You run the Connection Server installer and select the Horizon Enrollment Server option to install an enrollment server. The enrollment server requests short-lived certificates on behalf of the users you specify. These short-term certificates are the mechanism True SSO uses for authentication to avoid prompting users for Active Directory credentials.
You must install and set up at least one enrollment server, and the enrollment server cannot be installed on the same host as Connection Server. VMware recommends that you have two enrollment servers for purposes of failover and load balancing. If you have two enrollment servers, by default one is preferred and the other is used for failover. You can change this default, however, so that the connection server alternates sending certificate requests to both enrollment servers.
If you install the enrollment server on the same machine that hosts the enterprise CA, you can configure the enrollment server to prefer using the local CA. For best performance, VMware recommends combining the configuration to prefer using the local CA with the configuration to load balance the enrollment servers. As a result, when certificate requests arrive, the connection server will use alternate enrollment servers, and each enrollment server will service the requests using the local CA. For information about the configuration settings to use, see Enrollment Server Configuration Settings and Connection Server Configuration Settings.
Prerequisites
- Create a Windows Server virtual machine with at least 4GB of memory, or use the virtual machine that hosts the enterprise CA. Do not use a machine that is a domain controller. For supported Windows Server operating systems, see the Horizon Installation document.
- Verify that no other Horizon component, including Connection Server, Horizon Client, or Horizon Agent is installed on the virtual machine.
- Verify that the virtual machine is part of the Active Directory domain for the Horizon deployment.
- Verify that you are using an IPv4 environment. This feature is currently not supported in an IPv6 environment
- VMware recommends that the system must have a static IP address.
- Verify that you can log in to the operating system as a domain user with Administrator privileges. You must log in as an administrator to run the installer.
Procedure
What to do next
- If you installed the enrollment server on the same machine that hosts an enterprise CA, configure the enrollment server to prefer using the local CA. See Enrollment Server Configuration Settings. Optionally, if you install and set up more than one enrollment server, configure connection servers to enable load balancing between the enrollment servers. See Connection Server Configuration Settings.
- Pair connection servers with enrollment servers. See Export the Enrollment Service Client Certificate.