Using an Omnissa CA for SSO

To provide your Horizon Cloud users with single sign-on (SSO) access to their desktops and applications using an Omnissa Certificate Authority (CA), use the Omnissa CA to issue short-lived smartcard certificates for SSO. For transparency and security, the process includes a PowerShell script that uses established Microsoft utilities.

The following list provides information about configuring the Omnissa CA. When you configure SSO, you will encounter many of these same details in context. For example, Add an SSO Configuration to Horizon Cloud for an Omnissa CA provides instructions for downloading the Omnissa CA bundle. That bundle contains the PowerShell script that you run to configure SSO, as instructed in Publish the SSO CA Bundle to the Active Directory Forest.

• To enable the functionality required by SSO with an Omnissa CA, either of the following situations must apply to your Active Directory forest:
  • The Active Directory forest has at least one online Microsoft Enterprise CA configured in it, in which case the following results occur.
    • The Microsoft Enterprise CA automatically publishes its CA certificates and certificate revocation lists (CRLs) to the forest.
    • The domain controllers automatically enroll for certificates.
  • The Active Directory forest uses a third-party CA or stand-alone Microsoft CA, in which case the following must apply.
    • All CA certificates must be manually published to the forest using a utility such as certutil.
    • Revocation information must always be available over HTTP.
    • Domain Controllers must be issued with certificates that allow client authentication, server authentication, smart card logon, and KDC authentication.
• You can configure the Omnissa CA as a root CA or an intermediate CA. However, the Public Key Infrastructure (PKI) best practice is to select an intermediate CA.
• If you use a root CA, the Omnissa CA certificate is valid for 5 years.
• If you use an intermediate CA, the issuing CA determines the validity period of the Omnissa CA certificate.
• If you use an intermediate CA, the Omnissa CA certificate can be signed by a Microsoft CA or any third-party CA.
• If you use a third-party CA, ensure that domain member machines have access to all certificates and revocation information required to validate the Omnissa CA certificate.
• For the Omnissa CA to be trusted, you must publish the Omnissa CA bundle to various locations in the Active Directory forest.
• Publish the Omnissa CA bundle by running the PowerShell script as an administrator with suitable permissions on a domain member machine.
• You are only required to run the PowerShell script once. Active Directory replicates the published PKI data to all domain controllers and desktops in all domains in the Active Directory forest. You can use a utility such as Repadmin in complex Active Directory deployments to ensure timely replication of the configuration naming context between domain controllers in different domains or sites before attempting SSO.
• The PowerShell script uses Microsoft utilities certreq and certutil for complete transparency. Before you run the PowerShell script, you can read the script to see precisely what it does.