Skip to main content

Integrate with Nutanix AHV

Support level: Community

What is Nutanix AHV?​

Nutanix AHV is the native hypervisor of the Nutanix Cloud Platform, providing enterprise virtualization for compute workloads. AHV clusters are managed through Prism Central, which supports single sign-on with SAML 2.0 identity providers.

-- https://www.nutanix.com/products/ahv

Preparation​

The following placeholders are used in this guide:

  • prismcentral.company is the FQDN of the Prism Central instance that manages the Nutanix AHV cluster.
  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

This guide follows the authorization policy workflow available in Prism Central pc.2024.1 and later. Earlier versions use standard user and group role assignments.

authentik configuration​

To support the integration of Nutanix AHV with authentik, you need to create two property mappings and an application/provider pair in authentik. Prism Central identifies users by the username and email attributes in the SAML assertion, and uses the NameID attribute for role mapping.

Create property mappings​

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Customization > Property Mappings and click New Property Mapping.

  3. Select SAML Provider Property Mapping and click Next.

  4. Set the following values:

    • Mapping Name: Nutanix username

    • SAML Attribute Name: username

    • Expression:

      return request.user.username

  5. Click Create.

  6. Repeat these steps to create a second property mapping with the following values:

    • Mapping Name: Nutanix email

    • SAML Attribute Name: email

    • Expression:

      return request.user.email

  7. Click Create.

Create an application and provider​

SAML provider changes in authentik 2026.5

authentik 2026.5 introduces changes to how the SAML provider behaves. Specifically, the provider now automatically sets the Issuer value to: https://authentik.company/application/saml/<application_slug>/metadata/

Older versions of authentik set this value to authentik by default. If you're running an older version, please set Issuer to https://authentik.company/application/saml/<application_slug>/metadata/, where <application_slug> is the slug that you selected for the application.

  1. Log in to authentik as an administrator and open the authentik Admin interface.

  2. Navigate to Applications > Applications and click New Application to open the application wizard.

    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings.
    • Choose a Provider type: select SAML Provider as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Set the ACS URL to https://prismcentral.company:9440/api/iam/authn/callback.
      • Set the Audience to https://prismcentral.company:9440/api/iam/authn.
      • Under Advanced protocol settings:
        • Select an available Signing Certificate.
        • Add the Nutanix username and Nutanix email property mappings that you created in the previous section to Property mappings.
        • Set NameID Property Mapping to Nutanix email.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.

  3. Click Submit to save the new application and provider.

Download the authentik metadata​

  1. In the authentik Admin interface, navigate to Applications > Providers and click on the name of the provider that you created in the previous section.
  2. Under Related objects > Metadata, click Download. This metadata file is required in the next section.

Nutanix AHV configuration​

Authentication for Nutanix AHV clusters is configured in Prism Central.

Add the identity provider​

  1. Log in to Prism Central as an administrator.
  2. From the Application Switcher, select the Admin Center application, then select IAM from the navigation bar.
  3. Select the IdP Configuration tab.
  4. Click Add Identity Provider > SAML Identity Provider.
  5. In the Configure Identity Provider window, set the following values:
    • Configuration Name: authentik (this name appears on the Prism Central login screen)
    • Username Attribute: username
    • Email Attribute: email
  6. Click Import Metadata and upload the authentik metadata file that you downloaded in the previous section.
  7. Click Save.

Create an authorization policy​

By default, SAML users are not granted any permissions. On Prism Central pc.2024.1 and later, create an authorization policy to grant access.

  1. In the Admin Center, navigate to IAM > Authorization Policies.
  2. Click Create Authorization Policy.
  3. Choose the role to assign, then click Next.
  4. Define the scope of the policy, then click Next.
  5. In the Assign Users section, change Local User to the authentik identity provider that you created, enter the email address of the user that should receive access, and select the user.
  6. Click Save.

On earlier Prism Central versions, select or create a role, then use Actions > Manage Assignment to assign users or groups from the authentik identity provider.

Configuration verification​

To confirm that authentik is properly configured with Nutanix AHV, open Prism Central and select the authentik configuration on the login screen. Complete the authentik authentication flow and confirm that Prism Central opens with the expected role.

Resources​