Integrating Omnissa Horizon 8 with Microsoft Entra ID via SAML Federation

The following guide will help you quickly set up SAML-based federation between your Omnissa Horizon 8 environment and Microsoft Entra ID.

Prerequisite: Please ensure that you are using a supported version of Horizon (version 2503 or later) before proceeding with this configuration.

Step 1: Create a New Enterprise Application in Entra ID

First, we need to set up a custom application within the Microsoft Entra admin center to handle the SAML integration.

1. Log in to the Microsoft Entra admin center.

2. Navigate to Identity > Applications > Enterprise applications > All applications.

3. Click on New application at the top of the pane.

1. On the next screen, select Create your own application.

2. Type a descriptive name that makes sense for your deployment (e.g., Omnissa Horizon 8 Production) and click Create.

Once the application is created, go to the Overview tab and copy the Application ID. Keep this handy, as you will need it later.

Note on User Assignment: Before moving to the next step, make sure to assign the appropriate users or groups to this application. We will skip the specific steps for user assignment here, as it is a standard Entra ID process and not unique to Horizon 8.

Step 2: Prepare the SAML Single Sign-On Configuration

The easiest way to configure Single Sign-On (SSO) is by uploading the Service Provider metadata file.

Inside your new Enterprise Application, navigate to Manage > Single sign-on and select SAML.

Look for the Upload metadata file option at the top of the page, leave this tab open for a moment; we will return to it shortly.

Step 3: Configure the SAML Authenticator in Horizon 8

Now, we need to configure Horizon to recognize Entra ID as its Identity Provider (IdP).

1. Log into your Horizon 8 Administrator Console.

2. Navigate to Settings > Global Settings > Authenticators.

3. Click Add to create a new authenticator and configure the following:

1. • Label: Give the authenticator a recognizable name.

   • Type: Leave this as the default Dynamic.

2. To provide the IdP metadata URL, you must point it to your specific Microsoft Entra tenant and append your unique Application ID (noted in Step 1). Use the following syntax: https://login.microsoftonline.com/<Entra_ID_Tenant_ID>/federationmetadata/2007-06/federationmetadata.xml?appid=<Entra_ID_Application_ID>

3. Click OK to save the configuration.

Select your newly created Authenticator from the list and click Enable.

Pro-Tip (Optional): If you want to force users to authenticate exclusively through Entra ID, change the Delegation of Authentication setting to Required and click OK.

Next, let's click on the "METADATA SETTINGS"

Step 4: Adjust Service Provider Metadata Settings

1. With the authenticator selected in the Horizon Console, click on Metadata Settings.

2. By default, the Shared EntityID is set to your Cluster GUID. You will probably need to change this to a friendly string (e.g., your Horizon FQDN) so Entra ID will seamlessly accept it when we import it.

3. Click OK when finished.

Step 5: Export Horizon Metadata and Upload to Entra ID

Now, we need to grab the Service Provider (SP) XML metadata file from your Horizon Connection Server and give it to Entra ID.

1. Open a new browser tab and navigate to your Horizon server's FQDN with /SAML/metadata/sp.xml appended to the end.

   • Example: https://cs01.example.local/SAML/metadata/sp.xml

2. You will see the raw XML data in your browser. Save this page to your computer as an .xml file.

3. Go back to your Entra ID Upload metadata file page that you left open in Step 2.

4. Choose the XML file you just saved, click Add, and once it finishes processing, click Save.

That’s it! Your federation is now configured.

Step 6: Testing the Integration

To test it, browse to your Horizon Connection Server FQDN or open the Horizon Client. You should be automatically redirected to Microsoft Entra ID for authentication. After successfully logging in, you will be redirected back to see your desktop and application entitlements.

Integrating Entra ID and Horizon 8: Handling UPN Mismatches

Another crucial architecture consideration is identity alignment. By default, Microsoft Entra ID typically utilizes an external domain for user authentication, whereas Omnissa Horizon 8 relies on the internal Active Directory (AD) User Principal Name (UPN). If your local AD users are configured with the default internal UPN, you must ensure Horizon is configured to map these identities correctly.

You can resolve this discrepancy using one of two primary approaches discussed below.

Security Consideration: Claims Transformation Risks

Security Note: While claims transformation provides immense flexibility, it also introduces a critical attack vector that security architects must account for.

When implementing claims transformation, organizations must carefully weigh the associated security risks. A compromised or malicious administrator with privileges to modify transformation rules could exploit the system to alter user identity claims. By injecting fraudulent claims, such an attacker could elevate privileges, impersonate another user, and ultimately gain unauthorized access to their virtual desktop infrastructure (VDI).

To mitigate this risk, it is highly recommended to implement strict auditing and real-time alerting. Specifically, organizations should continuously monitor and alert on any modifications made to the claims configurations of federated applications. For a detailed guide on how to monitor federation changes and secure these environments, refer to the Microsoft Entra documentation.

Option 1: Utilizing ADAM Database Filters

The first method involves leveraging filters via the pae-LDAPURLList attribute within your Horizon ADAM database (specifically on the SAML authenticator created for this integration).

As detailed in the Omnissa Documentation, you can utilize various unique identifiers to bridge the gap. This configuration instructs the Horizon Connection Server to dynamically locate and resolve the correct internal UPN based on the specified identifier.

⚠️ Important Note: If your environment utilizes True SSO, modifying the ADAM database filters alone will not be sufficient to achieve seamless authentication.

Option 2: Implementing Entra ID Claims Transformation

For environments leveraging True SSO, a more robust solution is to use a RegexReplace Claims Transformation within Microsoft Entra ID.

By navigating to the Attributes & Claims section of the Single Sign-On (SSO) settings for your Enterprise Application, you can create a transformation rule. This rule dynamically rewrites the incoming claim - effectively converting user@domain.com to user@domain.local on the fly based on your specific domain mapping requirements.

A Note on True SSO

If you have True SSO enabled for this new Authenticator, users will launch their resources seamlessly without being prompted for their Active Directory password a second time.

Setting up True SSO involves specific active directory configurations which are outside the scope of this guide. You can find the official documentation on the Omnissa Documentation Portal.

I hope this guide was helpful to you! If you have any questions or want to connect, feel free to reach out to me on LinkedIn.