{"id":52636,"date":"2022-05-24T09:00:29","date_gmt":"2022-05-24T07:00:29","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=52636"},"modified":"2026-04-29T12:24:41","modified_gmt":"2026-04-29T10:24:41","slug":"vmware-horizon-true-sso-configuration-pt-3","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-3\/","title":{"rendered":"VMware Horizon True SSO configuration - pt.3"},"content":{"rendered":"

\"horizon-saml-true-sso-setup-pt3-01\"<\/p>\n

To leverage True SSO in VMware Horizon<\/a>, Enrollment Server deployment, CA and SAML configuration in the UAG are the steps required<\/strong> before setting the True SSO authenticator in the Connection Server.<\/p>\n

Once enabled True SSO in the Connection Server, the login process to the VDI machine won't prompt to enter the credentials twice<\/strong> making the procedure faster.<\/p>\n

 <\/p>\n

Blog series<\/h2>\n

VMware Horizon True SSO configuration - pt.1<\/a>
\nVMware Horizon True SSO configuration - pt.2<\/a>
\nVMware Horizon True SSO configuration - pt.3<\/p>\n

 <\/p>\n

Configure SAML Authenticator<\/h2>\n

To configure the SAML Authenticator, access the Connection Server<\/strong> admin login page, enter the credentials then click Login<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-02\"<\/p>\n

From the dashboard, go to Settings > Servers<\/strong> area.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-03\"<\/p>\n

From the Connection Servers<\/strong> tab, select the first Connection Server and click Edit<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-04\"<\/p>\n

Go to Authentication<\/strong> tab and from the Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator)<\/strong> drop-down menu select Allowed<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-05\"<\/p>\n

Click Manage SAML Authenticators<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-06\"<\/p>\n

Click Add<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-07\"<\/p>\n

Select Static<\/strong> option as Type<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-08\"<\/p>\n

Open the .xml file<\/strong> previously downloaded from Azure and select and copy<\/strong> the content.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-09\"<\/p>\n

In the Connection Server, enter a Label<\/strong> name for the SAML 2.0 Authenticator (Azure_SSO<\/em> in the example) and paste the .xml content<\/strong> to the SAML Metadata<\/strong> box. Make sure that option Enable for Connection Server<\/strong> is checked. Click OK<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-10\"<\/p>\n

The new SAML Authenticator has been configured. Click OK<\/strong>\u00a0to save.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-11\"<\/p>\n

The just created authenticator is now configured as SAML Authenticator<\/strong>. Click OK<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-12\"<\/p>\n

 <\/p>\n

Configure second Connection Server<\/h4>\n

If your Horizon infrastructure has multiple Connection Servers<\/strong>, the following procedure must be applied to all Connection Servers installed.<\/p>\n

Select the second Connection Server and click Edit<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-13\"<\/p>\n

In the Authentication<\/strong> tab, select Allowed<\/strong> from the Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator)<\/strong> drop-down menu. Click Manage SAML Authenticators<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-14\"<\/p>\n

Select the authenticator configured in the first Connection Server (Azure_SSO<\/em> in the example) and click Edit<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-15\"<\/p>\n

Check the Enabled for Connection Server<\/strong> option and click OK<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-16\"<\/p>\n

The SAML authenticator is now enabled. Click OK<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-17\"<\/p>\n

The configured authenticator is now set under SAML Authenticator<\/strong>. Click OK<\/strong>\u00a0to save.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-18\"<\/p>\n

 <\/p>\n

Check the SAML Authenticator status<\/h4>\n

From the Connection Server, go to Monitor > Dashboard<\/strong> area and click View<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-19\"<\/p>\n

Access the Other Components<\/strong> section and go to SAML 2.0<\/strong> tab. The authenticator Status<\/strong> is reported as healthy.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-20\"<\/p>\n

 <\/p>\n

Enable Horizon True SSO<\/h2>\n

From the Connection Server, open a Command Prompt<\/strong> as Administrator.<\/p>\n

Run the following command to add the Enrollment Server<\/strong>. Repeat same command if you have multiple Enrollment Servers.<\/p>\n

vdmUtil --authAs <administrator> --authDomain <domain> --authPassword <password> --truesso --environment --add --enrollmentServer <enroll-server01, enroll-server02><\/p><\/blockquote>\n

C:\\> vdmUtil --authAs Administrator --authDomain nolabnoparty.local --authPassword Password --truesso --environment --add --enrollmentServer w16-enroll01.nolabnoparty.local<\/span><\/p>\n

\"horizon-saml-true-sso-setup-pt3-21\"<\/p>\n

Check available CAs and certificate templates<\/strong> for the domain.<\/p>\n

vdmUtil --authAs <administrator> --authDomain <domain> --authPassword <password> --truesso --environment --list --enrollmentServer <enroll-server> --domain <domain><\/p><\/blockquote>\n

C:\\> vdmUtil --authAs Administrator --authDomain nolabnoparty.local --authPassword Password --truesso --environment --list --enrollmentServer w16-enroll01.nolabnoparty.local --domain nolabnoparty.local<\/span><\/p>\n

\"horizon-saml-true-sso-setup-pt3-22\"<\/p>\n

If you have multiple Enrollment Servers<\/strong>, by default they are configured as active\/passive<\/strong>.<\/p>\n

vdmUtil --authAs <administrator> --authDomain <domain> --authPassword <password> --truesso --create --connector --domain <domain> --template <truesso template> --primaryEnrollmentServer <enroll-server01> --secondaryEnrollmentServer <enroll-server02> --certificateServer <ca-common-name01, ca-common-name02> --mode enabled<\/p>\n

C:\\> vdmUtil --authAs Administrator --authDomain nolabnoparty.local --authPassword Password --truesso --create --connector --domain nolabnoparty.local --template TrueSSO --primaryEnrollmentServer w16-enroll01.nolabnoparty.local --certificateServer lab-ca --mode enabled<\/span><\/p>\n

\"horizon-saml-true-sso-setup-pt3-23\"<\/p>\n

Check SAML Authenticators configured<\/strong> in Horizon.<\/p>\n

vdmUtil --authAs <administrator> --authDomain <domain> --authPassword <password> --truesso --list --authenticator<\/p><\/blockquote>\n

C:\\> vdmUtil --authAs Administrator --authDomain nolabnoparty.local --authPassword Password --truesso --list --authenticator<\/span><\/p>\n

\"horizon-saml-true-sso-setup-pt3-24\"<\/p>\n

Enable True SSO<\/strong> for the created SAML Authenticator.<\/p>\n

vdmUtil --authAs <administrator> --authDomain <domain> --authPassword <password> --truesso --authenticator --edit --name <authenticator> --truessoMode enabled<\/p><\/blockquote>\n

C:\\> vdmUtil --authAs Administrator --authDomain nolabnoparty.local --authPassword Password --truesso --authenticator --edit --name Azure_SSO --truessoMode enabled<\/span><\/p>\n

\"horizon-saml-true-sso-setup-pt3-25\"<\/p>\n

 <\/p>\n

Check True SSO status<\/h4>\n

Now go back to Monitor > Dashboard<\/strong> area and click View<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-26\"<\/p>\n

Access the Components<\/strong> section and go to TrueSSO<\/strong> tab. The TrueSSO Status<\/strong> is reported as healthy.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-27\"<\/p>\n

 <\/p>\n

Test True SSO<\/h2>\n

Now that the Horizon infrastructure has been configured for True SSO, let's test the login procedure.<\/p>\n

Access your Horizon infrastructure by entering the username<\/strong> and click Next<\/strong>. Note the login request comes from login.microsoftonline.com<\/em><\/span>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-28\"<\/p>\n

Enter the password and click Sign in<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-29\"<\/p>\n

Click Accept<\/strong> if you have configured a welcome screen. Note the URL now comes from the Horizon public DNS name (vdi.nolabnoparty.com<\/em> in the example).<\/p>\n

\"horizon-saml-true-sso-setup-pt3-30\"<\/p>\n

The screen shows the Desktop Pool the user is entitled. Click on the icon to access the VDI<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-31\"<\/p>\n

The login process takes place without prompting<\/strong> the Active Directory credentials.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-32\"<\/p>\n

The user logged into the machine successfully, True SSO is working as expected<\/strong>. If the user logged in at least once<\/strong>, at next login he\/she won't be prompted for credentials<\/strong>.<\/p>\n

\"horizon-saml-true-sso-setup-pt3-33\"<\/p>\n

The configuration of True SSO is now up and running<\/strong> and the users can take advantage of an easier login procedure<\/strong>.<\/p>\n

VMware Horizon is available to download as 60-day trial<\/a>.<\/p>\n

\"signature\"<\/p>\n","protected":false},"excerpt":{"rendered":"

To leverage True SSO in VMware Horizon, Enrollment Server deployment, CA and SAML configuration in the UAG are the steps required before setting the True SSO authenticator in the Connection Server. Once enabled True SSO in the Connection Server, the login process to the VDI machine won't prompt to enter the credentials twice making the procedure faster.<\/p>\n","protected":false},"author":3,"featured_media":53069,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1025,2905],"tags":[688,1711,2448,2447],"class_list":["post-52636","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-horizon-en","category-omnissa-en","tag-active-directory-en","tag-horizon","tag-saml","tag-true-sso","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/52636","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=52636"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/52636\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/53069"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=52636"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=52636"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=52636"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}