Enabling Common Service Provider Metadata in Connection Servers

You can enable usage of common metadata within the cluster using the LDAP flag pae-SAMLKeySharingEnabled.

Note: Setting this flag doesn’t require restart of any service.

Prerequisites

• Enable SAML authentication and add a SAML authenticator in the Horizon Console as described in Configure a SAML Authenticator in Horizon Console.

Procedure

1. Log in to the pod’s Connection Server with domain administrator privileges.

2. Open the ADSI Edit tool (from Windows Administrative Tools).

3. In the console tree, select Connect to.

4. In the Select or type a Distinguished Name or Naming Context text box, enter the distinguished name.

5. In the Computer pane, select or type localhost:389 or the fully qualified domain name (FQDN) of the Connection Server host followed by port 389.

   For example: localhost:389 or mycomputer.example.com:389

6. Expand the ADSI Edit tree, then expand OU=Properties.

7. Select OU=Global, and double-click CN=Common in the right pane.

8. In the Properties dialog box, set the pae-SAMLKeySharingEnabled attribute based on the Connection Server version:

   • Connection Server version 2503
     Set pae-SAMLKeySharingEnabled to 1 to enable shared signing and encryption certificates across all Connection Servers in the cluster.

   • Connection Server version 2512 and later
     Set pae-SAMLKeySharingEnabled to 3 to enable cluster-level Service Provider (SP) metadata, including a shared Entity ID, signing certificate, and encryption certificate for all Connection Servers in the cluster.

9. When the common metadata feature is enabled, launching sp.xml from any Connection Server in the cluster using this URL will result in the same signing and encryption credentials:

   https://<CS_FQDN>/SAML/metadata/sp.xml

The resulting metadata behavior depends on the Connection Server version.

• Version 2503 and later with pae-SAMLKeySharingEnabled value set to 1:

  • Same encryption certificate across all Connection Servers
  • Same signing certificate across all Connection Servers
  • Connection Server–specific Entity ID (https://<CS_FQDN>/SAML/metadata/sp.xml)
  • Connection Server–specific ACS URL

• Version 2512 and later with pae-SAMLKeySharingEnabled value set to 3:

  • Same encryption certificate across all Connection Servers
  • Same signing certificate across all Connection Servers
  • Single, shared Entity ID (<Cluster_GUID>)
  • All Connection Server ACS URLs listed in the metadata (for example, https://CS1-FQDN/SAML/sso, https://CS2-FQDN/SAML/sso)

10. If WS1 Access is used, please perform a sync of the Virtual App Collection on the Access side.