Configure True SSO for Use with Your Horizon Cloud Environment

After you have registered an Active Directory domain with your Horizon Cloud environment and have integrated the environment with Omnissa Access, you can configure True SSO for it. True SSO is a feature that integrates with Access to allow users to single sign-on to the virtual Windows desktops and applications served by Horizon Cloud without needing to also enter their Active Directory credentials into the Windows operating system. When True SSO is configured for your environment, the end users authenticate at the Access URL that you provide to them for accessing their entitled desktops and applications. After that authentication, the users are able to launch their entitled desktops or applications without a prompt for Active Directory credentials.

Important: The True SSO configuration is a tenant-wide type of configuration. The True SSO configuration will apply across all of your pod fleet's Horizon Cloud pods in Microsoft Azure. As a result, after you have successfully configured True SSO in your Horizon Cloud tenant for the first time, and then you later subsequently deploy additional Horizon Cloud pods into your Microsoft Azure subscriptions using the automated pod-deployment wizard, the system will send the same True SSO configuration to all of those pods and attempt to validate the same True SSO configuration against those pods.

Configuring True SSO for use with your environment is a multi-step process. At a high-level, the steps are:

Set up the infrastructure required for True SSO to operate, which involves: a. Installing and configuring a Microsoft Windows Server Certificate Authority (CA) to be an enterprise CA . The procedures in this section are for Microsoft Windows Server 2012 R2. Very similar steps can be followed on the other Microsoft Windows Server versions that are supported for use with this feature. b. Setting up a certificate template on the CA.

Important: Use only ASCII characters in the names of your True SSO templates. Due to a known issue, if your True SSO template names contain non-ASCII or high-ASCII characters, you cannot successfully configure True SSO with your Horizon Cloud environment.

c. Downloading the Horizon Cloud pairing bundle from the Horizon Universal Console's Active Directory page. The pairing bundle is used when setting up the Enrollment Server.

d. Setting up the Enrollment Server.

Important: After setting up the Enrollment Server, make sure you meet the port requirements for the Enrollment Server described in First-Gen Tenants - Horizon Cloud on Microsoft Azure Deployments - Host Name Resolution Requirements, DNS Names.
Adding the Enrollment Server information to the Horizon Universal Console's Active Directory page.

When the configuration is complete, the enterprise CA and Enrollment Server work together to issue short-lived certificates that are used to log the users in to their entitled desktops and applications. The Horizon Cloud pod asks the Enrollment Server for a certificate for a specific entitled user. The Enrollment Server contacts the CA to generate the requested certificate and then returns the certificate to the Horizon Cloud pod.

Prerequisites for End-to-End True SSO Setup

Before configuring True SSO, you must have at least one Access environment configured with your Horizon Cloud environment. See the documentation topic About Using a Horizon Cloud Environment with Omnissa Access and with the Optional True SSO Feature and follow the integration procedure that is appropriate for your Horizon Cloud environment's configuration.

Set Up an Enterprise Certificate Authority Using a Microsoft Windows Server System

A required element for using the True SSO feature is a Microsoft Certificate Authority (CA). If you do not already have a certificate authority (CA) set up, you must add the Active Directory Certificate Services (AD CS) role to a Microsoft Windows server and configure the server as an enterprise CA. You can use the Service Manager wizard to do this procedure.

The following are standard steps to set up a Microsoft CA. They are detailed in this topic in a simple form suitable for use in a lab environment, but for a real production system it is recommended that you follow industry best practice for CA configuration.

If you need further guidance about setting up a CA, please check out the standard Microsoft technical references: Active Directory Certificate Services Step-by-Step Guide and Install a Root Certification Authority.

Note: To illustrate the process, the specific steps in this topic are based on using Windows Server 2012 R2. Very similar steps can be followed on other Windows server systems. If you want to install the Enrollment Server on the same system that hosts this CA, please ensure you use one of the Windows server versions that are supported for the Enrollment Server. See Set up the Enrollment Server.

Procedure

On the Server Manager Dashboard, click Add Roles and Features to open the wizard, and then and click Next.
On the Select Installation Type page, select Role-based or feature-based installation and click Next.
On the Server Selection page, leave defaults and click Next.
On the Server Roles page:
1. Select Active Directory Certificate Services.
2. In the dialog, select Include management tool (if applicable) and click Add Features.
3. Click Next.
On the Features page, click Next.
On the AD CS page, click Next.
On the Role Services page, select Certification Authority and click Next.
On the Confirmation page, select Restart the destination server automatically is required and click Install.

Installation Progress displays. When the installation is complete, a URL link displays, allowing you to configure the newly installed CA as “Configure Active Directory Certificate Services” on the destination server.

Click on the configuration link to launch the configuration wizard.
On the Credentials page, enter user credentials from Enterprise Admin group and click Next.
On the Role Services page, select CA and click Next.
On the Setup Type page, select Enterprise CA and click Next.
On the CA Type page, select Root or Subordinate CA as appropriate (in this example it is a Root CA) and click Next.
On the Private Key page, select Create a new private key and click Next.
On the Cryptography page, enter information as follows.

Field Description
Cryptographic Provider RSA#Microsoft Software Key Storage Provider
Key Length 4096 (or another length if you prefer)
Hash Algorithm SHA256 (or another SHA algorithm if you prefer)
On the CA Name page, configure as preferred or accept defaults and click Next.
On the Validity Period page, configure as preferred and click Next.
On the Certificate Database page, click Next.
On the Confirmation page, review the information and click Configure.
Complete the configuration process by performing the following tasks (run all commands from the command prompt).
1. Configure CA for non-persistent certificate processing
```
certutil –setreg DBFlags 
+DBFLAGS_ENABLEVOLATILEREQUESTS
```
2. Configure CA to ignore offline CRL errors
```
certutil –setreg ca\CRLFlags 
+CRLF_REVCHECK_IGNORE_OFFLINE
```
3. Restart the CA service
```
net stop certsvc
net start certsvc
```
Set up a certificate template on the CA by following the steps in the following section Set Up a Certificate Template on the CA .

Field	Description
Cryptographic Provider	RSA#Microsoft Software Key Storage Provider
Key Length	4096 (or another length if you prefer)
Hash Algorithm	SHA256 (or another SHA algorithm if you prefer)

Horizon Cloud - True SSO - Set Up a Certificate Template on the CA

You must configure the certificate template on the CA. The certificate template is the basis for the certificates that the CA generates.

Prerequisites

Complete the steps described earlier in Set Up an Enterprise Certificate Authority Using a Microsoft Windows Server System.

Procedure

Create a new Universal Security Group.

Creating this group allows you to have a single Security Group to which you can assign the permissions required for issuing certificates on behalf of users. All the computers where the Enrollment Servers are installed can inherit those permissions by becoming a member of this group.
1. Click Start and type dsa.msc.
The Active Directory Users and Computers window displays.
1. In the tree, right-click the Users folder for the domain controller and select New > Group.
The New Object - Group window displays.
1. In the Group Name field, enter a name for the new group. For example, True SSO Enrollment Servers.
2. Set the following values.
  
  Setting Value
  Group scope Universal
  Group type Security
3. Click OK.
The new group appears in the tree in the Active Directory Users and Computers window.
1. Right-click the group and select Properties.
2. On the Member Of tab, add every computer on which you will be installing an Enrollment Server, and then click OK.
3. Restart every computer on which you will be installing an Enrollment Server.

Setting	Value
Group scope	Universal
Group type	Security

Configure the certificate template.

Select Control Panel > Administrative Tools > Certificate Authority.
In the tree, expand the local CA name.
Right-click on the Certificate Templates folder and select Manage.

The Certificate Templates Console displays.

Right-click on the Smartcard Logon template and select Duplicate Template.

The Properties of New Template window displays.

Enter information on the tabs of the window as described below.

Tab	Settings
Compatibility	Select the Show resulting changes check box. Certification Authority - Select the Windows operating system Certificate recipient - Select the Windows operating system
General	Important: Use only ASCII characters in the names of your True SSO templates. Due to a known issue, if your True SSO template names contain non-ASCII or high-ASCII characters, you cannot successfully configure True SSO with your Horizon Cloud environment. Template display name - Name of your choice. For example, True SSO Template. Template name - Name of your choice. For example, True SSO Template. Validity period - 1 hours Renewal period - 0 weeks
Request Handling	Purpose - Signature and smartcard logon Select the For automatic renewal of smart card certificates . . . check box Select the Prompt the user during enrollment radio button
Cryptography	Provider Category - Key Storage Provider Algorithm name - RSA Minimum key size - 2048 Select the Requests can use any provider available . . . . radio button Request hash - SHA256
Subject Name	Select the Build from this Active Directory Information radio button. Subject name format - Fully distinguished name Select the User principal name (UPN) check box.
Server	Select the Do not store certificates and requests in the CA database check box
Issuance Requirements	Require the following for enrollment - Select This number of authorized signatures and enter `1`. Policy type required in signature - Application policy Application policy - Certificate Request Agent Require the following for enrollment - Valid existing certificate
Security	In the upper part of the tab, select the new group you created. Then in the lower part of the tab, select Allow for Read and Enroll permissions.

Click OK.

Issue the template for True SSO.
1. Right-click again on the Certificate Templates folder and select New > Certificate Template to Issue.
The Enable Certificate Templates window displays.
1. Select TrueSsoTemplate and click OK.
Issue the Enrollment Agent template.
1. Right-click again on the Certificate Templates folder and select New > Certificate Template to Issue.
The Enable Certificate Templates window displays.
1. Select the Enrollment Agent computer and click OK.
Note: This template must have the same security settings as the template issued in the previous step.

The CA is now set up and configured with a certificate template suitable for use with True SSO.
Download the Horizon Cloud pairing bundle by following the steps in the following section Download the Horizon Cloud Pairing Bundle.

Horizon Cloud - True SSO - Download the Horizon Cloud Pairing Bundle

You need this pairing bundle to complete the Enrollment Server setup steps when you are configuring your Horizon Cloud environment for True SSO. You download the pairing bundle from the Horizon Universal Console's Active Directory page.

The pairing bundle contains a certificate file for each one of the Horizon Cloud pods deployed in Microsoft Azure for your Horizon Cloud environment. For the pods for which you want to configure True SSO, you upload those pods' certificate files to the Enrollment Server. When you have one pod, the bundle contains one certificate file in CRT format. When you have more than one pod, the bundle contains multiple CRT files, one per pod. The name of each CRT file follows the pattern:

podID_truesso.crt

where podID is the pod's ID that is displayed in the pod's summary page.

Procedure

In the console, navigate to Settings > Active Directory.
In the True SSO Configuration area, obtain the pairing_bundle.7z file by clicking Download Pairing Token.
Save the file to a location where you can extract its contents.
For the pods for which you want to configure True SSO, extract the pods' CRT files from the pairing bundle to a location where you can retrieve them when you are setting up the Enrollment Server.

The pairing bundle contains a certificate file for each pod in your environment. Each CRT file name follow the pattern podID_truesso.crt, where podID is the pod's ID value.

Set up the Enrollment Server by following the steps in the following section Set up the Enrollment Server.

Set up the Enrollment Server

This documentation page describes how to set up the Enrollment Server for use with first-generation Horizon Cloud on Microsoft Azure deployments.

The Enrollment Server (ES) is a Horizon Cloud on Microsoft Azure component that you install on a Windows Server machine as the last step in setting up infrastructure for True SSO. By deploying the Enrollment Agent (Computer) certificate onto the server, you are authorizing this ES to act as an Enrollment Agent and generate certificates on behalf of users.

Attention: If your first-gen tenant has multiple Horizon Cloud on Microsoft Azure deployments in its fleet, when you are setting up Enrollment Servers, you must ensure that the Enrollment Servers are reachable by all of those deployments' pod manager instances. Otherwise, the final pairing step will fail (the completion step will fail).

As described in the Important note at the top of this page Configure True SSO for Use with Your Horizon Cloud Environment, the True SSO configuration is a tenant-wide type of configuration. The system sends the same True SSO configuration to all of the pods in the tenant's fleet and attempts to validate the same True SSO configuration on all of them. If you stand up an Enrollment Server to work with Pod-A and also stand up a separate Enrollment Server to work with Pod-B, both of those Enrollment Servers must be reachable by both Pod-A and Pod-B.

Prerequisites

Verify that you have completed the steps in Set Up an Enterprise Certificate Authority Using a Microsoft Windows Server System, Set Up a Certificate Template on the CA, and Download the Horizon Cloud Pairing Bundle.

Note: The Enterprise CA must be set up for you to see the appropriate items in the Certificate Enrollment wizard in the steps documented in this page.

Verify that the system on which you will install the Enrollment Server software is running one of these operating systems that are supported for this installation: Windows Server 2012 R2, Windows Server 2016, Windows Server 2019. The system should have a minimum of 4GB of memory.

Note: Use of Windows Server 2022 hasn't been qualified for support for Enrollment Server use with first-generation Horizon Cloud on Microsoft Azure deployments.

The labels in the following steps reflect running the steps on a Windows Server 2016 system.

Procedure

Install the Enrollment Server on the system.
1. Download the Enrollment Server.exe file from the Horizon Cloud on Microsoft Azure page in Customer Connect. The file name will look similar to HorizonCloud-TruessoEnrollmentServer-x86_64-7.3.0-xxxxx.exe.
2. Confirm that the system meets the prerequisites as previously stated.
3. Run the installer and follow the wizard.
On the Enrollment Server, add the Certificate snap-in to MMC (Microsoft Management Console).
1. Open the MMC and select File > Add/Remove Snap-in.
2. Under Available snap-ins, select Certificates and click Add.
3. In the Certificates snap-in window, select Computer account and click Next.
4. In the Select Computer window, keep the default of Local computer and click Finish.
5. Back in the Add or Remove Snap-ins window, click OK to complete the addition of the Certificate snap-in.
Deploy the Enrollment Agent certificate on this Enrollment Server.
1. In the MMC, expand Certificates (Local Computer) that you added in the previous step, right-click the Personal folder, and select All Tasks > Request New Certificate.
  
  The Certificate Enrollment wizard starts.
2. Proceed through the Certificate Enrollment wizard accepting the defaults until you reach the Request Certificates step.
3. In the wizard's Request Certificates step, select the Enrollment Agent (Computer) check box and click Enroll.
4. Proceed through the wizard accepting the defaults on the remaining steps and at the final step, click Finish.
Import the pods' certificate CRT files extracted from the pairing_bundle.7z file, for those pods with which you want to configure True SSO.

The pairing bundle contains a certificate file for each pod in your environment. Each CRT file name follow the pattern podID_truesso.crt, where podID is the pod's ID value.
1. In the MMC, right-click the Certificates sub-folder under the Horizon View Enrollment Server Trusted Roots folder and select All Tasks > Import.
2. In the Certificate Import wizard, follow the prompts to browse to the location where you extracted the certificate files from the pairing_bundle.7z bundle.
When you have only one pod, the bundle contains only one CRT file. When you have more than one pod, the bundle contains a CRT file for each pod.
1. Import the certificate file or files, depending on how many pods you are configuring.
2. Click Next, then click Finish.
Complete the remaining configuration steps described in the following section Complete Configuring True SSO for your Horizon Cloud Environment.

Horizon Cloud - True SSO - Complete Configuring True SSO for your Horizon CloudEnvironment

After the Enrollment Server is set up, you enter the information in the Horizon Universal Console's Active Directory page.

Prerequisites

Complete the previous step Set up the Enrollment Server.

Verify that you have met the port and protocol requirements for the pod's manager VMs and Enrollment Server network traffic, as described in First-Gen Tenants - Horizon Cloud on Microsoft Azure Deployments - Host Name Resolution Requirements, DNS Names. If the appopriate ports are not allowing traffic, pairing of the Enrollment Server will fail.

Procedure

In the console, navigate to Settings > Active Directory.
Click Add next to True SSO Configuration.

The True SSO Config dialog displays.

Note: Because you already configured the Enrollment Server you can ignore the Download Pairing Token link in this dialog.

Enter the fully-qualified domain name (FQDN) of your enrollment server in the Primary Enrollment Server field and click the Test Pairing button next to the field.

The other required fields are auto-populated.

Click Save
To configure a Secondary Enrollment Server for high-availability, do the following.
1. Repeat the process described in Set up the Enrollment Server on a second machine.
2. Edit the True SSO configuration and add the second ES address in the Secondary Enrollment Server field, and then test the pairing.
3. Save the configuration again.

Results

The configuration information now appears on the Active Directory page under True SSO Configuration.

Was this page helpful?

Configure True SSO for Use with Your Horizon Cloud Environment

Prerequisites for End-to-End True SSO Setup

Set Up an Enterprise Certificate Authority Using a Microsoft Windows Server System

Procedure

Horizon Cloud - True SSO - Set Up a Certificate Template on the CA

Prerequisites

Procedure

Horizon Cloud - True SSO - Download the Horizon Cloud Pairing Bundle

Procedure

Set up the Enrollment Server

Prerequisites

Procedure

Horizon Cloud - True SSO - Complete Configuring True SSO for your Horizon CloudEnvironment

Prerequisites

Procedure

Results

Provide feedback for this topic

Write your review