{"id":52613,"date":"2022-05-17T09:00:31","date_gmt":"2022-05-17T07:00:31","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=52613"},"modified":"2026-04-29T12:25:31","modified_gmt":"2026-04-29T10:25:31","slug":"vmware-horizon-true-sso-configuration-pt-1","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-1\/","title":{"rendered":"VMware Horizon True SSO configuration - pt.1"},"content":{"rendered":"<p><img decoding=\"async\" class=\"aligncenter wp-image-52910 size-full\" title=\"horizon-saml-true-sso-setup-pt1-01\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-01.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-01\" width=\"602\" height=\"202\" \/><\/p>\n<p>VMware Horizon True SSO configuration is used to <strong>eliminate the credential requests<\/strong> from Active Directory while accessing Horizon virtual desktops and published applications.<\/p>\n<p>After the user login to <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-2103-deploy-published-apps-with-rds-farms\/\">VMware Horizon<\/a> with an Identity Provider using <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-uag-two-factor-authentication-configuration\/\">UAG<\/a>, with the True SSO (single sign-on) feature enabled the <strong>user is not prompted<\/strong>\u00a0to enter the Active Directory credentials twice to use VDI or published apps.<!--more--><\/p>\n<p><a href=\"https:\/\/nolabnoparty.com\/en\/vmware-uag-configure-azure-mfa-saml\/\">UAGs<\/a> can be configured to leverage <a href=\"https:\/\/en.wikipedia.org\/wiki\/Security_Assertion_Markup_Language\" target=\"_blank\" rel=\"noopener\">SAML<\/a> capability to <strong>enable the communication<\/strong> between Identity Providers (Azure for example) and Horizon using <strong>secure tokens<\/strong> with no need to share credentials. This security tokens are SSO certificates generated for each user by the CA and requested by the <strong>Horizon Enrollment Server<\/strong>. Bear in mind that SAML doesn't provide <strong>any password<\/strong> to Horizon.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52912 size-large\" title=\"horizon-saml-true-sso-setup-pt1-02\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-02-600x401.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-02\" width=\"600\" height=\"401\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Blog series<\/h2>\n<p>VMware Horizon True SSO configuration - pt.1<br \/>\n<a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-2\/\">VMware Horizon True SSO configuration - pt.2<\/a><br \/>\n<a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-3\/\">VMware Horizon True SSO configuration - pt.3<\/a><\/p>\n<p>&nbsp;<\/p>\n<h2>Firewall ports for Horizon True SSO<\/h2>\n<p>The following ports must be open in the Firewall to allow the correct traffic flow.<\/p>\n<ul>\n<li><strong>TCP 443<\/strong> - mainly used for the authentication traffic flow.<\/li>\n<li><strong>TCP 135<\/strong> - used by the Enrollment Server for the initial communication with the CA then a random port from <strong>1024 \u2013 5000 and 49152 -65535<\/strong>.<\/li>\n<li><strong>TCP 32111<\/strong> - used by the Connection Server to use the Enrollment Server.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52914 size-large\" title=\"horizon-saml-true-sso-setup-pt1-03\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-03-600x386.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-03\" width=\"600\" height=\"386\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Install the Enrollment Server<\/h2>\n<p>To deploy the True SSO service, a VMware Horizon Enrollment Server must be installed on a Windows machine with at least <strong>4 GB RAM<\/strong>.<\/p>\n<p>The Enrollment Server is used to <strong>request a short-lived certificate<\/strong> on behalf of the user that is authenticating against Horizon. This certificate is what True SSO uses to avoid requesting the user to enter the <strong>credentials also for Active Directory<\/strong>.<\/p>\n<p>At least one Enrollment Server must be installed to perform True SSO but it is <strong>recommended to have two servers<\/strong> for redundancy (active-passive cluster) and it <strong>cannot be installed<\/strong> on the same server as the Connection Server. The Enrollment Server can be installed in the <strong>same server as the CA<\/strong> and to <strong>optimize the performance<\/strong> it should be configured to prefer using the local CA.<\/p>\n<p>To install the Enrollment Server you need a Windows Server VM and the <strong>same installer file<\/strong> used for the <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-7-12-installing-connection-server-pt-1\/\">Connection Server<\/a>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52916 size-full\" title=\"horizon-saml-true-sso-setup-pt1-04\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-04.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-04\" width=\"514\" height=\"314\" \/><\/p>\n<p>Run the installation wizard and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52918 size-full\" title=\"horizon-saml-true-sso-setup-pt1-05\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-05.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-05\" width=\"500\" height=\"386\" \/><\/p>\n<p>Accept the EULA and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52920 size-full\" title=\"horizon-saml-true-sso-setup-pt1-06\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-06.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-06\" width=\"500\" height=\"386\" \/><\/p>\n<p>Leave default <strong>Destination Folder<\/strong> and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52922 size-full\" title=\"horizon-saml-true-sso-setup-pt1-07\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-07.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-07\" width=\"500\" height=\"386\" \/><\/p>\n<p>From the drop-down menu select <strong>Horizon Enrollment Server<\/strong> option and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52924 size-full\" title=\"horizon-saml-true-sso-setup-pt1-08\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-08.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-08\" width=\"500\" height=\"386\" \/><\/p>\n<p>Select <strong>Configure Windows Firewall automatically<\/strong> and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52926 size-full\" title=\"horizon-saml-true-sso-setup-pt1-09\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-09.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-09\" width=\"500\" height=\"386\" \/><\/p>\n<p>Click <strong>Install<\/strong> to proceed with the installation.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52928 size-full\" title=\"horizon-saml-true-sso-setup-pt1-10\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-10.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-10\" width=\"500\" height=\"386\" \/><\/p>\n<p>The software is being installed.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52930 size-full\" title=\"horizon-saml-true-sso-setup-pt1-11\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-11.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-11\" width=\"500\" height=\"386\" \/><\/p>\n<p>When the installation has been completed successfully, click <strong>Finish<\/strong> to exit the wizard.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52932 size-full\" title=\"horizon-saml-true-sso-setup-pt1-12\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-12.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-12\" width=\"500\" height=\"386\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Setup a Certification Authority<\/h2>\n<p>If a <strong>CA is not available<\/strong> in your network, you must install the CA before going ahead with the procedure. The Certificate Authority must be an\u00a0<strong>Enterprise CA<\/strong> type and can be installed on the <strong>same server<\/strong> as the Enrollment Server.<\/p>\n<p>&nbsp;<\/p>\n<h4>Install the CA<\/h4>\n<p>Login to a Windows-based machine and from the <strong>Server Manager<\/strong> click the <strong>Add roles and features<\/strong> link to install the <strong>Certification Authority role<\/strong>. Since the installation procedure is straightforward (just click Next), only the key steps are shown.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52934 size-large\" title=\"horizon-saml-true-sso-setup-pt1-13\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-13-600x268.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-13\" width=\"600\" height=\"268\" \/><\/p>\n<p>Select <strong>Active Directory Certificate Services<\/strong> role and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52936 size-large\" title=\"horizon-saml-true-sso-setup-pt1-14\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-14-600x427.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-14\" width=\"600\" height=\"427\" \/><\/p>\n<p>For True SSO purposes, you only need to select <strong>Certification Authority<\/strong> option as <strong>Role Services<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52938 size-large\" title=\"horizon-saml-true-sso-setup-pt1-15\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-15-600x427.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-15\" width=\"600\" height=\"427\" \/><\/p>\n<p>During the configuration wizard procedure, make sure to specify the CA as <strong>Enterprise CA<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52940 size-large\" title=\"horizon-saml-true-sso-setup-pt1-16\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-16-600x442.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-16\" width=\"600\" height=\"442\" \/><\/p>\n<p>If you don't have any CA installed in your infrastructure, select <strong>Root CA<\/strong> as CA type to install.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52942 size-large\" title=\"horizon-saml-true-sso-setup-pt1-17\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-17-600x442.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-17\" width=\"600\" height=\"442\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Configure CA in the same server<\/h4>\n<p>If the CA is <strong>installed on the same server<\/strong> as the Enrollment Server, run <strong>regedit<\/strong> in the Enrollment Server and navigate to <em>HKLM\\Software\\VMware, Inc.\\VMware VDM<\/em>.\u00a0Right click <strong>VMware VDM<\/strong> and select <strong>New &gt; Key<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52944 size-large\" title=\"horizon-saml-true-sso-setup-pt1-18\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-18-600x431.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-18\" width=\"600\" height=\"431\" \/><\/p>\n<p>For the new key enter the name <strong>Enrollment Service<\/strong>. Then right click the new created key and select <strong>New &gt; String Value<\/strong>\u00a0to create a new <strong>String (REG_SZ)<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52946 size-large\" title=\"horizon-saml-true-sso-setup-pt1-19\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-19-600x438.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-19\" width=\"600\" height=\"438\" \/><\/p>\n<p>Specify <strong>PreferLocalCa<\/strong> as key name then right click the created key and select <strong>Modify<\/strong>. Enter <strong>TRUE<\/strong> in the <strong>Value Data<\/strong> field and click <strong>OK<\/strong> to save the configuration.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52948 size-large\" title=\"horizon-saml-true-sso-setup-pt1-20\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-20-600x344.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-20\" width=\"600\" height=\"344\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Configure the Certificate Authority<\/h4>\n<p>Once the Certification Authority has been installed, <strong>open the Command Prompt<\/strong> and run the following command to configure the <strong>CA for non-persistent certificate<\/strong> processing.<\/p>\n<p><span style=\"color: #0000ff;\">C:\\&gt; certutil -setreg DBFlags +DBFLAGS_ENABLEVOLATILEREQUESTS<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52950 size-large\" title=\"horizon-saml-true-sso-setup-pt1-21\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-21-600x350.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-21\" width=\"600\" height=\"350\" \/><\/p>\n<p>Then run the following command to <strong>ignore offline CRL<\/strong> (certificate revocation list) errors on the CA:<\/p>\n<p><span style=\"color: #0000ff;\">C:\\&gt; certutil -setreg ca\\CRLFlags +CRLF_REVCHECK_IGNORE_OFFLINE<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52952 size-large\" title=\"horizon-saml-true-sso-setup-pt1-22\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-22-600x202.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-22\" width=\"600\" height=\"202\" \/><\/p>\n<p>Restart the service.<\/p>\n<p><span style=\"color: #0000ff;\">C:\\&gt; sc stop certsvc<\/span><br \/>\n<span style=\"color: #0000ff;\">C:\\&gt; sc start certsvc<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52954 size-large\" title=\"horizon-saml-true-sso-setup-pt1-23\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-23-600x331.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-23\" width=\"600\" height=\"331\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Configure the Certificate Template<\/h4>\n<p>Open the the <strong>Certification Authority<\/strong> and right click the <strong>Certificate Templates<\/strong> folder. Select <strong>Manage<\/strong> option.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52956 size-large\" title=\"horizon-saml-true-sso-setup-pt1-24\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-24-600x336.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-24\" width=\"600\" height=\"336\" \/><\/p>\n<p>From the list, right click the <strong>Smartcard Logon<\/strong> template and select <strong>Duplicate Template<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52958 size-large\" title=\"horizon-saml-true-sso-setup-pt1-25\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-25-600x590.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-25\" width=\"600\" height=\"590\" \/><\/p>\n<p>In the duplicated template, configure the following:<\/p>\n<p>&nbsp;<\/p>\n<p><strong>Compatibility<\/strong><\/p>\n<ul>\n<li>Select <strong>Windows Server 2008 R2<\/strong> from the <strong>Certification Authority<\/strong>\u00a0drop-down menu.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52960 size-full\" title=\"horizon-saml-true-sso-setup-pt1-26\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-26.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-26\" width=\"400\" height=\"560\" \/><\/p>\n<ul>\n<li>Click <strong>OK<\/strong> to confirm.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52962 size-full\" title=\"horizon-saml-true-sso-setup-pt1-27\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-27.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-27\" width=\"569\" height=\"357\" \/><\/p>\n<ul>\n<li>Select <strong>Windows 7 \/ Server 2008 R2<\/strong> from the <strong>Certificate Recipient<\/strong>\u00a0drop-down menu.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52964 size-full\" title=\"horizon-saml-true-sso-setup-pt1-28\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-28.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-28\" width=\"400\" height=\"560\" \/><\/p>\n<ul>\n<li>Click <strong>OK<\/strong> to confirm.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52966 size-full\" title=\"horizon-saml-true-sso-setup-pt1-29\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-29.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-29\" width=\"569\" height=\"357\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>General<\/strong><\/p>\n<ul>\n<li>Specify a <strong>Template display name<\/strong>.<\/li>\n<li>Set <strong>1 day<\/strong> for the <strong>Validity period<\/strong> and <strong>18 hours<\/strong> for the <strong>Renewal period<\/strong>.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52968 size-full\" title=\"horizon-saml-true-sso-setup-pt1-30\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-30.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-30\" width=\"400\" height=\"560\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Request Handling<\/strong><\/p>\n<ul>\n<li>Select <strong>Signature and smartcard logon<\/strong> in the <strong>Purpose<\/strong> field.<\/li>\n<li>Enable the option <strong>For automatic renewal of smart card certificates, use the existing key if a new key cannot be created<\/strong>.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52970 size-full\" title=\"horizon-saml-true-sso-setup-pt1-31\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-31.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-31\" width=\"400\" height=\"560\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Cryptography<\/strong><\/p>\n<ul>\n<li>Select <strong>Key Storage Provider<\/strong> as <strong>Provider Category<\/strong>.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52972 size-full\" title=\"horizon-saml-true-sso-setup-pt1-32\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-32.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-32\" width=\"400\" height=\"560\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Server<\/strong><\/p>\n<ul>\n<li>Enable the <strong>Do not store certificates and requests in the CA database<\/strong> option.<\/li>\n<li>Uncheck <strong>Do not include revocation information in issued certificates<\/strong> option.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52974 size-full\" title=\"horizon-saml-true-sso-setup-pt1-33\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-33.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-33\" width=\"400\" height=\"560\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Issuance Requirements<\/strong><\/p>\n<ul>\n<li>Check the <strong>This number of authorized signatures<\/strong> option and enter <strong>1<\/strong>.<\/li>\n<li>Select <strong>Application policy<\/strong> option from the drop-down menu <strong>Policy type required in signature<\/strong>.<\/li>\n<li>Select <strong>Certificate Request Agent<\/strong> option from the drop-down menu <strong>Application policy<\/strong>.<\/li>\n<li>Select <strong>Valid existing certificate<\/strong> option.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52976 size-full\" title=\"horizon-saml-true-sso-setup-pt1-34\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-34.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-34\" width=\"400\" height=\"560\" \/><\/p>\n<p>&nbsp;<\/p>\n<p><strong>Security<\/strong><\/p>\n<ul>\n<li>Click <strong>Add<\/strong> button and add the Enrollment Server previously created.<\/li>\n<li>Select the added Enrollment Server and check <strong>Allow<\/strong> option for the <b>Enroll<\/b> permission.<\/li>\n<li>Click <strong>OK<\/strong> to save the template configuration.<\/li>\n<\/ul>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52978 size-full\" title=\"horizon-saml-true-sso-setup-pt1-35\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-35.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-35\" width=\"400\" height=\"560\" \/><\/p>\n<p>The created certificate template.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52980 size-full\" title=\"horizon-saml-true-sso-setup-pt1-36\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-36.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-36\" width=\"595\" height=\"207\" \/><\/p>\n<p>Now right click the <strong>Enrollment Agent (Computer)<\/strong> template and select <strong>Properties<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52982 size-large\" title=\"horizon-saml-true-sso-setup-pt1-37\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-37-600x449.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-37\" width=\"600\" height=\"449\" \/><\/p>\n<p>In the <strong>Security<\/strong> tab, add your Enroll Server and check <strong>Allow<\/strong> option for the <b>Enroll<\/b> permission.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52984 size-full\" title=\"horizon-saml-true-sso-setup-pt1-38\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-38.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-38\" width=\"400\" height=\"524\" \/><\/p>\n<p>Right-click <strong>Certificate Templates<\/strong> and select <strong>New &gt; Certificate Template to Issue<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52986 size-large\" title=\"horizon-saml-true-sso-setup-pt1-39\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-39-600x334.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-39\" width=\"600\" height=\"334\" \/><\/p>\n<p>Select the previously created template (<em>True SSO<\/em> in the example) and click <strong>OK<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52988 size-full\" title=\"horizon-saml-true-sso-setup-pt1-40\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-40.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-40\" width=\"583\" height=\"373\" \/><\/p>\n<p>Right-click <strong>Certificate Templates<\/strong> and select <strong>New &gt; Certificate Template to Issue<\/strong>\u00a0once again.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52990 size-large\" title=\"horizon-saml-true-sso-setup-pt1-41\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-41-600x333.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-41\" width=\"600\" height=\"333\" \/><\/p>\n<p>Select the <strong>Enrollment Agent (Computer)<\/strong> template and click <strong>OK<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52992 size-full\" title=\"horizon-saml-true-sso-setup-pt1-42\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-42.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-42\" width=\"583\" height=\"373\" \/><\/p>\n<p>The configured certificate templates. If you have an existing CA in your network and you are configuring a subCA, <strong>delete all certificate templates<\/strong> except for the two new created templates.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52994 size-large\" title=\"horizon-saml-true-sso-setup-pt1-43\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-43-600x327.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-43\" width=\"600\" height=\"327\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Install the certificate to the Enrollment Server<\/h2>\n<p>Now you need to <strong>import the certificate<\/strong> in your Enrollment Server.<\/p>\n<p>Login to the Enrollment Server and from the <strong>Run<\/strong> window run the <strong>certlm.msc<\/strong> command to open the <strong>Certification<\/strong> console. Click <strong>OK<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52996 size-full\" title=\"horizon-saml-true-sso-setup-pt1-44\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-44.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-44\" width=\"413\" height=\"229\" \/><\/p>\n<p>Right click <strong>Personal<\/strong> and select <strong>All Tasks &gt; Request New Certificate<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-52998 size-large\" title=\"horizon-saml-true-sso-setup-pt1-45\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-45-600x320.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-45\" width=\"600\" height=\"320\" \/><\/p>\n<p>Click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53000 size-large\" title=\"horizon-saml-true-sso-setup-pt1-46\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-46-600x440.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-46\" width=\"600\" height=\"440\" \/><\/p>\n<p>Select <strong>Active Directory Enrollment Policy<\/strong> (default) and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53002 size-large\" title=\"horizon-saml-true-sso-setup-pt1-47\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-47-600x440.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-47\" width=\"600\" height=\"440\" \/><\/p>\n<p>Select <strong>Enrollment Agent (Computer)<\/strong> and click <strong>Enroll<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53004 size-large\" title=\"horizon-saml-true-sso-setup-pt1-48\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-48-600x440.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-48\" width=\"600\" height=\"440\" \/><\/p>\n<p>Click <strong>Finish<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53006 size-large\" title=\"horizon-saml-true-sso-setup-pt1-49\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-49-600x440.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-49\" width=\"600\" height=\"440\" \/><\/p>\n<p>The certificate has been installed successfully.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53008 size-large\" title=\"horizon-saml-true-sso-setup-pt1-50\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/04\/horizon-saml-true-sso-setup-pt1-50-600x274.jpg\" alt=\"horizon-saml-true-sso-setup-pt1-50\" width=\"600\" height=\"274\" \/><\/p>\n<p><a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-2\/\">Part 2<\/a> will cover the <strong>export\/import procedure<\/strong> of the certificate and the configuration of <strong>SAML authentication<\/strong> in the UAG.<\/p>\n<p><img decoding=\"async\" title=\"signature\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" alt=\"signature\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>VMware Horizon True SSO configuration is used to eliminate the credential requests from Active Directory while accessing Horizon virtual desktops and published applications. After the user login to VMware Horizon with an Identity Provider using UAG, with the True SSO (single sign-on) feature enabled the user is not prompted\u00a0to enter the Active Directory credentials twice to use VDI or published apps.<\/p>\n","protected":false},"author":3,"featured_media":52910,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1025,2905],"tags":[688,1711,2448,2447],"class_list":["post-52613","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-horizon-en","category-omnissa-en","tag-active-directory-en","tag-horizon","tag-saml","tag-true-sso","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/52613","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=52613"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/52613\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/52910"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=52613"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=52613"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=52613"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}