You can use Omnissa Identity Service to manage user provisioning and authentication for Horizon Cloud. To set up the connection, configure Omnissa Identity Service as the identity provider in the Horizon Cloud console, and, in Omnissa Identity Service, select Horizon Cloud as one of the supported services.
What's Supported
Only the following configurations are supported for Horizon Cloud:
- Microsoft Entra ID, Okta, or Google Workspace as the third-party identity provider integrated with Omnissa Identity Service
- OpenID Connect as the authentication protocol
Microsoft Entra ID Attributes Required for Horizon Cloud
When you integrate Omnissa Identity Service with Microsoft Entra ID as the third-party identity provider, you must map certain user attributes to synchronize from Entra ID to Omnissa Identity Service.
Note: If you have a hybrid identity model with on-premises Active Directory and Entra ID, you must first sync the required on-premises attributes to Entra ID. See Syncing On-Premises Active Directory Attributes to Entra ID.
Horizon Cloud requires the following user attributes:
| Microsoft Entra ID Attribute | SCIM User Attribute (Required) |
|---|---|
| userPrincipalName | userName |
| emails[type eq "work"].value | |
| givenName | name.givenName |
| surname | name.familyName |
| objectId | externalId |
| Switch([IsSoftDeleted], "False", "True", "True", "False") | active |
| userPrincipalName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:userPrincipalName Note: You must add this mapping in addition to mapping userPrincipalName to userName. Mapping userPrincipalName to two different SCIM attributes is required because those SCIM attributes are separate attributes in Horizon Cloud, both of which are required. |
| onPremisesSamAccountName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesSamAccountName |
| onPremisesUserPrincipalName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesUserPrincipalName |
| onPremisesSecurityIdentifier | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesSecurityIdentifier |
| onPremisesDomain | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesDomain |
| securityIdentifier | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:securityIdentifier |
Note: The table shows the typical mapping between the required SCIM attributes and Microsoft Entra ID attributes. You can map the SCIM attributes to different Microsoft Entra ID attributes than those listed here.
In addition to the required attributes, you can synchronize optional attributes and custom attributes. For the list of supported optional and custom attributes, see User Attribute Mapping for Omnissa Identity Service.
Syncing On-Premises Active Directory Attributes to Entra ID
If you have a hybrid identity model with on-premises Active Directory and Entra ID, you must sync the required on-premises attributes to Entra ID before you integrate Entra ID with Omnissa Identity Service. For the list of required attributes, see Attributes required by Horizon Cloud.
Sync the attributes using an application such as Microsoft Entra Connect Sync or Microsoft Entra Connect Cloud Sync. You can use directory extensions to sync the attributes. See the Microsoft documentation for more information. For example, see:
- Microsoft Entra Connect Sync: Understand and customize synchronization
- Microsoft Entra Connect Sync: Directory extensions
- How to customize a synchronization rule
After syncing the attributes to Entra ID, add them to the provisioning app.
Okta Attributes Required for Horizon Cloud
When you integrate Omnissa Identity Service with Okta as the third-party identity provider, you must map certain user attributes to synchronize from Okta to Omnissa Identity Service.
Horizon Cloud requires the following user attributes:
| Okta Attribute | SCIM User Attribute (Required) |
|---|---|
| userName | userName |
| user.email | |
| emailType | (user.email != null && user.email != ") ? 'work' : " |
| user.firstName | name.givenName |
| user.lastName | name.familyName |
| externalId | externalId Note: This attribute is set implicitly. You do not need to add it manually. |
| active | active Note: This attribute is set implicitly. You do not need to add it manually. |
| login | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:userPrincipalName Note: If you have an Okta-Entra ID integration, map this SCIM attribute to the custom Okta attribute to which you map Entra ID userPrincipalName instead of mapping it to login. |
| Attribute used for on-premises SamAccountName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesSamAccountName |
| Attribute used for on-premises UserPrincipalName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesUserPrincipalName |
| Attribute used for on-premises SecurityIdentifier | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesSecurityIdentifier |
Note: The table shows the typical mapping between the required SCIM attributes and Okta attributes. You can map the SCIM attributes to different Okta attributes than those listed here.
In addition to the required attributes, you can synchronize optional attributes and custom attributes. For the list of supported optional and custom attributes, see User Attribute Mapping for Omnissa Identity Service.
Important: You cannot specify group attribute mappings in Okta to synchronize to Omnissa Identity Service. You can only map user attributes.
Google Workspace Attributes Required for Horizon Cloud
When you integrate Omnissa Identity Service with Google Workspace as the third-party identity provider, you must map certain user attributes to synchronize from Google Workspace to Omnissa Identity Service.
Note: If you have a hybrid identity model with on-premises Active Directory and Google Workspace, you must first sync the required on-premises attributes to Google Workspace.
Horizon Cloud requires the following user attributes:
| Google Attribute | SCIM User Attribute (Required) |
|---|---|
| Basic Information > Username | userName |
| Email > Value | emails.value |
| Email > Is primary | emails.primary |
| Basic Information > First name | name.givenName |
| Basic Information > Last name | name.familyName |
| active | active Note: This attribute is set implicitly. You do not need to add it manually. |
| Attribute used for onPremisesUserPrincipalName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:userPrincipalName |
| Attribute used for onPremisesUserPrincipalName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesUserPrincipalName |
| Attribute used for onPremisesSamAccountName | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesSamAccountName |
| Attribute used for onPremisesSecurityIdentifier | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:onPremisesSecurityIdentifier |
| Attribute used for onPremisesSecurityIdentifier | urn:ietf:params:scim:schemas:extension:ws1b:2.0:User:SecurityIdentifier |
In addition to the required attributes, you can synchronize optional attributes and custom attributes. For the list of supported optional and custom attributes, see User Attribute Mapping for Omnissa Identity Service.
Note: Since you can only provision users from Google Workspace to Omnissa Identity Service, group attribute mapping is not applicable to this integration.
How to Set Up the Integration between Omnissa Identity Service and Horizon Cloud
The high-level tasks to set up the connection between Omnissa Identity Service and Horizon Cloud Service include:
- Configure Horizon Cloud
Follow the Horizon Cloud documentation to configure the service. - Configure Omnissa Identity Service
Follow the Omnissa Identity Service documentation to configure the service and set up the integration with your third-party cloud-based identity provider. - Select Horizon Cloud as one of the supported services in Omnissa Identity Service
See Select Omnissa Services. - Configure Omnissa Identity Service as the identity provider in the Horizon Cloud console
See Setting up your Identity Provider and Connecting your Identity Provider in the Horizon Cloud documentation.
Was this page helpful?