Enabling SAML 2.0 Authentication for Horizon with Unified Access Gateway and Okta: VMware Horizon Operational Tutorial

Access the Okta administration console and switch to Classic UI.

1. Click Directory.
2. Click Directory Integrations.

Click Add Active Directory.

Review the installation requirements and click Set Up Active Directory.

1. Click Download Agent.
2. Click Allow.

Click the downloaded file to launch the OktaADAgent installer.

1. Click Next.
2. Confirm the installation folder.
3. Click Install.

1. Enter the Domain.
2. Click Next.

1. Select Create or use the OktaService account (recommended).
2. Click Next.

1. Enter the password.
2. Retype the password.

If your environment requires an outbound connection via proxy, select the Use proxy server option and provide the details.

For this exercise, Proxy is not required.

Click Next.

Select the type of Okta environment that to be integrated with the Okta AD Agent.

1. Select Production.
2. Enter the Subdomain. If you are using an Okta development environment, enter https://dev-XXXXXX.okta.com, where XXXXXX is your respective environment.
3. Click Next.

1. Click Allow Access.
2. Click Finish.

1. Enter the Username.
2. Enter the Password.
3. Click Sign In.

You should see a dialog box confirming the Agent Installation.

Click Next to continue.

1. Select the Organization Unites (OUs) that you want to sync Users from.
2. Select the Organization Unites (OUs) that you want to sync Groups from.
3. Select User Principal Name (UPN) for the Okta username format.
4. Click Next.

A successful AD configuration allows the import of AD users and groups.

Click Next.

1. Select the attributes that you want to use for the Okta User profile.
2. Click Next.

At this point, your AD domain is integrated with Okta. The next step is to sync your AD users to Okta.

Click Done.

Select Import.

Click Import Now.

Define the import method you would like to use.

1. Select Incremental Import.
2. Click Import.

The initial import time will depend on the number of users and groups to be synchronized.

After the import completes, you can confirm how many users and groups were synchronized.

Click OK.

1. Click Applications.
2. Click Add Application.

Click Create New App.

1. Select Web as Platform.
2. Select SAML 2.0 for the Sign on method.
3. Click Create.

1. Enter Horizon as the App name.
2. Define an App logo if you want—this is optional.
3. Click Next.

Replace  <UAG-FQDN> from the following parameters with the respective FQDN from your environment. This example uses uaghzn.

1. Enter https://<UAG-FQDN>/portal/samlsso for Single sign on URL.
2. Ensure Use this for Recipient URL and Destination URL is selected.
3. Enter https://<UAG-FQDN>/portal for Audience URI (SP Entity ID).
4. Scroll down and click Next.

Keep the default values in the remaining text boxes.

Your selection on the feedback screen will not affect the configuration of your SAML application.

1. Select an option for Are you a customer or partner? question. Depending on the answer, you may need to answer additional questions.
2. Click Finish.

After you configure the General settings, you are redirected to the Sign On page, which allows you to download the Identity Provider metadata. This metadata will be uploaded to Unified Access Gateway and Horizon Connection Server in a later exercise.

1. Right-click Identity Provider metadata.
2. Click Download Linked File As...
3. Update the file name adding .xml as the file extension. The original file name does not include the file extension.
4. Click Save.

1. Click Assignments.
2. Click Assign.
3. Click Assign to Groups.

1. Enter Domain Users in the search bar.
2. Click Assign for Domain Users on the filtered list. The button label will be updated to Assigned.
3. Click Done.

Users that are part of the Domain Users group can now launch the Horizon SAML application. However, additional configuration is required and this is covered in the next exercises.

Click Back to Applications.

This concludes the configuration of the SAML 2.0 application, where the Horizon SAML 2.0 application is now listed as active on the Okta application list. The configuration for this app can be updated at any time by clicking the gear next to the application name.

Under Advanced Settings on Unified Access Gateway:

1. Click the gear next to Upload Identity Provider Metadata.

Keep Entity ID empty, as this value will be defined based on the metadata XML file.

1. Click Select for IDP Metadata.
2. Select the Okta XML metadata file previously downloaded from Okta.
3. Click Open.
4. Click Save.

1. Click the Show toggle next to Edge Service Settings. After you click, it switches to display the Hide option.
2. Click the gear icon next to Horizon Settings.

All items should be GREEN, representing that the appliance can communicate with the Horizon Connection Server through the multiple protocols configured. Items not fully functional are presented in RED.

Click More at the bottom of the Horizon settings.

1. Select SAML and Passthrough.
2. Select http://www.okta.com for Identity Provider.  http://www.okta.com is the name of the Entity ID specified in the Okta metadata.
3. Scroll down.
4. Click Save.

When Auth Methods is set to SAML, SAML assertion is validated by Unified Access Gateway and passed to the backend. User single sign-on leveraging True SSO to the remote desktops and applications.

When Auth Methods is set to SAML + passthrough, SAML assertion is validated by Unified Access Gateway and Connection Server authenticates the user against Active Directory when launching remote desktops and applications.

In both authentication methods user will be redirect to Okta for SAML authentication, service provider (SP) and IdP initiated flows are supported.

1. Launch Horizon Client.
2. Click Add Server.
3. Enter the Unified Access Gateway or load balancer IP or FQDN.
4. Click Connect.

User is redirected to Okta for authentication (XML-API Protocol), and after successful authentication, the user is redirected back to the Horizon client with a valid token.

This step is related to the SAML part of the SAML and passthrough authentication configured on Horizon edge service.

1. Enter the Username.
2. Enter the Password.
3. Click Sign In.

A successful connection will present the desktops and applications entitled to logged-in users. In this exercise, you can see one virtual desktop (Win10 1803) and four other virtual applications (Calculator, Notepad, Paint, WordPad).

1. Right-click the desktop or one of the applications.
2. Ensure that VMware Blast (default) is selected.
3. Click Launch.

As result of the SAML and passthrough configuration on Horizon edge service, the passthrough configuration results in prompt the user to enter his AD credentials to log in into the desktop or application.

1. Enter your AD user name.
2. Enter your AD password.
3. Click Login.

As previously mentioned, you are prompted to enter your AD credentials to log in to the desktop if on Unified Access Gateway, you configure the Horizon edge service authentication method as SAML and passthrough. However, if you configure as SAML and your environment has True SSO enabled, the desktop login uses single sign-on (SSO).

Confirm that you have successfully launched the virtual resource.

1. Click Options.
2. Click Disconnect and Log Off.

To access the Horizon administration console, navigate to https://server/admin on your Web browser, where server is the host name of the Connection Server instance.

1. Enter the user name.
2. Enter the password.
3. Enter the Domain.
4. Click Sign in.

1. Click Settings.
2. Click Servers.
3. Select Connection Servers.
4. Select the Connection Server to be used as the front-end server for Unified Access Gateway deployed in this exercise.
5. Click Edit.

1. Select the Authentication tab.
2. Select Allowed for Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator).
3. Click Manage SAML Authenticators.

Click Add.

1. Select Static for Type.
2. Enter Okta for Label.
3. Paste the content of the Okta metadata XML file you previously downloaded from Okta into the SAML Metadata text box.
4. Make sure Enabled for Connection Server is selected.
5. Click OK.

1. Confirm that Okta is now configured as a SAML authenticator for Horizon.
2. Click OK.

Note: You can configure more than one SAML authenticator to a Connection Server and all the authenticators can be active simultaneously. However, the entity-ID of each SAML authenticator configured on the Connection Server must be different.

If your environment leverages Horizon TrueSSO, you must enable the OKTA SAML Authenticator on True SSO.

Use the following command line to list all the authenticators and their True SSO mode status.

vdmutil --authAs <Horizon admin user> --authDomain <fqdn> --authPassword <Horizon admin password> --truesso --list --authenticator

Replace
<Horizon admin user> with the Horizon administrator user
<fqdn> with the fully qualified domain name for the Horizon admin user
<Horizon admin password> with the password for the Horizon administrator

If True SSO mode is DISABLED for the authenticator you are trying to configure, execute the following command line to enable.

vdmutil --authAs <Horizon admin user> --authDomain <fqdn> --authPassword <Horizon admin password> --truesso --authenticator --edit --name <SAML authenticator name> --truessoMode ENABLED

After you enable True SSO, the True SSO mode for the authenticator you are enabling displays as  ENABLE_IF_NO_PASSWORD.

Log in to the Unified Access Gateway administration console.

1. Click the Show toggle next to Edge Service Settings. After you click, it switches to display the Hide option.
2. Click the gear icon next to Horizon Settings.

Click More at the bottom of the Horizon settings.

1. Select SAML for Auth Methods.
2. Select http://www.okta.com for Identity Provider.  http://www.okta.com is the name of the Entity ID specified in the Okta metadata.
3. Scroll down.
4. Click Save.

1. Launch Horizon Client.
2. Double Click on your Unified Access Gateway connection, which was registered in one of the previous exercise.

User is redirected to Okta for authentication (XML-API Protocol), and after successful authentication, the user is redirected back to the Horizon client with a valid token.

This step is related to the SAML authentication configured on Horizon edge service.

1. Enter the Username.
2. Enter the Password.
3. Click Sign In.

A successful connection will present the desktops and applications entitled to logged-in users. In this exercise, you can see one virtual desktop (Win10 1803) and four other virtual applications (Calculator, Notepad, Paint, WordPad).

1. Double Click in one of your Desktop or Applications icons to launch the resource.

As result of the SAML Authenticator and True SSO configuration in Horizon, single sign-on kicked in and logged the user automatically.

Confirm that you have successfully launched the virtual resource.

1. Click Options.
2. Click Disconnect and Log Off.

1. Click Applications.
2. Click Add Application.

1. Enter Bookmark in the search bar.
2. Click Add for the Bookmark App.

1. Enter Windows Desktop for Application Label.
2. For URL add the URL to launch a desktop. For example, to launch a desktop from the Win10 1803 pool using the Native Client and BLAST protocol, use https://<UAG-hostname>/portal/nativeclient/Win10%201803?action=start-session&desktopProtocol=BLAST
3. Click Done.

To learn more about the syntax and parameters that can be used as part of the URL, see Syntax for Creating vmware-view URIs.

1. Make sure the Assignments tab is selected.
2. Click Assign.
3. Click Assign to Groups.

1. Enter Domain Users in the search bar.
2. Click Assign for Domain Users on the filtering list. The button label will be updated to Assigned.
3. Click Done.

You can repeat the same steps from this exercise to configure a new bookmark, this time to launch a virtual application using the Horizon HTML5 client (Web Client).

For example, the URL syntax to launch Notepad from the Application Pool using an Okta bookmark would be:

https://<UAG-hostname>/portal/webclient/index.html?applicationName=Notepad

To launch a virtual desktop named Win10Desktop from the Desktop Pool using an Okta bookmark, the URL syntax is as follows:

https://<UAG-hostname>/portal/webclient/index.html?desktopName=Win10Desktop

1. Enter a domain username.
2. Enter the password.
3. Click Sign In.

A successful login will present all the applications assigned to your account.

If you follow all the steps from this tutorial, you should see:

• Horizon — This is the SAML 2.0 application used to generate the IdP metadata. Launching this app redirects you to the Horizon HTML client. You can hide this app on the Okta administration console as previously explained.
• Notepad — Refers to the Notepad application pool, which will launch a new Notepad session.
• Windows Desktop — Refers to the Win10-1803 desktop pool, which will launch a new Desktop session.

Select an application to launch.

Confirm that you have successfully launched the virtual resource.

1. Click Options.
2. Click Disconnect and Log Off.