permissions in Nutanix central (SaaS Version)

So if nutanix central is using a saml connection then you need to setup that saml connection as well in prism central. 

Hello Jeroen,

thanks for reply.

you need to setup that saml connection

But how? Nutanix central Authorization is using my Account at my.nutanix.com (my email address).

Our on prem clusters are using a local Microsoft AD and local Accounts for RBAC.

kind regards,

Thomas

I found this documentation:

https://portal.nutanix.com/page/documents/kbs/details?targetId=kA0VO0000001Amv0AE&a=18733c247a66120943096b3a9ce1681edc71a0c7c53c4a34ed23e95b9e24fb3d1255f95e8a91e9af

​@ThomasM If your Prism Central instances are using local AD/local accounts while Nutanix Central authenticates through your my.nutanix.com identity, they are treated as different identities unless SAML federation is configured end-to-end. Simply having the same email address isn't enough. The identity provider and user principal must match. I'd also verify that the SAML claims (especially NameID/UPN), role mappings, and domain registration completed successfully. Those are often the missing pieces when clusters connect but permissions don't propagate.

​@Allan Solomon Mejia  Thanks, I’ll check this.

Hello ​@Allan Solomon Mejia 

I’m struggling to grasp this: is it actually possible to manage on-prem Prism Central instances using Nutanix Central (as a SaaS solution) if:
a) the on-prem Prism Central instances authenticate against a local AD, and
b) authentication for Nutanix Central uses my.nutanix.com?
After all, the Prism Central instances are already connected to Nutanix Central via an API key.

Hi ​@ThomasM 

Yes, this scenario is supported. The authentication mechanisms are independent of the management connection.

• Your on-prem Prism Central instances can continue to authenticate administrators against your local Active Directory (LDAP).
• Nutanix Central (SaaS) uses its own identity provider (for example, my.nutanix.com or a configured enterprise IdP) to authenticate users accessing the SaaS portal.
• The connection between Nutanix Central and the registered Prism Central instances is established through the registration process and API-based trust, not by sharing the same authentication source.

In other words, users log in to Nutanix Central using the identity configured for the SaaS service, while Nutanix Central securely communicates with the registered Prism Central instances over the established trust relationship. Your existing AD authentication for Prism Central doesn't need to be replaced.

The only thing to keep in mind is that authorization (what you're allowed to do) within Nutanix Central is governed by its own RBAC model. So even though the managed Prism Central uses AD for authentication, you'll still need to assign the appropriate roles and permissions in Nutanix Central for administrators accessing resources through the SaaS interface.

I’m also sharing key references that will help you:

• Nutanix Central overview: https://www.nutanix.com/products/nutanixcentral
• Nutanix Security Guide (RBAC and Identity Management): https://www.nutanix.com/content/dam/nutanix/documents/certifications/nutanix-security.pdf
• Nutanix IAM API Reference: https://developers.nutanix.com/api-reference?namespace=iam&version=v4.1.b1