Setting Up Authentication To TAP GUI With Workspace ONE

Tanzu Application Platform uses Backstage as its frontend with some pretty amazing custom plugins. Backstage allows for Authentication to be configured with many different integrations however the documentation is very difficult to follow and in many cases is simply missing.
In this post we will go over the way to configure TAP GUI to use VMware's Workspace ONE IDP as the authentication provider, utilizing the OIDC authentication backend mechanism.

Workspace ONE Configuration

• Login to the admin portal and navigate to Catalog > Web Apps

• Create a new Web App by selecting the New button

• Enter the Name and if desired select an icon and add a description for the Web App in Workspace ONE

• Web App configuration

  a. Set the Authentication Type to be "OpenID Connect"

  b. Set the Target URL to be the URL of your Tanzu Application Platform GUI

  c. Set the Redirect URL to be the URL of your Tanzu Application Platform GUI with the path suffix of "/api/auth/oidc/handler/frame"

  d. Set the Client ID to be any descriptive name that makes sense such as "tap-gui"

  e. Set the Client Secret to be a unique string (can be generated via a command such as "openssl rand -base64 32")

  f. Set the Show in User Portal to true

• Select the access policy you want applied to your Web App

• Validate on the summary page everything is correct and then click on Save and Assign to add access for users to the Web App

• Select Users and or Groups via the search bar that should have access to the TAP GUI via Workspace ONE

• Navigate to Catalog > Settings

• Select the Remote App Access tab

• Find your Web App in the list and click on it to view the advanced configurations

• Click on the Edit button under the Scope section

• Select the scopes as depicted in the picture bellow

• Your Web App is now fully configured and ready to use with TAP GUI!

Tanzu Application Platform GUI Configuration

In your values file for the TAP installation where you will be installing TAP GUI you need to configure the Authentication backend to use our newly created Web App from WorkspaceONE as described bellow:

Once configured you can now either install TAP GUI or reconfigure it using the standard Tanzu CLI method.