To launch remote desktops and applications from Omnissa Workspace ONE Access or to connect to remote desktops and applications through a third-party load balancer or gateway, you must create a SAML authenticator in Horizon Console. A SAML authenticator contains the trust and metadata exchange between Horizon 8 and the device to which clients connect.
You associate a SAML authenticator with a Connection Server instance. If your deployment includes more than one Connection Server instance, you must associate a separate SAML authenticator with each instance.
You can allow one static authenticator and multiple dynamic authenticators to go live at a time. You can configure vIDM (Dynamic) and Unified Access Gateway (Static) authenticators and retain them in active state. You can make connections through either of these authenticators.
You can configure more than one SAML authenticator to a Connection Server and all the authenticators can be active simultaneously. However, the entity-ID of each of these SAML authenticators configured on the Connection Server must be different.
The status of the SAML authenticator in dashboard is always green as it is predefined metadata that is static in nature. The red and green toggling is only applicable for dynamic authenticators.
For information about configuring a SAML authenticator for Omnissa Unified Access Gateway appliances, see Authentication Methods for Unified Access Gateway and Third-Party Identity Provider Integration.
Prerequisites
-
Verify that Workspace ONE, Omnissa Workspace ONE Access, or a third-party gateway or load balancer is installed and configured. See the installation documentation for that product.
-
Verify that the root certificate for the signing CA for the SAML server certificate is installed on the Connection Server host. Omnissa does not recommend that you configure SAML authenticators to use self-signed certificates. For information about certificate authentication, see the Horizon 8 Installation and Upgrade document.
-
Make a note of the FQDN or IP address of the Workspace ONE server, Omnissa Workspace ONE Access server, or external-facing load balancer.
-
If you are using Workspace ONE or Omnissa Workspace ONE Access, make a note of the URL of the connector Web interface.
-
If you are creating an authenticator for a Unified Access Gateway appliance or a third-party appliance that requires you to generate SAML metadata and create a static authenticator, perform the procedure on the device to generate the SAML metadata, and then copy the metadata.
Procedure
-
In Horizon Console, navigate to Settings > Servers.
-
On the Connection Servers tab, select a server instance to associate with the SAML authenticator and click Edit.
-
On the Authentication tab, select a setting from the Delegation of authentication to Omnissa Horizon (SAML 2.0 Authenticator) drop-down menu to enable or disable the SAML authenticator.
Option Description Disabled SAML authentication is disabled. You can launch remote desktops and applications only from Horizon Client. Enabled SAML authentication is enabled. You can launch remote desktops and applications from both Horizon Client and Omnissa Workspace ONE Access or the third-party device. Required SAML authentication is enabled. You can launch remote desktops and applications only from Omnissa Workspace ONE Access or the third-party device. You cannot launch desktops or applications from Horizon Client manually. You can configure each Connection Server instance in your deployment to have different SAML authentication settings, depending on your requirements.
-
Click Manage SAML Authenticators and click Add.
-
Configure the SAML authenticator in the Add SAML 2.0 Authenticator dialog box.
Option Description Type For a Unified Access Gateway appliance or a third-party device, select Static. For Omnissa Workspace ONE Access select Dynamic. For dynamic authenticators, you can specify a metadata URL and an administration URL. For static authenticators, you must first generate the metadata on the Unified Access Gateway appliance or a third-party device, copy the metadata, and then paste it into the SAML metadata text box. Label Unique name that identifies the SAML authenticator. Description Brief description of the SAML authenticator. This value is optional. Metadata URL (For dynamic authenticators) URL for retrieving all of the information required to exchange SAML information between the SAML identity provider and the Connection Server instance. In the URL https://<YOUR HORIZON SERVER NAME>/SAAS/API/1.0/GET/metadata/idp.xml, click <YOUR HORIZON SERVER NAME> and replace it with the FQDN or IP address of the Omnissa Workspace ONE Access server or external-facing load balancer (third-party device).Administration URL (For dynamic authenticators) URL for accessing the administration console of the SAML identity provider. For Omnissa Workspace ONE Access, this URL should point to the Omnissa Workspace ONE Access Connector Web interface. This value is optional. True SSO Trigger Mode (For dynamic authenticators) Enable or disable TrueSSO for SAML authenticators. SAML metadata (For static authenticators) Metadata text that you generated and copied from the Unified Access Gateway appliance or a third-party device. Enabled for Connection Server Select this check box to enable the authenticator. You can enable multiple authenticators. Only enabled authenticators are displayed in the list. Require Encrypted Assertion (Horizon 2412 and later) Select this checkbox if you need Encrypted Assertion support. If the IDP is not able to send the Encrypted Assertion, leave this flag unchecked (the default), and the default Connection Server will allow an unencrypted SAML Assertion from the IDP. When IDP sends the Encrypted Assertion, the Connection Server will allow the encrypted assertion even when the Require Encrypted Assertion option is unchecked. Note: Add/Edit SAML Authenticator functions have this option selected by default.
Workspace ONE Mode If enabled, marks this SAML Authenticator as a Workspace ONE Authenticator. By default, Connection Server will not consider an authenticator as a Workspace ONE Authenticator. IDP Should Authenticate User Every Time If enabled, IDP (Identity Provider) should re-authenticate even if a SAML session is currently active for particular user. By default, IDP will not require users to re-authenticate when an user session is already active.
6. Click **OK** to save the SAML authenticator configuration.If you provided valid information, you must either accept the self-signed certificate (not recommended) or use a trusted certificate for Horizon 8 and Omnissa Workspace ONE Access or the third-party device. The Manage SAML Authenticators dialog box displays the newly created authenticator.
What to do next
Extend the expiration period of the Connection Server metadata so that remote sessions are not terminated after only 24 hours. See Change the Expiration Period for Service Provider Metadata on Connection Server.
Was this page helpful?