Prepare Active Directory for an SSO Configuration with an Omnissa CA and Applicable to Multiple Forests

When you configure SSO for your Horizon Cloud, you must perform the appropriate tasks that follow, depending on the details of your Omnissa certification authority (CA) configuration.

Summary of Procedures That Follow

When you create an SSO bundle, you use the PowerShell script to publish the bundle to the forest for which the bundle was created. This action ensures that SSO is functional for the bundle’s forest.

For SSO to work with additional trusting forests, root and intermediate certificates from the certification path of the Omnissa CA must be published to the trusting forest as follows.

• The root CA certificates must be published to the trusting forest.
• The intermediate CA certificates must be published to the trusting forest.
• The root CA certificates must be published to the NTAuth store.
• Revocation information must always be available over HTTP for the entire certificate chain.

Add the Root Certificate to Trusted Root Certification Authorities

The root certificate terminating the Omnissa CA certification path must be added to the Trusted Root Certification Authorities group policy in Active Directory.

Procedure

1. On all Active Directory forests that are part of the trust configuration, add the root certificate to the trusted root certification authorities.

   1. Select Start > Administrative Tools > Group Policy Management.

   2. Expand your domain, right-click Default Domain Policy, and click Edit.

2. Expand the Computer Configuration section and open Windows Settings\Security Settings\Public Key.

3. Right-click Trusted Root Certification Authorities and select Import.

4. Follow the prompts in the wizard to import the root certificate (for example, rootCA.cer) and click OK.

5. Close the Group Policy window.

Results

All of the systems in the domain now have a copy of the root certificate in their trusted root store.

What to do next

If an intermediate certification authority (CA) issues your smart card login or domain controller certificates, add the intermediate certificate to the Intermediate Certification Authorities group policy in Active Directory.

Add an Intermediate Certificate to Intermediate Certification Authorities

All interim certificates from the Omnissa CA certification path must be added to the Intermediate Certification Authorities group policy in Active Directory.

Procedure

1. On all Active Directory forests that are part of the trust configuration, add all intermediate certificates that are part of the Omnissa CA certificate chain to the intermediate certification authorities. On the Active Directory server, navigate to the Group Policy Management plug-in and complete the following steps:

   1. Select Start > Administrative Tools > Group Policy Management.

   2. Expand your domain, right-click Default Domain Policy, and click Edit.

2. Expand the Computer Configuration section and open the policy for Windows Settings\Security Settings\Public Key.

3. Right-click Intermediate Certification Authorities and select Import.

4. Follow the prompts in the wizard to import the intermediate certificate (for example, intermediateCA.cer) and click OK.

5. Close the Group Policy window.

Results

All of the systems in the domain now have a copy of the intermediate certificate in their intermediate certification authority store.

Add the Root Certificate to the Enterprise NTAuth Store

The root certificate terminating the Omnissa CA certification path must be added to the Enterprise NTAuth store in Active Directory.

Procedure

1. On your Active Directory server, use the certutil command to publish the certificate to the Enterprise NTAuth store.

   For example: certutil -dspublish -f path_to_root_CA_cert NTAuthCA

Results

The CA is now trusted to issue certificates of this type.