Administration

Although the process for conguring SAML authentication for VMware Identity Manager has not changed,
one additional step has been added for True SSO. You must congure VMware Identity Manager so that
password pop-ups are suppressed.
N If your deployment includes more than one View Connection Server instance, you must associate the
SAML authenticator with each instance.
Prerequisites
n
Verify that single sign-on is enabled as a global seing. In View Administrator, select  >
Global , and verify that Single sign-on (SSO) is set to Enabled.
n
Verify that VMware Identity Manager is installed and congured. See the VMware Identity Manager
documentation, available at hps://www.vmware.com/support/pubs/vidm_pubs.html
n
Verify that the root certicate for the signing CA for the SAML server certicate is installed on the
connection server host. VMware does not recommend that you congure SAML authenticators to use
self-signed certicates. See the topic "Import a Root Certicate and Intermediate Certicates into a
Windows Certicate Store," in the chapter "Conguring SSL Certicates for View Servers," in the View
Installation document.
n
Make a note of the FQDN of the VMware Identity Manager server instance.
Procedure
1 In View Administrator, select  > Servers.
2 On the Connection Servers tab, select a server instance to associate with the SAML authenticator and
click Edit.
3 On the Authentication tab, from the Delegation of authentication to VMware Horizon (SAML 2.0
Authenticator) drop-down menu, select Allowed or Required.
You can congure each View Connection Server instance in your deployment to have dierent SAML
authentication seings, depending on your requirements.
4 Click Manage SAML Authenticators and click Add.
5 Congure the SAML authenticator in the Add SAML 2.0 Authenticator dialog box.
Option Description
Label
You can use the FQDN of the VMware Identity Manager server instance.
Description
(Optional) You can use the FQDN of the VMware Identity Manager server
instance.
Metadata URL
URL for retrieving all of the information required to exchange SAML
information between the SAML identity provider and the View
Connection Server instance. In the URL https://<YOUR HORIZON SERVER
NAME>/SAAS/API/1.0/GET/metadata/idp.xml, click <YOUR
HORIZON SERVER NAME> and replace it with the FQDN of the
VMware Identity Manager server instance.
Administration URL
URL for accessing the administration console of the SAML identity
provider (VMware Identity Manager instance). This URL has the format
https://<Identity-Manager-FQDN>:8443.
6 Click OK to save the SAML authenticator conguration.
If you provided valid information, you must either accept the self-signed certicate (not recommended)
or use a trusted certicate for View and VMware Identity Manager.
The SAML 2.0 Authenticator drop-down menu displays the newly created authenticator, which is now
set as the selected authenticator.
Chapter 5 Authenticating Users Without Requiring Credentials
VMware, Inc. 77