{"id":66182,"date":"2025-07-15T09:00:09","date_gmt":"2025-07-15T07:00:09","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=66182"},"modified":"2025-07-14T08:52:53","modified_gmt":"2025-07-14T06:52:53","slug":"enable-fido2-authentication-in-omnissa-horizon-true-sso","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/enable-fido2-authentication-in-omnissa-horizon-true-sso\/","title":{"rendered":"Enable FIDO2 authentication in Omnissa Horizon True SSO"},"content":{"rendered":"

\"enable-fido2-authentication-omnissa-horizon-true-sso-01\"<\/p>\n

To enforce the login process, FIDO2 authentication adds an additional layer of security<\/strong>, enabling a robust MFA authentication process.<\/p>\n

Leveraging Azure authentication methods<\/strong> and Omnissa Horizon<\/a> True SSO capabilities enhances the security of the VDI infrastructure against unwanted access.<\/p>\n

 <\/p>\n

Configure Omnissa Horizon True SSO<\/h2>\n

Before configuring the FIDO2 authentication, you must have a working Omnissa Horizon infrastructure that leverages SAML and True SSO<\/strong> (True SSO is recommended but not mandatory) for authentication.<\/p>\n

To configure Horizon True SSO, you can follow this guide<\/a>.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

 <\/p>\n

Configure the Azure security group<\/h2>\n

Login to the Azure portal<\/a> and click on Microsoft Entra ID<\/strong>.<\/p>\n

\"\"<\/p>\n

Select Manage > Groups<\/strong> to create a new group.<\/p>\n

\"\"<\/p>\n

Click New group<\/strong>.<\/p>\n

\"\"<\/p>\n

Specify the Group type<\/strong> as Security<\/strong> and enter the desired Group name<\/strong>. Click the link No members selected<\/strong> to add the required users.<\/p>\n

\"\"<\/p>\n

Select the users to add and click Select<\/strong> to confirm.<\/p>\n

\"\"<\/p>\n

Click Create<\/strong>.<\/p>\n

\"\"<\/p>\n

The new Security Group has been created successfully.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Enable passkeys (FIDO2) for the organization<\/h2>\n

After creating the Security Group, navigate to Microsoft Entra ID > Manage > Security<\/strong> area. Select Manage > Authentication methods<\/strong>.<\/p>\n

In the Authentication method policies<\/strong> section, click Passkey (FIDO2)<\/strong> to proceed with the configuration.<\/p>\n

\"\"<\/p>\n

Go to Manage > Policies<\/strong> section and click Passkey (FIDO2)<\/strong> option.<\/p>\n

\"\"<\/p>\n

In the Enable and Target<\/strong> tab, click on Enable<\/strong> switch and thick the Select groups<\/strong> option. Click the Add groups<\/strong> link to assign the desired security group for the selected authentication method.<\/p>\n

\"\"<\/p>\n

Select the security group created earlier (FIDO2<\/em> in the example) then click Select<\/strong>.<\/p>\n

\"\"<\/p>\n

The chosen group has been added.<\/p>\n

\"\"<\/p>\n

Now move to Configure<\/strong> tab and under GENERAL<\/strong> select Yes<\/strong> for both Allow self-service set up<\/strong> and Enforce attestation<\/strong> options. Click Yes<\/strong> for option Enforce key restriction<\/strong>.<\/p>\n

\"\"<\/p>\n

This option requires to add the AAGUID<\/strong> to enforce key restrictions. Each security key vendor must provides the Authenticator Attestation GUID (AAGUID), a 128-bit identifier<\/strong> indicating the key type<\/strong>, such as the make and model<\/strong>.\u00a0In this example the Thetis PRO-C FIDO2 Security Key Device - Passkey, USB-C & NFC<\/a> was used.<\/p>\n

A list of security keys eligible<\/strong> for attestation with Microsoft Entra ID can be found in this page<\/a>.<\/p>\n

Identify and copy the AAGUID<\/strong> written at the bottom of the corresponding Product<\/strong> page (AAGUID a3975549-b191-fd67-b8fb-017e2917fdb3<\/em>).<\/p>\n

\"\"<\/p>\n

Now click Add AAGUID<\/strong> to add the correct code.<\/p>\n

\"\"<\/p>\n

Paste the code<\/strong> copied from the website and click OK<\/strong> to save.<\/p>\n

\"\"<\/p>\n

Click Save<\/strong> to save the FIDO2 authentication method configuration.<\/p>\n

\"\"<\/p>\n

The Passkey (FIDO2) has been configured successfully.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Configure the security key<\/h2>\n

First, insert the security key into the computer's USB port.<\/p>\n

Download the Key Manager<\/strong> software for the FIDO2 security key in your hands and run the application.<\/p>\n

In the example the Thetis security key<\/strong> has been used. Access the FIDO<\/strong> area and specify the PIN<\/strong> for your key. A 6 numbers PIN<\/strong> is required to configure the PIN successfully.<\/p>\n

\"\"<\/p>\n

Go to Settings<\/strong> and select OATH OTP<\/strong> then click Save<\/strong>.<\/p>\n

\"\"<\/p>\n

In HOTP<\/strong> area, click Configure<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Generate<\/strong> then Save<\/strong>.<\/p>\n

\"\"<\/p>\n

Now go to Product Info<\/strong> and write down the serial number to better identify the key in case of need.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Configure FIDO2 authentication to users<\/h2>\n

Open your preferred browser and enter the URL: https:\/\/mysignins.microsoft.com\/security-info<\/span>. Enter the username of the user you want to configure then click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Enter the\u00a0Password<\/strong>\u00a0and click\u00a0Sign in<\/strong>.<\/p>\n

\"\"<\/p>\n

Specify the\u00a0MFA Code<\/strong> using the Authenticator then click\u00a0Verify<\/strong>. Note the user you want to configure with FIDO2\u00a0must have MFA enabled<\/strong> in Azure.<\/p>\n

\"\"<\/p>\n

In Security info<\/strong>\u00a0area, click Add sign-in method<\/strong>.<\/p>\n

\"\"<\/p>\n

Select Security key<\/strong> option.<\/p>\n

\"\"<\/p>\n

Select USB device<\/strong>.<\/p>\n

\"\"<\/p>\n

Click Next<\/strong>\u00a0to proceed.<\/p>\n

\"\"<\/p>\n

You are redirected to a new window.<\/p>\n

\"\"<\/p>\n

Insert the security key into the USB port and click Back<\/strong>.<\/p>\n

\"\"<\/p>\n

Select Use an external security key<\/strong>.<\/p>\n

\"\"<\/p>\n

Click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

Click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

Enter the security PIN<\/strong> configured earlier and click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

Push the button<\/strong> from the security key.<\/p>\n

\"\"<\/p>\n

In the FIDO2 security key used in this example the button is identified by the key icon<\/strong>.<\/p>\n

\"\"<\/p>\n

Enter a Name<\/strong> for the security key and click Next<\/strong>\u00a0to complete the configuration<\/p>\n

\"\"<\/p>\n

Click Done<\/strong> to close the window.<\/p>\n

\"\"<\/p>\n

The Passkey<\/strong> method has been configured successfully for the selected user.<\/p>\n

\"\"<\/p>\n

 <\/p>\n

Test the connection to a Horizon VDI using True SSO and FIDO2<\/h2>\n

Insert the FIDO2 security key into the USB port<\/strong> of your computer.<\/p>\n

Using the preferred browser, enter the public DNS name<\/strong> to access your VDI infrastructure (https:\/\/vdi.domain.com<\/em> for example). Click Omnissa Horizon Web Client<\/strong> (you can also use the Horizon Client).<\/p>\n

\"\"<\/p>\n

Since the infrastructure is configured to have MFA with Azure<\/a>, you need to specify your credentials. Enter your username<\/strong> and click Next<\/strong>.<\/p>\n

\"\"<\/p>\n

Enter the Password<\/strong> and click Sign in<\/strong>.<\/p>\n

\"\"<\/p>\n

Since the user is configured to have FIDO2 authentication as additional authentication method<\/strong>, you are prompted to specify the passkey to use. Click Windows Hello or external security key<\/strong> (the message type depends on the OS version used).<\/p>\n

\"\"<\/p>\n

Enter the PIN<\/strong> of your security key and click OK<\/strong>.<\/p>\n

\"\"<\/p>\n

Push the button<\/strong> on your key to complete the sign in process.<\/p>\n

\"\"<\/p>\n

If the authentication process succeed, the user is redirected to the typical Horizon console. Select the desired Desktop Pool<\/strong> to access the VDI.<\/p>\n

\"\"<\/p>\n

Because the infrastructure is configure to leverage True SSO, no additional credentials<\/strong> are required to access the VDI.<\/p>\n

\"\"<\/p>\n

Securing the access to the Omnissa Horizon infrastructure with FIDO2 authentication, you can enforce the login security process<\/strong> providing Multi Factor Authentication (MFA) to users.<\/p>\n

\"signature\"<\/p>\n","protected":false},"excerpt":{"rendered":"

To enforce the login process, FIDO2 authentication adds an additional layer of security, enabling a robust MFA authentication process. Leveraging Azure authentication methods and Omnissa Horizon True SSO capabilities enhances the security of the VDI infrastructure against unwanted access.<\/p>\n","protected":false},"author":3,"featured_media":66187,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1025,2905],"tags":[668,1682,2984,1711,2265],"class_list":["post-66182","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-horizon-en","category-omnissa-en","tag-authentication-en","tag-azure","tag-fido2","tag-horizon","tag-mfa","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/66182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=66182"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/66182\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/66187"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=66182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=66182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=66182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}