With the True SSO feature, users can log in to Omnissa Workspace ONE Access using smart card, RADIUS, or RSA SecurID authentication, and they will no longer be prompted for Active Directory credentials, even when they launch a remote desktop or application for the first time.
With earlier releases, SSO (single sign-on) worked by prompting users for their Active Directory credentials the first time they launched a remote desktop or published application if they had not previously authenticated with their Active Directory credentials. The credentials were then cached so that subsequent launches would not require users to re-enter their credentials. With True SSO, short-term certificates are created and used instead of AD credentials.
Although the process for configuring SAML authentication for Omnissa Workspace ONE Access has not changed, one additional step has been added for True SSO. You must configure Omnissa Workspace ONE Access so that True SSO is enabled.
Note: If your deployment includes more than one Connection Server instance, you must associate the SAML authenticator with each instance.
Prerequisites
-
Verify that single sign-on is enabled as a global setting. In Horizon Console, select Settings > Global Settings, and verify that Single sign-on (SSO) is set to Enabled.
-
Verify that Omnissa Workspace ONE Access is installed and configured. See the Omnissa Workspace ONE Access documentation on the Omnissa Product Documentation portal.
-
Verify that the root certificate for the signing CA for the SAML server certificate is installed on the connection server host. Omnissa does not recommend that you configure SAML authenticators to use self-signed certificates. See the topic "Import a Root Certificate and Intermediate Certificates into a Windows Certificate Store," in the chapter "Configuring SSL Certificates for Horizon Servers," in the Horizon 8 Installation and Upgrade document.
-
Make a note of the FQDN of the Omnissa Workspace ONE Access server instance.
Procedure
-
In Horizon Console, select Settings > Servers.
-
On the Connection Servers tab, select a server instance to associate with the SAML authenticator and click Edit.
-
On the Authentication tab, from the Delegation of authentication to Omnissa Horizon (SAML 2.0 Authenticator) drop-down menu, select Allowed or Required.
You can configure each Connection Server instance in your deployment to have different SAML authentication settings, depending on your requirements.
-
Click Manage SAML Authenticators and click Add.
-
Configure the SAML authenticator in the Add SAML 2.0 Authenticator dialog box.
Option Description Label You can use the FQDN of the Omnissa Workspace ONE Access server instance. Description (Optional) You can use the FQDN of the Omnissa Workspace ONE Access server instance. Metadata URL URL for retrieving all of the information required to exchange SAML information between the SAML identity provider and the Horizon Connection Server instance. In the URL https://<YOUR HORIZON SERVER NAME>/SAAS/API/1.0/GET/metadata/idp.xml, click <YOUR HORIZON SERVER NAME> and replace it with the FQDN of the Omnissa Workspace ONE Access server instance.Administration URL URL for accessing the administration console of the SAML identity provider (Omnissa Workspace ONE Access instance). This URL has the format https://<Identity-Manager-FQDN>:8443.True SSO Trigger Mode TrueSSO Trigger Mode options are based on the SAML Authenticator Trigger Mode supported vdmUtil commands to manage the SAML Authenticators TrueSSO Trigger Mode individually. These options will reflect the current TrueSSO Trigger Mode value of the selected SAML Authenticator even if the TrueSSO Trigger Mode value has been manually updated in the connection server Enabled for Connection Server Select/deselect depending on your configuration. Require Encrypted Assertion If enabled, enforces encrypted SAML Assertion. By default Connection Server will not reject an authentication request if the SAML Assertion is not encrypted. Workspace ONE Mode If enabled, marks this SAML Authenticator as a Workspace ONE Authenticator. By default, Connection Server will not consider an authenticator as a Workspace ONE Authenticator. IDP Should Authenticate User Every Time If enabled, IDP (Identity Provider) should re-authenticate even if a SAML session is currently active for particular user. By default, IDP will not require users to re-authenticate when an user session is already active. -
Click OK to save the SAML authenticator configuration.
If you provided valid information, you must either accept the self-signed certificate (not recommended) or use a trusted certificate for Horizon 8 and Omnissa Workspace ONE Access.
The SAML 2.0 Authenticator drop-down menu displays the newly created authenticator, which is now set as the selected authenticator.
-
In the System Health section on the Horizon Console dashboard, click View and select Other components > SAML 2.0 Authenticators, select the SAML authenticator that you added, and verify the details.
If the configuration is successful, the authenticator's health is green. An authenticator's health can display red if the certificate is untrusted, if the Omnissa Workspace ONE Access service is unavailable, or if the metadata URL is invalid. If the certificate is untrusted, you might be able to click Verify to validate and accept the certificate.
-
Log in to the Omnissa Workspace ONE Access administration console, navigate to the desktop pool from the Catalog > Virtual Apps page, and select the True SSO Enabled check box.
What to do next
- Extend the expiration period of the Connection Server metadata so that remote sessions are not terminated after only 24 hours. See Change the Expiration Period for Service Provider Metadata on Connection Server.
- Use the
vdmutilcommand-line interface to configure True SSO on a connection server. See Configure Horizon Connection Server for True SSO.
For more information about how SAML authentication works, see Using SAML Authentication.
-
Was this page helpful?