To provide end users with single sign-on (SSO) access to their desktops and applications when using Horizon Cloud, administer SSO on the corresponding Horizon Edge Gateway instance.
This procedure enables end users to access their desktops and applications after they enter their credentials once.
For background information on configuring the Omnissa CA, see Using an Omnissa CA for SSO with Horizon Cloud.
See Microsoft documentation as needed to complete this procedure. For example, to install an Enterprise CA, see Install the Certification Authority.
Prerequisites
-
Use the Horizon Universal Console to create and download a certificate authority (CA) bundle. See Add an SSO Configuration to Horizon Cloud for an Omnissa CA.
-
To run the PowerShell script extracted from the Omnissa CA bundle, as described in this procedure, confirm that you have the appropriate permissions.
This procedure requires that you run the Omnissa PowerShell script. You have a few options available to you to run the PowerShell script, including running the script as a member of the Enterprise Admins group. The guidance that follows suggests that you use less powerful permissions, but running the script as a member of the Enterprise Admins group is available to you. The suggestion here is to confirm that you have the following permissions.
- Full Control permissions on the "Public Key Services" container in Active Directory.
- Enroll permissions on the "SubCA" certificate template in Active Directory.
Procedure
-
Connect to a domain member machine, upload the Omnissa CA bundle file to the server, and unzip the file contents.
As long as you have the proper permissions, you can run the Omnissa PowerShell script from any domain member machine.
-
Open PowerShell, run the commands, and respond to the prompts as described in the substeps that follow.
Important: If your deployment consists of multiple domain controllers or you install the bundle from a remote machine, the propagation of the CA certificate to all domain controllers can take several hours. You can reduce the run time by running
'gpupdate.exe /Target:Computer /Force'on all domain controller instances.-
Run the following command.
Unblock-File -Path Path to ps1 file -
Run the
ps1PowerShell script extracted from the CA bundle and respond to the prompts.For example,
PS C:\ca\AuthEngine-CA_1> .\AuthEngine-CA_1.ps1If you added your SSO configuration as an intermediate CA, you are prompted to select a MSFT enterprise CA to sign the Omnissa CA CSR. You can choose a root or intermediate MSFT enterprise CA to process the Omnissa CA CSR. If applicable, select the appropriate enterprise CA. You must enable the Subordinate Certification Authority template for the selected enterprise CA.
Respond to the following required confirmation prompt with
Yas illustrated.Confirmation required Do you want to publish to AD?N] No [Y] Yes [?] Help (default is "N"):``Y
-
Results
The expected result is that the script runs without error. However, if you encounter the following type of error, perform the troubleshooting suggestion provided.
2022-03-22T15:35:39 [INFO ] [AuthEngine-CA-62351bb62ff3dd5966ad3575-1.ps1,67] certutil.exe -dspublish -f C:\SSO-C\
AuthEngine-CA-62351bb62ff3dd5966ad3575-1.crl
error : 2022-03-22T15:35:39 [ERROR][-2147016563][] Failed to publish base CRL
At C:\SSO-C\AuthEngine-CA-62351bb62ff3dd5966ad3575-1.ps1:303 char:5
+ error $retCode "Failed to publish base CRL"
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+ CategoryInfo : NotSpecified: (:) [Write-Error], WriteErrorException
+ FullyQualifiedErrorId : Microsoft.PowerShell.Commands.WriteErrorException,error
Run the following Get-ADRootDSE command and check the output to see if the CA configuration domain name used to create the SSO configuration matches what the following property returns: configurationNamingContext.
C:\>
Get-ADRootDSE -Server dnsDomainName
For example, C:\> Get-ADRootDSE -Server horizonv2.local
Output:
configurationNamingContext : "CN=Configuration,DC=horizonv2,DC=local"
...other
output fields...
If the CA configuration domain name does not match the output, you can use the Horizon Universal Console to edit the SSO configuration, specifically to correct the CA configuration domain name. See Add an SSO Configuration to Horizon Cloud for an Omnissa CA for information about accessing the SSO configuration. To edit an SSO configuration, click the three vertical dots next to the SSO configuration and select Edit. After you correct the domain name, you can download and publish the updated CA bundle.
What to do next
After you deploy the Horizon Edge Gateway, verify that the SSO configuration status is properly set. In the Horizon Universal Console, click Capacity, select the name of the Horizon Edge Gateway instance you configured, and edit the configuration to activate the Use SSO option. Select the SSO Configuration to associate it with the Horizon Edge Gateway. Save and verify that the status is set to READY_TO_SERVE, which indicates that SSO is functional for end users.
Removing a published bundle from Active Directory
To support bundle cleanup, an AD administrator can uninstall previously installed CA bundles from the Active Directory by using the following command line options for the dspublish script. These options require the AD administrator to enter the CA certificate thumbprint to confirm bundle uninstallation. However, the command line options do not check if the bundle is in use before uninstalling it. Before running either uninstall command, be sure that the bundle is not in use as the command line options do not make that verification.
-uninstallAll
-uninstall
An example command line for both options is shown below:
-.\AuthEngine-CA-653a8ec615d61616b629de15-1.ps1 -Uninstall
-.\AuthEngine-CA-653a8ec615d61616b629de15-1.ps1 -UninstallAll
Note that the PS script name, for example 653a8ec615d61616b629de15-1, is different for each customer.
Questa pagina è stata utile?