Configuring Untrusted Domains

You can add user domains that do not have a formal trust relationship with the Omnissa Horizon Connection Server domain. Setting up a one-way or two-way trust relationship between the Horizon Connection Server domain and the user's domain is often times an intrusive activity into the user's Active Directory (AD) infrastructure. Instead, you can deploy Omnissa Horizon in a separate domain and set up communication with the user domain by configuring it as an untrusted domain.

Establishing an untrusted relationship can be an easier set up to manage in some scenarios such as when you have a cloud-hosted Horizon Connection Server domain communicating with an on-premises user domain.

You can create a primary domain bind account to set up the untrusted relationship between the Horizon Connection Server domain and another domain. Omnissa Horizon 8 uses the domain bind account to query and perform lookups in Active Directory. You can also add multiple auxiliary accounts in case the primary domain bind account becomes inaccessible or locked out.

When configured, Horizon 8 uses the auxiliary domain bind account to query and perform lookups in Active Directory.

In Omnissa Horizon Console, you can view the configured untrusted domains on the Domain Bind tab and information and trust relationships for Horizon Connection Server domains on the Horizon Connection Server tab by navigating to Settings > Domains.

When an untrusted domain is configured successfully and later on an administrator establishes a formal trust relationship (one-way or two-way) of the untrusted domain with a Horizon Connection Server domain, the untrusted domain will be treated as a Horizon Connection Server domain. The untrusted domain will no longer appear in Domains > Domain Bind tab and will appear in Domains > Horizon Connection Server tab.

Users belonging to an untrusted domain can use SAML authentication and smart card authentication. To use SAML authentication, see Using SAML Authentication. Users belonging to an untrusted domain can also use True SSO with SAML authentication. To use smart card authentication, see Setting Up Smart Card Authentication.