{"id":52626,"date":"2022-05-19T09:00:36","date_gmt":"2022-05-19T07:00:36","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=52626"},"modified":"2026-04-29T12:25:01","modified_gmt":"2026-04-29T10:25:01","slug":"vmware-horizon-true-sso-configuration-pt-2","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-2\/","title":{"rendered":"VMware Horizon True SSO configuration - pt.2"},"content":{"rendered":"

\"horizon-saml-true-sso-setup-pt2-01\"<\/p>\n

VMware Horizon True SSO eliminates the requirement of entering the credentials twice<\/strong>\u00a0while accessing VMware Horizon desktops and published applications.<\/p>\n

After installing the Enrollment Servers and configured the CA accordingly, the export\/import<\/strong> of the certificate and the SAML configuration<\/strong> are the next steps to perform.<\/p>\n

 <\/p>\n

Blog series<\/h2>\n

VMware Horizon True SSO configuration - pt.1<\/a>
\nVMware Horizon True SSO configuration - pt.2
\nVMware Horizon True SSO configuration - pt.3<\/a><\/p>\n

 <\/p>\n

Export the Enrollment Service Client Certificate<\/h2>\n

From a Connection Server, open the Certificate console<\/strong> by running the certlm.msc<\/strong> command.<\/p>\n

Expand VMware Horizon View Certificates<\/strong> and select Certificates<\/strong>. Search from the list the certificate with the Friendly Name vdm.ec<\/strong>\u00a0(all Connection Servers have the same certificate). Right click the certificate and select\u00a0All Tasks > Export<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Select No, do not export the private key<\/strong> then click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Select DER encoded binary X.509 (.CER)<\/strong> format and click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Enter a File Name<\/strong> for the certificate to export and click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Finish<\/strong>.<\/p>\n

\"\"<\/p>\n

Click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

Copy the exported certificate to the Enrollment Server.<\/p>\n

 <\/p>\n

Import the certificate to the Enrollment Server<\/h2>\n

In the Enrollment Server open the Certificates console<\/strong> with certlm.msc<\/strong>.<\/p>\n

Right click VMware Horizon View Enrollment Server Trusted Roots<\/strong> and select All Tasks > Import<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Browse<\/strong> to select the certificate file previously exported from the Connection Server and click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Select Place all certificates in the following store<\/strong> option and select VMware Horizon View Enrollment Server Trusted Roots<\/strong>. Click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Finish<\/strong> to import the certificate.<\/p>\n

\"\"<\/p>\n

The certificate has been imported successfully. Click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

The imported certificate.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Configure SAML authentication for Horizon True SSO<\/h2>\n

To take advantage of True SSO, you need to\u00a0create an application<\/strong> in your Azure environment first.<\/p>\n

Follow\u00a0this procedure<\/a> to create in Azure the appropriate application for the Unified Access Gateway<\/a>.<\/p>\n

 <\/p>\n

Download the Federation Metadata XML from the\u00a0Identity Provider<\/strong><\/h4>\n

Login in the Azure portal<\/a> and go to Azure Active Directory > Enterprise applications<\/strong>.<\/p>\n

\"\"<\/p>\n

From the All applications<\/strong> area, click the application link name<\/strong> created for UAG.<\/p>\n

\"\"<\/p>\n

Go to Single sign-on<\/strong> area and search for SAML Signing Certificate<\/strong> section. In the Federation Metadata XML<\/strong> field click the corresponding Download<\/strong> link.<\/p>\n

\"\"<\/p>\n

Save the file anywhere in your computer. Click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Configure the UAG<\/h4>\n

Access the UAG login page, enter the credentials and click Login<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Select<\/strong>.<\/p>\n

\"\"<\/p>\n

Under Identity Bridging Settings<\/strong>, select the gear icon<\/strong> next to Upload Identity Provider Metadata<\/strong> option.<\/p>\n

\"\"<\/p>\n

Click Select<\/strong> link next to IDP Metadata<\/strong>.<\/p>\n

\"\"<\/p>\n

Select the previously downloaded Federation Metadata XML<\/strong> file and click Save<\/strong>.<\/p>\n

\"\"<\/p>\n

Under General Settings<\/strong>, enable the Edge Service Settings<\/strong> selector and click the gear icon<\/strong> next to Horizon Settings<\/strong>.<\/p>\n

\"\"<\/p>\n

At the bottom of the window, click More<\/strong>.<\/p>\n

\"\"<\/p>\n

From Auth Methods<\/strong> drop-down menu, select SAML<\/strong>.<\/p>\n

\"\"<\/p>\n

Select the value from the Identity Provider<\/strong> drop-down menu (https:\/\/sts.windows.net<\/strong> in the example)\u00a0and click Save<\/strong> at the bottom to save the configuration.<\/p>\n

\"\"<\/p>\n

The SAML authentication is now configured in the UAG. Repeat same procedure also for the second UAG<\/strong>.<\/p>\n

Part 3<\/a> will cover the configuration of the True SSO<\/strong> in the Connection Server and the test to check<\/strong> that True SSO works as expected.<\/p>\n

\"signature\"<\/p>\n","protected":false},"excerpt":{"rendered":"

VMware Horizon True SSO eliminates the requirement of entering the credentials twice\u00a0while accessing VMware Horizon desktops and published applications. After installing the Enrollment Servers and configured the CA accordingly, the export\/import of the certificate and the SAML configuration are the next steps to perform.<\/p>\n","protected":false},"author":3,"featured_media":53012,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1025,2905],"tags":[688,1711,2448,2447],"class_list":["post-52626","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-horizon-en","category-omnissa-en","tag-active-directory-en","tag-horizon","tag-saml","tag-true-sso","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/52626","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=52626"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/52626\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/53012"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=52626"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=52626"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=52626"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}