Administration

n
Verify that you have the correct certicate to import. You can use either your own certicate or the
automatically generated, self-signed Enrollment Service Client certicate from one connection server in
the cluster, as described in “Export the Enrollment Service Client Certicate,” on page 74.
I To use your own certicates for pairing, place the preferred certicate (and the associated
private key) in the custom container (VMware Horizon View Certificates\Certificates) in the
Windows Certicate Store on the connection server machine. You must then set the friendly name of the
certicate to vdm.ec.new, and restart the server. The other servers in the cluster will fetch this certicate
from LDAP. You can then perform the steps in this procedure.
If you have your own client certicate, the certicate that you must copy to the enrollment server is the
root certicate used to generate the client certicate.
Procedure
1 Copy the appropriate certicate le to the enrollment server machine.
To use the automatically generated certicate, copy the Enrollment Service Client certicate from the
connection server. To use your own certicate, copy the root certicate that was used to generate the
client certicate.
2 On the enrollment server, add the Certicates snap-in to MMC:
a Open the MMC console and select File > Add/Remove Snap-in
b Under Available snap-ins, select  and click Add.
c In the Certicates snap-in window, select Computer account, click Next, and click Finish.
d In the Add or Remove Snap-in window, click OK.
3 In the MMC console, in the left pane, right-click the VMware Horizon View Enrollment Server Trusted
Roots folder and select All Tasks > Import.
4 In the Certicate Import wizard, follow the prompts to browse to and open the EnrollClient certicate
le.
5 Follow the prompts and accept the defaults to nish importing the certicate.
6 Right-click the imported certicate and add a friendly name such as vdm.ec (for Enrollment Client
certicate).
VMware recommends you use a friendly name that identies the View cluster, but you can use any
name that helps you easily identify the client certicate.
What to do next
Congure the SAML authenticator used for delegating authentication to VMware Identity Manager. See
“Congure SAML Authentication to Work with True SSO,” on page 76.
Configure SAML Authentication to Work with True SSO
With the True SSO feature introduced in Horizon 7, users can log in to VMware Identity Manager 2.6 and
later releases using smart card, RADIUS, or RSA SecurID authentication, and they will no longer be
prompted for Active Directory credentials, even when they launch a remote desktop or application for the
rst time.
With earlier releases, SSO (single sign-on) worked by prompting users for their Active Directory credentials
the rst time they launched a remote desktop or hosted application if they had not previously authenticated
with their Active Directory credentials. The credentials were then cached so that subsequent launches would
not require users to re-enter their credentials. With True SSO, short-term certicates are created and used
instead of AD credentials.
View Administration
76 VMware, Inc.