Which two steps must an NSX administrator take to integrate VMware Identity Manager in NSX to support role-based access control? (Choose two.)

The integration of NSX with VMware Identity Manager (now Workspace ONE Access) for Role-Based Access Control (RBAC) utilizes the OpenID Connect (OIDC) and OAuth 2.0 protocols. The process requires configuration on both systems. First, an OAuth 2.0 client must be created in VMware Identity Manager to represent the NSX Manager. This step generates a Client ID and a Client Secret. Second, the NSX administrator configures the integration within NSX Manager by providing the VMware Identity Manager's FQDN (service URL), the generated Client Secret, the Client ID, and the SSL thumbprint to establish a trusted connection.

A. This is incorrect because the integration uses the OIDC/OAuth 2.0 protocol, not SAML.
B. This uses SAML terminology ("Service Provider"). In an OAuth 2.0 integration, NSX Manager is registered as a "client," not a Service Provider.
C. This is incorrect as providing an IdP metadata URL is a step for configuring a SAML-based integration, not an OIDC/OAuth 2.0 integration.

1. VMware NSX 4.1 Administration Guide

Chapter: "Users and Roles"

Section: "Integrate Workspace ONE Access with NSX".

The guide states the first step is to "Create an OAuth 2.0 client in the Workspace ONE Access console for NSX." This directly supports option E.

The subsequent step

"Configure the integration on the NSX Manager

" details entering the "Workspace ONE Access FQDN

" "OAuth Client Secret

" and "Thumbprint." This directly supports option D.

2. VMware NSX-T Data Center 3.2 Administration Guide

Chapter: "Users and Roles"

Section: "Integrate VMware Identity Manager with NSX-T Data Center".

This document outlines the procedure: "In the VMware Identity Manager console

navigate to Catalog > Settings > Remote App Access > Create Client... Select OAuth 2.0 Client..." (supporting option E). It then instructs the user to configure NSX Manager with the vIDM FQDN

OAuth Client ID

OAuth Client Secret

and SSL Thumbprint (supporting option D). The guide makes no mention of SAML

Service Providers

or metadata URLs for this specific integration.