Configure True SSO on RHEL Desktops

To support True SSO on RHEL 8.x desktops, you must first integrate the base virtual machine (VM) with your Active Directory (AD) domain. Then you must modify certain configurations on the system to support the True SSO feature.

Note: True SSO is not supported on instant-clone RHEL 8.x desktops.

Some examples in the procedure use placeholder values to represent entities in your network configuration, such as the DNS name of your AD domain. Replace the placeholder values with information specific to your configuration, as described in the following table.

Prerequisites

• Configure True SSO for Omnissa Access and Horizon Connection Server.

• Verify that the Active Directory (AD) server is resolvable by DNS on the RHEL 8.x base VM.

• Configure the host name of the VM.

• Configure the Network Time Protocol (NTP) on the VM.

• Get a root Certificate Authority (CA) certificate and save it to /tmp/certificate.cer on the VM. See How to Export Root Certification Authority Certificate.

  If a subordinate CA is also an issuing authority, then get the entire chain of root and subordinate CA certificates and save it to /tmp/certificate.cer on the VM.

Procedure

1. On the RHEL 8.x VM, verify the network connection to Active Directory.

   realm discover *mydomain.com*
   

2. Install the required dependency packages.

   yum install oddjob oddjob-mkhomedir sssd adcli samba-common-tools
   

3. Join the AD domain.

   realm join --verbose *mydomain.com* -U administrator
   

4. Install the root CA certificate or certificate chain.

   1. Locate the root CA certificate or certificate chain that you downloaded, and transfer it to a PEM file.

      openssl x509 -inform der -in /tmp/certificate.cer -out /tmp/certificate.pem
      
      

   2. Copy the certificate to the /etc/sssd/pki/sssd_auth_ca_db.pem file.

      sudo cp /tmp/certificate.pem /etc/sssd/pki/sssd_auth_ca_db.pem
      

5. Modify the /etc/sssd/sssd.conf configuration file, as shown in the following example.

6. Modify the /etc/krb5.conf configuration file by setting the mode equal to 644.

   Note: If you do not modify /etc/krb5.conf as specified, the True SSO feature might not work.

7. Install the Horizon Agent package, with True SSO enabled.

   sudo ./install_viewagent.sh -T yes
   

8. Modify the viewagent-custom.conf configuration file so that it includes the following line.

   NetbiosDomain = *MYDOMAIN*
   

9. Restart the VM and log back in.