
2. Click Upload

Click Choose File

1. Click the Downloads folder
2. Click the KDC-root-cert.cer file
3. Click Open

Click Save to upload the KDC-root-cert.cer file.

1. Enter SCEP in the payload search box
2. Click the SCEP payload
3. Click Configure

1. Select AirWatch Certificate Authority for the Credential Source
2. Select AirWatch Certificate Authority for the Certificate Authority
3. Select Single Sign-On for the Certificate Template

1. Enter Single Sign-On in the payload search box
2. Click the Single Sign-On payload
3. Click Configure

1. Enter a friendly name like TestSSO for the Account Name
2. Enter the {EnrollmentUser} lookup value for the Kerberos Principal Name
3. Enter VIDMPREVIEW.COM for the Realm
   IMPORTANT: The value for Realm is case sensitive and it needs to be all upper case!
4. Select SCEP #1 from the Renewal Certificate dropdown

1. Scroll down until you see the URL Prefixes and Applications sections
2. Enter your Workspace ONE Access URL (https://{tenantName}.vidmpreview.com) in the URLs field. Replace {tenantName} with your Workspace ONE Access tenant name!
   NOTE: This is the Workspace ONE Access URL you've logged into during previous lab steps.
3. Enter com.apple.mobilesafari for the Application Bundle ID field.
4. Click Save & Publish.

You have now configured an iOS Profile that will:

• Distribute the KDC root certificate file to your enrolled iOS Devices
• Allow Single Sign-On to the VIDMPREVIEW.COM realm using the SCEP certificate you configured and provide the kerberos principal name as the enrolled username on the iOS device
• The Single Sign-On capabilities are allowed for your Workspace ONE Access tenant
• The iOS Safari app (com.apple.mobilesfari) is allowed to use this Single Sign-On login

Click PUBLISH