Configure True SSO with SSSD on Ubuntu/Debian Desktops

To enable True SSO with SSSD on an Ubuntu/Debian desktop, integrate the base virtual machine (VM) with an Active Directory (AD) domain using the SSSD solution. Then install the root Certificate Authority (CA) certificate to support trusted authentication before installing Horizon Agent.

Note: To ensure that an existing True SSO configuration continues to work after a Horizon 8 upgrade, you may need to modify /etc/sssd/sssd.conf. For more information, see Upgrading to Omnissa Horizon 8 2412 and Later.

Some examples in the procedure use placeholder values to represent entities in your network configuration, such as the host name of your VM. Replace the placeholder values with information specific to your configuration, as described in the following table.

Prerequisites

• Verify that the VM is running one of the following distributions.

  • Ubuntu
  • Debian

• Configure True SSO for Omnissa Access and Horizon Connection Server.

• Get a root CA certificate and save it to /tmp/certificate.cer on the Ubuntu/Debian VM. See How to Export Root Certification Authority Certificate.

  If a subordinate CA is also an issuing authority, then get the entire chain of root and subordinate CA certificates and save it to /tmp/certificate.cer on the VM.

Procedure

1. On the base VM, verify the network connection to Active Directory.

   sudo apt install -y realmd
   sudo realm discover mydomain.com
   

2. Install the required dependency packages.

   sudo apt-get install sssd-tools sssd libnss-sss libpam-sss libpam-pkcs11 adcli samba-common-bin krb5-user krb5-pkinit
   

3. Join the AD domain.

   sudo realm join --verbose mydomain.com -U admin-user
   

4. Install the root CA certificate or certificate chain.

   1. Locate the root CA certificate or certificate chain that you downloaded, and transfer it to a PEM file.

      sudo openssl x509 -inform der -in /tmp/certificate.cer -out /tmp/certificate.pem
      

   2. Copy the certificate to the /etc/sssd/pki/sssd_auth_ca_db.pem file.

      sudo cp /tmp/certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
      

5. Modify the /etc/sssd/sssd.conf configuration file, as shown in the following example.

   Notes:

   use_fully_qualified_names = False means use short name for user

   Add ad_gpo_map_interactive = +gdm-hzncred line for SSO

   Add ad_gpo_access_control = permissive only for Ubuntu 20.04 and Debian 12 to fix https://bugs.launchpad.net/ubuntu/+source/sssd/+bug/1934997

   Add the [pam] code lines below to have certificate login. pam_cert_auth line enables certificate login for the system. pam_p11_allowed_services line enables certificate login for Horizon Agent.

   Add the [cert] code lines to set match and map rule for certificate user.

   [sssd]
   domains = mydomain.com
   config_file_version = 2
   services = nss, pam
    
   [domain/mydomain.com]
   ad_domain = mydomain.com
   krb5_realm = MYDOMAIN.COM
   realmd_tags = manages-system joined-with-adcli
   cache_credentials = True
   id_provider = ad
   krb5_store_password_if_offline = True
   default_shell = /bin/bash
   ldap_id_mapping = True
   use_fully_qualified_names = False
   fallback_homedir = /home/%u@%d
   access_provider = ad
   ad_gpo_map_interactive = +gdm-hzncred
   ad_gpo_access_control = permissive
    
   [pam]
   pam_cert_auth = True
   pam_p11_allowed_services = +gdm-hzncred
    
   [certmap/mydomain.com/truesso]
   matchrule = <EKU>msScLogin
   maprule = (|(userPrincipal={subject_principal})(samAccountName={subject_principal.short_name}))
   domains = mydomain.com
   priority = 10
   

6. Change the access mode for the /etc/krb5.conf configuration file to make it editable.

   sudo chmod 644 /etc/krb5.conf
   

7. Modify the /etc/krb5.conf file, as shown in the following example.

   kdc and pkinit_kdc_hostname specify Kerberos Key Distribution Center
   This can be found in output of "dig +short _kerberos._tcp.MYDOMAIN.COM SRV" or "nslookup -type=SRV _kerberos._tcp.dc._msdcs.mydomain.com"
   

   Include the following PKINT parameters in the [realms] section.

   pkinit_anchors specifies the directory containing trusted CA certificates for PKINIT
   pkinit_kdc_hostname: Hostname of the KDC for PKINIT
   pkinit_eku_checking: Controls Extended Key Usage checking (example, kpServerAuth)
   

   The following example includes PKINT parameters in the [realms] section.

   [realms]
   http://MYDOMAIN.COM  = {
   kdc =  http://dnsserver.mydomain.com 
   admin_server =  http://dnsserver.mydomain.com 
   pkinit_anchors = FILE:/etc/sssd/pki/sssd_auth_ca_db.pem
   pkinit_kdc_hostname =  http://dnsserver.mydomain.com 
   pkinit_eku_checking = kpServerAuth
   }
   

8. Install the Horizon Agent package, with True SSO enabled.

   sudo ./install_viewagent.sh -T yes
   

9. Modify the /etc/omnissa/viewagent-custom.conf configuration file so that it includes the following line.

```

NetbiosDomain = MYDOMAIN
```

11. Restart the VM and log back in.