Configuring SSO Using Horizon Cloud CA for Linux Agents

You can configure Single Sign-On (SSO) for Linux virtual machines (VMs) in Horizon Cloud to allow users to log in seamlessly without re-entering credentials. This setup integrates the Horizon Agent running on Linux with the Horizon authentication service so that when users sign in to Horizon, they are automatically authenticated to their Linux desktops.

This configuration ensures a consistent user experience and secure access for Linux-based virtual desktops.

Prerequisites

Ensure the following before you begin:

• A Linux image is created in Horizon Cloud with the Horizon Agent for Linux installed and configured for certificate-based SSO.

  For details about supported operating systems and dependency versions, see System Requirements for Horizon Agent for Linux.

• A CA-based SSO configuration is created using Horizon Cloud CA in the Horizon Cloud Universal Console.

  For more details, see Adding an SSO Configuration for Horizon Cloud CA.

Steps to Configuring SSO for Linux VMs

The following steps describe how to configure SSO for Linux VMs using Horizon Cloud CA.

Required Certificates

1. Export Certificates

   Follow these steps to export the certificates required for SSO from the AD server:

   • Export the AD KDC Certificate

     1. Press Windows + R, type mmc, and press Enter.

     2. In the MMC console, go to File > Add/Remove Snap-in.

     3. Select Certificates, choose Computer account, and click Finish.

     4. Navigate to Certificates (Local Computer) > Personal > Certificates.

     5. Locate a valid Kerberos Authentication certificate.

     6. Right-click the certificate and select All Tasks > Export.

     7. Choose No, do not export the private key.

     8. Select Base-64 encoded X.509 (.CER) as the export format.

     9. Save the file, for example as: C:\Temp\AD_KDC_Certificate.cer.

   • Export the Intermediate CA Certificate

     • The Intermediate CA certificate is created automatically after you install the Horizon Cloud CA bundle on the Active Directory (AD) server.

     • The certificate is generated in the same folder where the CA installation Powershell script was run.

     • The file name follows a pattern similar to: HcsAuthEngine-CA-xxx.cer.

   • Export the Root CA Certificate

     1. On the Windows Server, press Windows + R, type certlm.msc, and press Enter.

     2. Navigate to: Trusted Root Certification Authorities > Certificates.

     3. Locate the correct root certificate. Tip: For a root certificate, the Issued To and Issued By fields are identical.

     4. Export the certificate using Base-64 encoded X.509 (.CER) format.

2. Convert Certificates to PEM Format

   Transfer exported certificates to the Linux VM and run the following:

   1 sudo openssl x509 -inform der -in /tmp/Intermediatecertificate.cer -out /tmp/certificate1.pem    
   2 sudo openssl x509 -inform der -in /tmp/kdc.cer -out /tmp/certificate2.pem
   

3. Add Certificates to the Linux VM Trust Store

   • Create the trust store (if it does not already exist).

     Run the following commands on the Linux VM:

     1 mkdir -p -m 755 /etc/sssd/pki    
     2 touch /etc/sssd/pki/sssd_auth_ca_db.pem
     3 chmod 644 /etc/sssd/pki/sssd_auth_ca_db.pem
     4 chown root:root /etc/sssd/pki/sssd_auth_ca_db.pem
     

   • Add the PEM certificates into the trust store file.

     1 sudo sh -c 'cat /tmp/kdc.pem /tmp/intermediate.pem /tmp/root.pem >> /etc/sssd/pki/sssd_auth_ca_db.pem'
     

   • Validate that the certificates were added correctly.

     Check for the PEM text corresponding to each certificate:

     1 cat /etc/sssd/pki/sssd_auth_ca_db.pem
     

     1 
     2 root@r3v25-1000:~# cat /etc/sssd/pki/sssd_auth_ca_db.pem 
     3 -----BEGIN CERTIFICATE-----
     4 MIIDojCCAoqgAwIBAgIQRKbCL+mFqTcqdobquyMJYTANBgkqhkiG9w0BAQwFADBh
     5 MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFDASBgoJkiaJk/IsZAEZFgR0ZTAxMTIw
     6 MAYDVQQDDClIY3NBdXRoRW5naW5lLUNBLTY4MWIzNTA4MWIwYjlhMjcyN2QyNzNk
     7 ZDAeFw0yNTA1MDcxMDE1MTJaFw0zMDA1MDYxMDI1MTJaMGExFTATBgoJkiaJk/Is
     8 ZAEZFgVsb2NhbDEUMBIGCgmSJomT8ixkARkWBHRlMDExMjAwBgNVBAMMKUhjc0F1
     9 dGhFbmdpbmUtQ0EtNjgxYjM1MDgxYjBiOWEyNzI3ZDI3M2RkMIIBIjANBgkqhkiG
     10 9w0BAQEFAAOCAQ8AMIIBCgKCAQEAlc/YwxHbvA8qmzQuOsKLKThyCVZWVLcSfRSx
     11 NOFIyNEkW9XiK49mLjHd36UkivN3qqUgDDbEDQNzmdbX/9CFH1V+g/lCFD0A/HpX
     12 7Px9WZLL7rYTNMo1fJiTgAl3EwsgdwyH5KUQNSrc6mz05nckXTA4Q6iMlU/1kFxQ
     13 eE2Ei94rVpCRx01s7PUeOF5XUEKSBqpZH5m/bIa3CXWlK8493tKKTa7OyUaa0LxX
     14 oyDjEpEMEPzBOF7Ue2gIelttHskZGMlyZ/r3JDwesKPxBHNw3Eq1F9dlIm0vZcbT
     15 i8pHhAZxXrltVwxnBOvK6M0v3w3+bTKBkgjH3Y6Ql3k1wOikZQIDAQABo1YwVDAd
     16 BgNVHQ4EFgQUdAg9vDkpi8NN0jaUYnA1VD3MENkwEgYJKwYBBAGCNxUBBAUCAwEA
     17 ATAOBgNVHQ8BAf8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQwF
     18 AAOCAQEAkfr77PvBTIZpnAPIQjGasz64HRT9vMks3lrfOSDot2FItk4eOO2S/KE6
     19 85M9eD8vy/p4Xl1cGo6JvWydAcW54YKSb83KEdJgNptUwP57kTeK2uXc2vTsoDHC
     20 WpiD2+kGVMgF7bUDEkIl+0H2gT+DR0aARRUTdJ5hLl/xzpaJERNXXLNVPC06qebr
     21 b+OtSp6UgjER4F+lwo7c+jdxR7v3utG47Fd2W8lHDyJErufmmyMs58xaB7CtM/ZT
     22 7u1wlTn2l3+LEbcFZQrfQ+MKKBvI3EuO/GA33TgumXsNeQCXl6+wIFZsKFTwDld3
     23 f98GSt/KD1H4HUxS7WFv3gbJaI1NYA==
     24 -----END CERTIFICATE-----
     25 -----BEGIN CERTIFICATE-----
     26 MIIDeTCCAmGgAwIBAgIQaulfpZ/89LVPMCqesKEXOTANBgkqhkiG9w0BAQsFADBP
     27 MRUwEwYKCZImiZPyLGQBGRYFbG9jYWwxFDASBgoJkiaJk/IsZAEZFgR0ZTAxMSAw
     28 HgYDVQQDExd0ZTAxLWFkLXBlcmYtdjItdGUwMS1DQTAeFw0yMzEyMjAyMTQ2MzRa
     29 Fw0yODEyMjAyMTU2MzBaME8xFTATBgoJkiaJk/IsZAEZFgVsb2NhbDEUMBIGCgmS
     30 JomT8ixkARkWBHRlMDExIDAeBgNVBAMTF3RlMDEtYWQtcGVyZi12Mi10ZTAxLUNB
     31 MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAvX5tatFAv6jjIWNmjS+A
     32 7cMK78qsldPEDz7DfYQzVnKWMMRP/RZIdFAtRcn2Pb4asrEz6B9cc2kAwyyEb7C2
     33 3LpXORx1s6ivq/N2S4hiJ5T048d5doo6iY6el2rAYTYkPxFdOE0hgqk55/uoYxpV
     34 I/pOSKbYO79UZQc6PXIGgGTk7cBUGhbccZ4trDyhWzfCw5wXfBHR3No+xyjw4LIM
     35 fhVlWkFVbqA2aFXmR62dxdF+RQnfYipAC3XlkSb4272vzWbI60BT5KgH6/qOqy9D
     36 MVdt6VxUJfp7lq9bEAsIhP8SXmiwSbwl5cUWun34fc9/CYZqFdJjZlBkeDi1QkRJ
     37 wQIDAQABo1EwTzALBgNVHQ8EBAMCAYYwDwYDVR0TAQH/BAUwAwEB/zAdBgNVHQ4E
     38 FgQUgHFkq7g25LjCNHTjtCZQn3US0bQwEAYJKwYBBAGCNxUBBAMCAQAwDQYJKoZI
     39 hvcNAQELBQADggEBAIT+Gq/epm4crWwjqS/AOuMOx19JMVAtHMYOWGFsOj4lC2UM
     40 BsfcgHcbn01OcwubF1uwyf1qx6PWPXVfgiglkpjlpQTUAb9KqJFarhCsOzFPb5Ur
     41 Am6SFE7+yoBH3SY4INottyBjhTCWLf4mEzO8wX2/Gryjt6rsdX7/oWRj7lV5Tl6i
     42 +UDdn8x6oTQx65B++EKOuAq6CXR+koRqGTHPXPdsz8iwFZMgF3ooTPHcNQ831C0Q
     43 oySWva7nwN2c00Hni/B+WUuT9r/OeFH3PBIOUvJHPnUSbqVuhmmGyQfMXNOn4W3v
     44 d8s1WvaY6CEiZi5PUbikZXjIaMPD886A4jQDSww=
     45 -----END CERTIFICATE-----
     46 root@r3v25-1000:~#
     

     For more information on installing CA certificates on Linux agents, refer to Configure True SSO with SSSD on Ubuntu/Debian Desktops.

What to do next

After completing the Linux-specific SSO configuration, publish the Linux image from the Horizon Cloud Universal Console. For more details, refer to Publish an Image with Microsoft Azure.