On-Premises Cert AuthN Requirements:

• Functional Workspace ONE Access On-Premises tenant
• If in a Cluster, then the following is also needed:
• A Load Balancer with additional VIPs configured for internal and external access
• Internal and External LB VIPs configured for Workspace ONE Access Certificate Passthrough Authentication
• Public FQDN certificate for the tenant (e.g. a TLS cert for portal.company.com)
  NOTE: This must already be loaded on the Reverse Proxy or Load Balancer and working within the tenant for standard web-based authentication but will need to be loaded again within each node of the tenant within the "Install SSL Certificates" tab on the "Passthrough Certificates" sub-tab
• Certificate must be in OpenSSL PEM format with child cert at the top, intermediate (signing certs) in the middle, and root CA at the bottom.
• Active Directory synchronized to Workspace ONE Access with on-premises Workspace ONE Access Connector(s)
• Active Directory Certificate Services
• User Certificate for Authentication
• System/Browser Trust of the root Certificate Authority issuing the Client Certificates for authentication

Configurations:

1. First and foremost, we need to ensure standard browser password (cloud deployment) authentication works on the tenant and that all tenant services within the System Diagnostics panel are green.
2. Now we need to configure passthrough certificate authentication within each node's admin UI.
1. Login to each appliance admin UI (i.e. Login to https://:8443) within the tenant cluster and browse to "Install SSL Certificates" in the left side menu then select the "Passthrough Certificate" tab.
2. From there, set the port you wish to use (I am using "7443"), paste in the entire certificate chain, paste in the certificate key, and click the ADD button.
   NOTE: The certificate must be in an OpenSSL PEM format with the child cert at the top, intermediate (signing) certs in the middle, and the root CA cert at the bottom.
   
3. Next, we need to manually modify each node's runtime configuration file to apply the same settings.
1. Login to the appliance node console as root or SSH into the node with the sshuser account and then elevate privileges to root via the "su" command.
2. Edit the "/usr/local/horizon/conf/runtime-config.properties" file by issuing the below command.
   vi /usr/local/horizon/conf/runtime-config.properties
3. Within the runtime-config.properties file, modify the "components.certauth.port" value to read the actual TCP port number set in the steps above instead of its default value referencing the "${gateway.port}" variable.
   NOTE: Use "i" to enter Insert Mode and ESC to exit Insert Mode
4. Exit and save the modifications to the runtime-configu.properties file by typing ":x" within VI Editor.
   
4. Now we need to create the LB (if it exists for use with a 3-node cluster).
   NOTE: I am showing an F5 BIG-IP VIP configuration
1. For the VIP, create a Layer 4 Load Balancer (within F5, this is a performance layer 4, within AVI, this is a "Layer 4 SSL/TLS" LB).
2. Define the IP and the same TCP port as done within the appliances (in my case, "7443").
3. Set the HTTP Client Profile to your template where X-ForwardedFor is set (in my case, "WS1-HTTP").
4. Set the Source Address Translation to AutoMap (mainly for F5 BIG-IPs).
   
5. Now all that is necessary is to finish configuring Certificate (Cloud Deployment) as an authenticator within Workspace ONE Access. From here on out it should be pretty much the same as it is in a SaaS Workspace ONE Access tenant.
1. Within the On-Premises Workspace ONE Access tenant admin UI, browse to Identity & Access Management > Manage > Authentication Methods and click on the pencil for Certificate (Cloud Deployment) to enable and configure it.
1. Check the box to enable it.
2. Select your Root CA Issuing Certificate and upload it here by clicking the SELECT FILE button and uploading it.
3. Define what User Identifier to be used.
4. Other options are all optional.
5. Click SAVE when done.
   
2. Within the On-Premises Workspace ONE Access tenant admin UI, browse to Identity & Access Management > Manage > Identity Providers and click on your Access Directory's "Built-in" IdP (by default it is just called "Built-in" but it can be renamed if WS1 Access is integrated with more than one Active Directory environment).
1. Check the box next to Certificate (Cloud Deployment).
2. Click SAVE.
   
3. Now we need to add Certificate (Cloud Deployment) to the default authentication policy.
1. Within the On-Premises Workspace ONE Access tenant admin UI, browse to Identity & Access Management > Manage > Policies and EDIT the default_access_policy_set and navigate to "2. Configuration" within the Edit Policy wizard.
2. Edit each of your desired default_access_policy_set policy rules where you wish to have certificate based authentication and add in the "Certificate (Cloud Deployment)" authenticator.
3. Click SAVE on each policy rule.
4. When done modifying each policy rule, then click NEXT and SAVE to close out of the Edit Policy wizard.
   
6. Finally, the only step left is to configure your client to use certificate authentication via browser.
1. For this to work, simply deploy a user certificate to the client platform for the user to authenticate with via Workspace ONE Access.

User Experience:

References:

• Video: VMware Identity Manager - Configuring Certificate Authentication - Feature Walk-through
• VMware Docs: Configuring Certificate Authentication for use with Workspace ONE Access