Administration

6 In the Properties dialog box, edit the pae-NameValuePair aribute to add the following values
cs-samlencryptionkeyvaliditydays=number-of-days
cs-samlsigningkeyvaliditydays=number-of-days
In this example, number-of-days is the number of days that can elapse before a remote Connection Server
stops accepting SAML assertions. After this period of time, the process of exchanging SAML metadata
must be repeated.
Generate SAML Metadata So That Connection Server Can Be Used as a Service
Provider
After you create and enable a SAML authenticator for the identity provider you want to use, you might need
to generate Connection Server metadata. You use this metadata to create a service provider on the
Unied Access Gateway appliance or a third-party load balancer that is the identity provider.
Prerequisites
Verify that you have created a SAML authenticator for the identity provider: Unied Access Gateway or a
third-party load balancer or gateway. In the System Health section on the Horizon Administrator
dashboard, you can select Other components > SAML 2.0 Authenticators, select the SAML authenticator
that you added, and verify the details.
Procedure
1 Open a new browser tab and enter the URL for geing the Connection Server SAML metadata.
https://connection-server.example.com/SAML/metadata/sp.xml
In this example, connection-server.example.com is the fully qualied domain name of the Connection
Server host.
This page displays the SAML metadata from Connection Server.
2 Use a Save As command to save the Web page to an XML le.
For example, you could save the page to a le named connection-server-metadata.xml. The contents of
this le begin with the following text:
<md:EntityDescriptor xmlns:md="urn:oasis:names:tc:SAML:2.0:metadata" ...
What to do next
Use the appropriate procedure on the identity provider to copy in the Connection Server SAML metadata.
Refer to the documentation for Unied Access Gateway or a third-party load balancer or gateway.
Response Time Considerations for Multiple Dynamic SAML Authenticators
If you congure SAML 2.0 Authentication as optional or required on a Connection Server instance and you
associate multiple dynamic SAML authenticators with the Connection Server instance, if any of the dynamic
SAML authenticators become unreachable, the response time to launch remote desktops from the other
dynamic SAML authenticators increases.
You can decrease the response time for remote desktop launch on the other dynamic SAML authenticators
by using Horizon Administrator to disable the unreachable dynamic SAML authenticators. For information
about disabling a SAML authenticator, see “Congure a SAML Authenticator in Horizon Administrator,” on
page 62.
Chapter 4 Setting Up Other Types of User Authentication
VMware, Inc. 65