To launch remote desktops and applications from VMware Workspace ONE Access or to connect to remote desktops and applications through a third-party load balancer or gateway, you must create a SAML authenticator in Horizon Console. A SAML authenticator contains the trust and metadata exchange between VMware Horizon and the device to which clients connect.

You associate a SAML authenticator with a Connection Server instance. If your deployment includes more than one Connection Server instance, you must associate the SAML authenticator with each instance.

You can allow one static authenticator and multiple dynamic authenticators to go live at a time. You can configure vIDM (Dynamic) and Unified Access Gateway (Static) authenticators and retain them in active state. You can make connections through either of these authenticators.

You can configure more than one SAML authenticator to a Connection Server and all the authenticators can be active simultaneously. However, the entity-ID of each of these SAML authenticators configured on the Connection Server must be different.

The status of the SAML authenticator in dashboard is always green as it is predefined metadata that is static in nature. The red and green toggling is only applicable for dynamic authenticators.

For information about configuring a SAML authenticator for VMware Unified Access Gateway appliances, see the Unified Access Gateway documentation.

Prerequisites

  • Verify that Workspace ONE, VMware Workspace ONE Access, or a third-party gateway or load balancer is installed and configured. See the installation documentation for that product.

  • Verify that the root certificate for the signing CA for the SAML server certificate is installed on the Connection Server host. VMware does not recommend that you configure SAML authenticators to use self-signed certificates. For information about certificate authentication, see the Horizon 8 Installation and Upgrade document.
  • Make a note of the FQDN or IP address of the Workspace ONE server, VMware Workspace ONE Access server, or external-facing load balancer.
  • (Optional) If you are using Workspace ONE or VMware Workspace ONE Access, make a note of the URL of the connector Web interface.
  • If you are creating an authenticator for a Unified Access Gateway appliance or a third-party appliance that requires you to generate SAML metadata and create a static authenticator, perform the procedure on the device to generate the SAML metadata, and then copy the metadata.

Procedure

  1. In Horizon Console, navigate to Settings > Servers.
  2. On the Connection Servers tab, select a server instance to associate with the SAML authenticator and click Edit.
  3. On the Authentication tab, select a setting from the Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator) drop-down menu to enable or disable the SAML authenticator.
    Option Description
    Disabled SAML authentication is disabled. You can launch remote desktops and applications only from Horizon Client.
    Allowed SAML authentication is enabled. You can launch remote desktops and applications from both Horizon Client and VMware Workspace ONE Access or the third-party device.
    Required SAML authentication is enabled. You can launch remote desktops and applications only from VMware Workspace ONE Access or the third-party device. You cannot launch desktops or applications from Horizon Client manually.
    You can configure each Connection Server instance in your deployment to have different SAML authentication settings, depending on your requirements.
  4. Click Manage SAML Authenticators and click Add.
  5. Configure the SAML authenticator in the Add SAML 2.0 Authenticator dialog box.
    Option Description
    Type For a Unified Access Gateway appliance or a third-party device, select Static. For VMware Workspace ONE Access select Dynamic. For dynamic authenticators, you can specify a metadata URL and an administration URL. For static authenticators, you must first generate the metadata on the Unified Access Gateway appliance or a third-party device, copy the metadata, and then paste it into the SAML metadata text box.
    Label Unique name that identifies the SAML authenticator.
    Description Brief description of the SAML authenticator. This value is optional.
    Metadata URL (For dynamic authenticators) URL for retrieving all of the information required to exchange SAML information between the SAML identity provider and the Connection Server instance. In the URL https://<YOUR HORIZON SERVER NAME>/SAAS/API/1.0/GET/metadata/idp.xml, click <YOUR HORIZON SERVER NAME> and replace it with the FQDN or IP address of the VMware Workspace ONE Access server or external-facing load balancer (third-party device).
    Administration URL (For dynamic authenticators) URL for accessing the administration console of the SAML identity provider. For VMware Workspace ONE Access, this URL should point to the VMware Workspace ONE Access Connector Web interface. This value is optional.
    True SSO Trigger Mode (For dynamic authenticators) Enable or disable TrueSSO for SAML authenticators.
    SAML metadata (For static authenticators) Metadata text that you generated and copied from the Unified Access Gateway appliance or a third-party device.
    Enabled for Connection Server Select this check box to enable the authenticator. You can enable multiple authenticators. Only enabled authenticators are displayed in the list.
  6. Click OK to save the SAML authenticator configuration.
    If you provided valid information, you must either accept the self-signed certificate (not recommended) or use a trusted certificate for VMware Horizon and VMware Workspace ONE Access or the third-party device.

    The Manage SAML Authenticators dialog box displays the newly created authenticator.

What to do next

Extend the expiration period of the Connection Server metadata so that remote sessions are not terminated after only 24 hours. See Change the Expiration Period for Service Provider Metadata on Connection Server.