Prepare Active Directory for SSO in Multi-Forest Environments

This section describes how to prepare Active Directory for SSO in multi-forest environments using either a Horizon Cloud Certificate Authority (CA) or a Microsoft Enterprise CA.

In multi-forest deployments, users typically authenticate in one forest (user forest) and access resources such as desktops in another forest (resource forest). To enable features such as True SSO in this scenario, the resource forest must trust the certificate authority used in the user forest.

The following prerequisites and procedures ensure that certificate trust and communication are correctly established across forests.

Prerequisites

Before you begin, ensure that the following prerequisites are met:

• A minimum of a one-way trust relationship exists between the resource forest and the user forest (a two-way trust can also be used, depending on the deployment design)
• DNS resolution is configured to allow name resolution across forests
• Certificate revocation lists (CRLs) are accessible across forests
• Network connectivity exists between domain controllers, certificate authorities, and Horizon components across all participating forests to support certificate issuance and validation
• Certificates issued by the certificate authority can be validated across forests

Summary of Procedures That Follow

To enable SSO across multiple forests, you must ensure that the root and intermediate certificates from the certificate authority in the user forest are trusted in the resource forest.

For Horizon Cloud CA deployments, the SSO certificate bundle is published to Active Directory using a PowerShell script. For Microsoft Enterprise CA deployments, certificate services publish certificate information available within Active Directory.

The procedures that follow describe how to publish and configure these certificates so that cross-forest authentication can succeed.

Add the Root Certificate to Trusted Root Certification Authorities

The root certificate terminating from the Omnissa or Microsoft Enterprise CA certificate chain must be added to the Trusted Root Certification Authorities store using Group Policy in Active Directory.

Procedure

1. On all Active Directory forests that are part of the trust configuration, add the root certificate to the trusted root certification authorities.

   1. Select Start > Administrative Tools > Group Policy Management.

   2. Expand your domain, right-click Default Domain Policy, and click Edit.

2. Expand the Computer Configuration section and open Windows Settings\Security Settings\Public Key.

3. Right-click Trusted Root Certification Authorities and select Import.

4. Follow the prompts in the wizard to import the root certificate (for example, rootCA.cer) and click OK.

5. Close the Group Policy window.

Results

All of the systems in the domain now have a copy of the root certificate in their trusted root store.

What to do next

If an intermediate certification authority (CA) issues your smart card login or domain controller certificates, add the intermediate certificate to the Intermediate Certification Authorities group policy in Active Directory.

Add an Intermediate Certificate to Intermediate Certification Authorities

All intermediate certificates from the Horizon Cloud or Microsoft Enterprise CA certification chain must be added to the Intermediate Certification Authorities store using Group Policy in Active Directory.

Procedure

1. On all Active Directory forests that are part of the trust configuration, add all intermediate certificates that are part of the Horizon Cloud CA certificate chain to the intermediate certification authorities. On the Active Directory server, navigate to the Group Policy Management plug-in and complete the following steps:

   1. Select Start > Administrative Tools > Group Policy Management.

   2. Expand your domain, right-click Default Domain Policy, and click Edit.

2. Expand the Computer Configuration section and open the policy for Windows Settings\Security Settings\Public Key.

3. Right-click Intermediate Certification Authorities and select Import.

4. Follow the prompts in the wizard to import the intermediate certificate (for example, intermediateCA.cer) and click OK.

5. Close the Group Policy window.

Results

All of the systems in the domain now have a copy of the intermediate certificate in their intermediate certification authority store.

Add the Root Certificate to the Enterprise NTAuth Store

The root certificate terminating the Horizon Cloud or Microsoft Enterprise CA certification chain must be added to the Enterprise NTAuth store in Active Directory.

Procedure

1. On your Active Directory server, use the certutil command to publish the certificate to the Enterprise NTAuth store.

   For example: certutil -dspublish -f path_to_root_CA_cert NTAuthCA

Results

The CA is now trusted to issue certificates of this type.