7.0

n
Verify that you have the correct certificate to import. You can use either your own certificate or the
automatically generated, self-signed Enrollment Service Client certificate from one connection server in
the cluster, as described in “Export the Enrollment Service Client Certificate,” on page 74.
IMPORTANT To use your own certificates for pairing, place the preferred certificate (and the associated
private key) in the custom container (VMware Horizon View Certificates\Certificates) in the
Windows Certificate Store on the connection server machine. You must then set the friendly name of
the certificate to vdm.ec.new, and restart the server. The other servers in the cluster will fetch this
certificate from LDAP. You can then perform the steps in this procedure.
If you have your own client certificate, the certificate that you must copy to the enrollment server is the
root certificate used to generate the client certificate.
Procedure
1 Copy the appropriate certificate file to the enrollment server machine.
To use the automatically generated certificate, copy the Enrollment Service Client certificate from the
connection server. To use your own certificate, copy the root certificate that was used to generate the
client certificate.
2 On the enrollment server, add the Certificates snap-in to MMC:
a Open the MMC console and select File > Add/Remove Snap-in
b Under Available snap-ins, select Certificates and click Add.
c In the Certificates snap-in window, select Computer account, click Next, and click Finish.
d In the Add or Remove Snap-in window, click OK.
3 In the MMC console, in the left pane, right-click the VMware Horizon View Enrollment Server
Trusted Roots folder and select All Tasks > Import.
4 In the Certificate Import wizard, follow the prompts to browse to and open the EnrollClient certificate
file.
5 Follow the prompts and accept the defaults to finish importing the certificate.
6 Right-click the imported certificate and add a friendly name such as vdm.ec (for Enrollment Client
certificate).
VMware recommends you use a friendly name that identifies the View cluster, but you can use any
name that helps you easily identify the client certificate.
What to do next
Configure the SAML authenticator used for delegating authentication to VMware Identity Manager. See
“Configure SAML Authentication to Work with True SSO,” on page 76.
Configure SAML Authentication to Work with True SSO
With the True SSO feature introduced in Horizon 7, users can log in to VMware Identity Manager 2.6 and
later releases using smart card, RADIUS, or RSA SecurID authentication, and they will no longer be
prompted for Active Directory credentials, even when they launch a remote desktop or application for the
first time.
With earlier releases, SSO (single sign-on) worked by prompting users for their Active Directory credentials
the first time they launched a remote desktop or hosted application if they had not previously authenticated
with their Active Directory credentials. The credentials were then cached so that subsequent launches
would not require users to re-enter their credentials. With True SSO, short-term certificates are created and
used instead of AD credentials.
View Administration
76 VMware, Inc.