Horizon Cloud - True SSO Requirements - Microsoft Enterprise Certificate Authority, Required Certificate Templates

For Horizon Cloud, ensure that your deployment has the elements required for using the True SSO feature with a Horizon Edge.

You might already be familiar with using True SSO in your prior Horizon deployments, such as Horizon 8 on-premises.

For a Horizon Cloud environment, the required elements for using the True SSO feature to provide your end users with single sign-on (SSO) access to their desktops and applications are a Microsoft Enterprise Certificate Authority and specifically configured certificate templates in that Microsoft Enterprise Certificate Authority.

Microsoft Enterprise Certificate Authority

Use of True SSO requires Microsoft Enterprise Certificate Authority.

The term Microsoft Enterprise Certificate Authority refers to a Microsoft Certificate Authority (Microsoft CA) running in enterprise mode. Because True SSO requires the enterprise configuration, the True SSO documentation uses the phrase Microsoft Enterprise Certificate Authority.

Note: In production environments, a best practice is to have a minimum of two (2) such certificate authorities to provide redundancy and load balancing.

If you do not already have a certificate authority set up, you must add the Active Directory Certificate Services (AD CS) role to a Microsoft Windows server and configure it as an enterprise CA.

Within the Microsoft procedure for configuring a Microsoft Enterprise Certificate Authority, you install the Active Directory Certificate Services (AD CS) role. The AD CS setup process gives you a choice between running the CA as an enterprise CA or a standalone CA.

Prerequisites for Set Up of the Required Certificate Templates for True SSO with Horizon Cloud

Specify the following settings, including the minimum key size for the Windows Server signing certificate for the True SSO template. For a Windows Server signing certificate, the minimum required key size is 2048. Specifying a minimum key size of less than 2048 causes authentication failure.

For the True SSO template, specify the following settings on the Cryptography tab.

For Provider Category, select Key Storage Provider.
For Algorithm name, select RSA.
For Minimum key size, specify 2048.
For Choose which cryptographic providers can be used for requests, select Requests can use any provider available on the subject's computer.
For Request hash, specify SHA384.
Click Save.

A partial screen shot is shown below which illustrates the 2048 minimum key size value.

Cryptography tab showing minimum key size set to 2048 bits.

Enable Non-Persistent Certificate Processing

For each Microsoft Enterprise Certificate Authority used by True SSO, a best practice is to enable non-persistent certificate processing.

Without non-persistent certificate processing enabled on the Microsoft Enterprise Certificate Authority, the True SSO certificates remain stored in the enterprise CA's database, leading to:

The enterprise CA's database growing unnecessarily quickly. True SSO requests a new certificate for every new connection.
Impacting performance, because the enterprise CA will run out of disk space as its database grows.

As described in KB article Configuring the Certificate Authority for processing non-persistent certificates and ignoring revocation checking - 2149312, to avoid the above issues, enable the DBFLAGS_ENABLEVOLATILEREQUESTS setting. See the KB article for details.

Note: In addition to describing the recommendation for enabling DBFLAGS_ENABLEVOLATILEREQUESTS, that KB article also describes use of another setting, CRLF_REVCHECK_IGNORE_OFFLINE. Enabling the CRLF_REVCHECK_IGNORE_OFFLINE setting depends on your PKI architecture. Enabling the CRLF_REVCHECK_IGNORE_OFFLINE setting is not a strict or hard requirement for True SSO and Horizon Cloud.

Set Up the Required Certificate Templates for True SSO with Horizon Cloud

The True SSO feature requires configuration of the certificate templates on the Microsoft Enterprise Certificate Authority that you are providing for use with True SSO and your Horizon Edge.

The certificate templates are the basis for the certificates that the Microsoft Enterprise Certificate Authority generates for use with True SSO.

The enrollment service accounts require Read and Enroll permissions on both templates, the TrueSsoEnrollmentAgent template and the TrueSso template.

Prerequisites

Verify that you have the Microsoft Enterprise Certificate Authority (AD CS) instances that the True SSO feature requires, as described in Supported Certificate Authority Types for Using SSO with a Horizon Edge.
Configure your firewall to allow the deployed Horizon Edges to communicate with the Certificate Authority instances with the required protocol and ports combination as described in the port and protocol requirements for your capacity type:
The communication uses the instances' Active Directory Certificate Services (AD CS). The required protocol is RPC/TCP (RPC over TPC). The first port is port 135 and the second port is within the range of 49152 -65535.
For a more firewall-friendly configuration, you can configure your Microsoft Enterprise Certificate Authority (AD CS) instances to use a static DCOM port and configure the firewall to allow the port 135 and your chosen static DCOM port, configuring that static port to be the same on all of the instances. This configuration is described in the Microsoft TechNet How to Configure a Static DCOM Port for AD CS.

Note: The following steps were performed using a Microsoft Enterprise Certificate Authority running the operating system Microsoft Windows Server 2016 Standard. The screenshots in the steps were taken from that system. As a result, the labels mentioned in the steps and the screenshots reflect that operating system. If your Microsoft Enterprise Certificate Authority is running a different operating system version of Windows Server, you might see minor differences in your system when compared with the labels and screenshots below.

Procedure

Create a new Universal Security Group in Active Directory.

Creating this group allows you to have a single Security Group to which you can assign the permissions required for issuing certificates on behalf of users. Then all the enrollment service accounts can inherit those required permissions by becoming a member of this group.
1. Open the Active Directory Users and Computers tool, from the Server Manager's Tools menu or by running the dsa.msc command.
2. In the Active Directory Users and Computers tool, create a new group for the domain enrollment accounts that True SSO requires.
  
  Give the group a name of your choice, such as True SSO Enrollment Accounts. Also set:
  
  Setting Value
  Group scope Universal
  Group type Security
3. Click OK to save the new group.
4. Then add the domain enrollment accounts as members of this new group.
  
  Add every domain enrollment service account that you will use for the purpose of using True SSO.
  
  These accounts would be the same ones that you added in the Domain Registration UI flow using the Horizon Universal Console, as described in Setting up your Active Directory Domain.
Configure the True SSO enrollment agent certificate template using the Certification Authority tool and its Certificate Templates Console.
1. Open the Certification Authority tool.
  
  Some ways of opening this tool are using the Server Manager's Tools menu, the Start menu's Windows Administrative Tools, or by running certsrv.msc.
2. In the Certification Authority tool's left hand tree, expand the local CA name until you see the Certificate Templates folder.
3. Open the Certificate Templates Console by right-clicking the Certificate Templates folder and selecting Manage.
  
  The following screenshot illustrates this step in a system running Window Server 2016.
  
  The Certificate Templates Console appears.
4. Right-click the listed Enrollment Agent template and select Duplicate Template.
  
  The following screenshot illustrates this step in a system running Window Server 2016.
  
  The Properties of New Template window displays.
5. Enter information on the tabs of the window as described in the following sections.
  
  Note: The screenshots below were taken using a Microsoft Enterprise Certificate Authority running the operating system Microsoft Windows Server 2016 Standard. If your Microsoft Enterprise Certificate Authority is running a different operating system version of Windows Server, you might see minor differences in the UI in your Windows system.
  - General tab
    
    Note: Use only ASCII characters in the names of your True SSO templates. Due to a known issue, if your True SSO template names contain non-ASCII or high-ASCII characters, you cannot successfully configure True SSO with your Horizon Cloud environment.
    - Template display name
      
      Type a name that indicates this new template is for True SSO enrollment agent, for example True SSO Enrollment Agent.
    - Template name
      
      As you type into preceding Template display name, the tool automatically enters that name here to match your entry for the Template display name without spaces.
      
      For example, if you typed True SSO Enrollment Agent into the Template display name, the tool automatically sets this Template name to TrueSsoEnrollmentAgent.
    The following screenshot illustrates this tab after entering the Template display name as True SSO Enrollment Agent.
  - Security tab
    
    On the Security tab, give the Read and Enroll permissions to the new Universal Security Group you created for the True SSO enrollment accounts.
    1. In the Group or user names section, add the group you created for the True SSO enrollment accounts.
    2. Select that group and in the Permissions section, select Allow for Read and Enroll permissions.
6. Save the new True SSO Enrollment Agent template by clicking OK in the Properties of New Template window.
The new True SSO Enrollment Agent template is listed within the Certificate Templates Console, displayed using the Template display name that you gave it and displayed purpose as certificate request agent.

The following screenshot illustrates the new listed template.
Within the same Certificate Templates Console, configure the True SSO Smartcard Logon template.
1. In the Certificate Templates Console, right-click the listed Smartcard Logon template and select Duplicate Template.
  
  The following screenshot illustrates this step in a system running Window Server 2016.
  
  The Properties of New Template window displays.
2. Enter information on the tabs of the window as described in the following sections.
  
  CAUTION:
  
  Ensure you follow these points, otherwise the system will prevent you from setting the required values, forcing you to cancel and redo your steps. This requirement is a Windows system behavior.
  - Keep away from Apply and OK in the Properties window until you have made the required settings in the three tabs as described in the following bullet, in the prescribed specific order.
    
    If you fail to follow this guidance of configuring the settings on the three tabs as described below before you apply or save in the window, Windows forces the Cryptography tab's Provider Category to read-only, and then the setting cannot be changed later to the Key Storage Provider setting that True SSO requires.
    
    Therefore, you must ensure that you complete the configuration on the following three tabs in precisely the correct order given below before you apply or save in the window.
  - Configure these tabs as the first ones you configure, and configure them this specific order:
    1. Compatibility tab
    2. General tab
    3. Cryptography tab The reason for this prescribed order is because as you change settings on the Compatibility tab, the system dynamically makes relevant options available in the other tabs. If you apply or save in the window before updating the Cryptography tab, you will be prevented from setting the configuration that True SSO requires Therefore, ensure that you configure the settings in the tabs in order as listed above and below before applying or saving in the window.
  - Compatibility tab
    
    Note: You must make these selections in the Compatibility tab so that the appropriate options become available within the Cryptography tab.
    - Select the Show resulting changes check box.
    - Certification Authority - The system presents the choices that Microsoft Windows makes available for this setting. To meet the True SSO requirements, select either the Windows Server 2008 R2 choice or one of the later releases presented in the menu.
    - Certificate recipient - The system presents the choices that Microsoft Windows makes available for this setting. To meet the True SSO requirements, select either the Windows 7 / Server 2008 R2 choice or one of the later releases presented in the menu.
  - General tab
    
    Note: Use only ASCII characters in the names of your True SSO templates. Due to a known issue, if your True SSO template names contain non-ASCII or high-ASCII characters, you cannot successfully configure True SSO with your Horizon Cloud environment.
    - Template display name
      
      Type a name that indicates this new template is for use by True SSO, for example True SSO.
    - Template name
      
      As you type into preceding Template display name, the tool automatically enters that name here to match your entry for the Template display name without spaces.
      
      For example, if you typed True SSO into the Template display name, the tool automatically sets this Template name to TrueSSO.
    - Validity period
      
      1 hour (one hour)
    - Renewal period
      
      0 weeks (zero weeks)
    The following screenshot illustrates this tab after entering the Template display name as True SSO.
  - Cryptography tab
    - Provider Category - Key Storage Provider
    - Algorithm name - RSA
    - Minimum key size - 2048
    - Select the Requests can use any provider available on the subject's computer radio button
    - Request hash - SHA384
  - Request Handling tab
    - Purpose - Signature and smartcard logon
    - Select the For automatic renewal of smart card certificates, use the existing key if a new key cannot be created check box
    - Select the Prompt the user during enrollment radio button.
  - Subject Name tab
    - Select the Build from this Active Directory information radio button.
    - Subject name format - Fully distinguished name
    - Select the User principal name (UPN) check box.
  - Server tab
    
    Select the Do not store certificates and requests in the CA database check box.
    
    Important: Ensure that you deselect the second check box labeled Do not include revocation information in issued certificates.
    
    When you select the first check box, the system automatically selects the Do not include revocation information in issued certificates.
    
    Ensure that you clear that second check box Do not include revocation information in issued certificates.
  - Issuance Requirements tab
    - Require the following for enrollment - Select This number of authorized signatures and enter 1.
    - Policy type required in signature - Application policy
    - Application policy - Certificate Request Agent
    - Require the following for reenrollment - Valid existing certificate
  - Security tab
    
    On the Security tab, give the Read and Enroll permissions to the new Universal Security Group you created for the True SSO enrollment accounts.
    1. In the Group or user names section, add the group you created for the True SSO enrollment accounts.
    2. Select that group and in the Permissions section, select Allow for Read and Enroll permissions.
3. Complete saving this new True SSO template by clicking OK in the Properties of New Template window.
The new True SSO template is listed within the Certificate Templates Console, displayed using the Template display name that you gave it and with displayed purpose of client authentication, smart card logon.

The following screenshot illustrates the new listed template.
Now you can close the Certificate Templates Console and return to the Certification Authority tool.
Issue the template for True SSO.
1. In the Certification Authority tool, right-click on the Certificate Templates folder and select New > Certificate Template to Issue.
  
  The following screenshot illustrates this step in a system running Window Server 2016.
  
  The Enable Certificate Templates window displays.
2. Select the True SSO template that you created in the preceding steps and click OK.
  
  The following screenshot illustrates this step in a system running Window Server 2016.
Note: You must perform these actions on every Microsoft Enterprise Certificate Authority instance that you intend to use for the True SSO feature.
Repeat the same issuing step for the True SSO Enrollment Agent template.
1. In the Certification Authority tool, right-click on the Certificate Templates folder and select New > Certificate Template to Issue.
  
  The Enable Certificate Templates window displays.
2. Select the True SSO Enrollment Agent template that you created in the preceding steps and click OK.
  
  The following screenshot illustrates this step in a system running Window Server 2016.
  
  Note: You must perform these actions on every Microsoft Enterprise Certificate Authority instance that you intend to use for True SSO.
The Microsoft Enterprise Certificate Authority is now set up and configured with the certificate templates required for use with the True SSO feature.