EUC

4. Unified Access Gateway / VMware Horizon integration into Workspace ONE Access

Overview

Traditional Federation with VMware Horizon and Workspace ONE Access has been a popular approach and is used my many organizations.
Organizations with High Security requirements do not like and SAML artifacts being validated internally
In this session we look at the option to validate the SAML artifact on the Unified Access Gateway instead of forwarding the artifact internally.

Part 1. Enabling SAML federation with the VMware Unified Access Gateway for Workspace ONE Access as the IDP

The Federation of Unified Access Gateway and VMware Horizon with Workspace ONE Access will be done in three phases

Phase 1. We enable and configure the SAML federation on 4 VMware Unified Access Gateway servers in a multi-site scenario
Phase 2. We enable and configure the SAML Integration as a Web App in Workspace ONE Access
Phase 3. We will create deep links in Workspace ONE Access for our Desktop entitlements

Step 1. Preparing to Federate the Unified Access Gateway with Workspace ONE Access

Note exporting the IDP.XML was accomplished on Day 1. Step 1 is here to remind you of the process. If you have an IDP.xml file downloaded in your Downloads folder on your ControlCenter server.

Move on to Step 2.

On your ControlCenter server
- Open your Workspace ONE Access, Admin console URL
  - Under Username
    - enter Administrator
  - Under Password
    - enter VMware1!
  - Select Sign In

In the Web Intelligent Hub Console
- To the right,
  - select TA
- From the dropdown
  - select Workspace ONE Access Console

In the Workspace ONE Access Console
- Select Resources
- Under the Resources > WEB Apps area
  - Select SETTINGS

In the Settings window
- below SaaS Apps
  - select SAML Metadata

In the Settings window
- in the right pane
  - below SAML Metadata
    - select & right click Identity Provider (IdP) metadata
    - in the drop down menu
      - select Save link as...
    - in Flle Explorer Save As window
      - ensure Downloads is selected Quick Access (default)
      - at the bottom of the window
        
        select Save

Step 2. Enabling SAML Federation on Site 1 , UAG-HZN-01a

On your Site 1 Browser profile
- In the Favourites bar
  - select the UAG-HZN-01a shortcut

In the VMware Unified Access Gateway login
- in the Username area
  - enter admin
- in the Password area
  - enter VMware1!
- select Login

In the VMware Unified Access Gateway admin console
- below Configure Manually
  - click Select

In the VMware Unified Access Gateway admin console
- scroll down to Identity Bridging Settings
  - to the right of Upload Identity Provider Metadata
    - select the GEAR icon

In the Upload Identity Provider Metadata window
- next to Entity ID
  - enter Workspace ONE Access
- next to IDP Metadata
  - click Select

In the File Explorer - Open window
- Quick Access > Downloads folder
  - (this should be the default)
    - select idp.xml
- in the bottom right corner
  - select Open

In the Upload Identity Provider Metadata window
- next to Always force SAML auth
  - switch the Toggle from OFF to ON
    - select Save
- scroll back up to the top of UAG admin console

In the VMware Unified Access Gateway admin console
- In the General Settings area
  - next to Edge Service Settings
    - turn the TOGGLE from OFF to ON
  - to the right of Horizon Settings
    - select the GEAR icon

In the Horizon Settings window
- scroll down to the bottom
  - next to More
    - select the expand icon

In the Horizon Settings window
- next to Auth Methods
  - from the dropdown
    - select SAML

In the Horizon Settings window
- below Auth Methods
  - next to Identity Provider*
    - from the dropdown
      - select Workspace ONE Access

In the Horizon Settings window
- below Identity Provider*
  - select Download SAML service provider metadata

In the Download SAML service provider metadata window
- next to External Host Name
  - enter corp.euc-livefire.com
  - select Download

In the Horizon Settings window
- scroll down to the bottom of the window
  - select Save

Step 3. Enabling SAML Federation on Site 1 , UAG-HZN-01b

On your Site 1 Browser profile
- In the Favourites bar
  - select the UAG-HZN-01B shortcut

In the VMware Unified Access Gateway login
- in the Username area
  - enter admin
- in the Password area
  - enter VMware1!
- select Login

In the VMware Unified Access Gateway admin console
- below Configure Manually
  - click Select

In the VMware Unified Access Gateway admin console
- scroll down to Identity Bridging Settings
  - to the right of Upload Identity Provider Metadata
    - select the GEAR icon

In the Upload Identity Provider Metadata window
- next to Entity ID
  - enter Workspace ONE Access
- next to IDP Metadata
  - click Select

In the File Explorer - Open window
- Quick Access > Downloads folder
  - (this should be the default)
    - select idp.xml
- in the bottom right corner
  - select Open

In the Upload Identity Provider Metadata window
- next to Always force SAML auth
  - switch the Toggle from OFF to ON
    - select Save
- scroll back up to the top of UAG admin console

In the VMware Unified Access Gateway admin console
- In the General Settings area
  - next to Edge Service Settings
    - turn the TOGGLE from OFF to ON
  - to the right of Horizon Settings
    - select the GEAR icon

In the Horizon Settings window
- scroll down to the bottom
  - next to More
    - select the expand icon

In the Horizon Settings window
- next to Auth Methods
  - from the dropdown
    - select SAML

In the Horizon Settings window
- below Auth Methods
  - next to Identity Provider*
    - from the dropdown
      - select Workspace ONE Access

In the Horizon Settings window
- scroll down to the bottom of the window
  - select Save

Step 4. Enabling SAML Federation on Site 2 , UAG-HZN-02a

On your ControlCenter server
- switch to your Site 2 Browser profile
  - In the Favourites bar
    - select the UAG-HZN-02a shortcut

In the VMware Unified Access Gateway login
- in the Username area
  - enter admin
- in the Password area
  - enter VMware1!
- select Login

In the VMware Unified Access Gateway admin console
- below Configure Manually
  - click Select

In the VMware Unified Access Gateway admin console
- scroll down to Identity Bridging Settings
  - to the right of Upload Identity Provider Metadata
    - select the GEAR icon

In the Upload Identity Provider Metadata window
- next to Entity ID
  - enter Workspace ONE Access
- next to IDP Metadata
  - click Select

In the File Explorer - Open window
- Quick Access > Downloads folder
  - (this should be the default)
    - select idp.xml
- in the bottom right corner
  - select Open

In the Upload Identity Provider Metadata window
- next to Always force SAML auth
  - switch the Toggle from OFF to ON
    - select Save
- scroll back up to the top of UAG admin console

In the VMware Unified Access Gateway admin console
- In the General Settings area
  - next to Edge Service Settings
    - turn the TOGGLE from OFF to ON
  - to the right of Horizon Settings
    - select the GEAR icon

In the Horizon Settings window
- scroll down to the bottom
  - next to More
    - select the expand icon

In the Horizon Settings window
- next to Auth Methods
  - from the dropdown
    - select SAML

In the Horizon Settings window
- below Auth Methods
  - next to Identity Provider*
    - from the dropdown
      - select Workspace ONE Access

In the Horizon Settings window
- scroll down to the bottom of the window
  - select Save

Step 5. Enabling SAML Federation on Site 2 , UAG-HZN-02b

On your ControlCenter server
- on your Site 2 Browser profile
  - In the Favourites bar
    - select the UAG-HZN-02b shortcut

In the VMware Unified Access Gateway login
- in the Username area
  - enter admin
- in the Password area
  - enter VMware1!
- select Login

In the VMware Unified Access Gateway admin console
- below Configure Manually
  - click Select

In the VMware Unified Access Gateway admin console
- scroll down to Identity Bridging Settings
  - to the right of Upload Identity Provider Metadata
    - select the GEAR icon

In the Upload Identity Provider Metadata window
- next to Entity ID
  - enter Workspace ONE Access
- next to IDP Metadata
  - click Select

In the File Explorer - Open window
- Quick Access > Downloads folder
  - (this should be the default)
    - select idp.xml
- in the bottom right corner
  - select Open

In the Upload Identity Provider Metadata window
- next to Always force SAML auth
  - switch the Toggle from OFF to ON
    - select Save
- scroll back up to the top of UAG admin console

In the VMware Unified Access Gateway admin console
- In the General Settings area
  - next to Edge Service Settings
    - turn the TOGGLE from OFF to ON
  - to the right of Horizon Settings
    - select the GEAR icon

In the Horizon Settings window
- scroll down to the bottom
  - next to More
    - select the expand icon

In the Horizon Settings window
- next to Auth Methods
  - from the dropdown
    - select SAML

In the Horizon Settings window
- below Auth Methods
  - next to Identity Provider*
    - from the dropdown
      - select Workspace ONE Access

In the Horizon Settings window
- scroll down to the bottom of the window
  - select Save

Part 2. Configuring the SAML Federation for Horizon

For TrueSSO to work the Horizon SAML authenticator is required.
We configure this on both Site 1 and Site 2

Step 1. Configuring the SAML federation with VMware Horizon on Site 1

Configuring VMware Identity Manager to deliver remote Applications and Desktops

On your ControlCenter server
- Site 1 Browser
- In the Horizon Admin Console
  - In the Inventory
    - expand Settings,
      - select Servers
    - In the Servers area
      - select the Connection Servers tab

Under Servers
- Select the radio button to next HORIZON-01a
- Select Edit

On the Edit Connection Server Settings page
- Select the Authentication tab.

On the Authentication tab
- below Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator):
  - On the Drop down Arrow
    - Select Allowed,
- Select the Manage SAML Authenticators box

On the Manage SAML Authenticators box
- Select Add

In the Add SAML 2.0 Authenticator window.
- Ensure Dynamic radio button is selected,
- Enter the following:
  - Under Label:
    - type Workspace ONE Access
  - Under Metadata URL : enter
    - https://YOUR CUSTOM Access URL/SAAS/API/1.0/GET/metadata/idp.xml
      - e.g. https://aw-euclivefirefran.vidmpreview.com/SAAS/API/1.0/GET/metadata/idp.xml
  - Under * TrueSSO Trigger Mode
    - from the dropdown
      - select Enabled
  - Select OK

In the Manage SAML Authenticators window
- Select OK to close

In the Connection Server Settings
- Select OK

Step 2. Configuring the SAML federation with VMware Horizon on Site 2

On your ControlCenter server
- Site 2 Browser
- In the Horizon Admin Console
  - Inventory pane
    - expand Settings,
      - select Servers
      - In the middle pane
        
        select the Connection Servers tab

Under Servers
- select the radio button to next HORIZON-02a
- select Edit

On the Edit Connection Server Settings page
- select the Authentication tab.

In the Edit Connection Server Settings window
- on the Authentication tab,
  - under Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator):
    - from the Drop down Arrow
      - select Allowed,
  - below SAML Authenticator
    - select the Manage SAML Authenticators box

On the Manage SAML Authenticators box
- Select Add

In the Add SAML 2.0 Authenticator window.
- ensure Dynamic radio button is selected,
  - enter the following:
    - under Label:
      - type Workspace ONE Access
    - Under Metadata URL : enter
      - https://YOUR CUSTOM Access URL/SAAS/API/1.0/GET/metadata/idp.xml
        
        e.g. https://aw-euclivefirefran.vidmpreview.com/SAAS/API/1.0/GET/metadata/idp.xml
    - under * TrueSSO Trigger Mode
      - from the dropdown
        
        select Enabled
    - select OK

In the Manage SAML Authenticators window
- Select OK to close

In the Connection Server Settings
- Select OK

Part 3. Configuring Workspace ONE Access for VMware Unified Access as the Service Provider

In this section perform the Workspace ONE Access part of the SAML Federation process with VMware Unified Access Gateway

Configuring Workspace ONE Access for VMware Unified Access as the Service Provider

On your ControlCenter server
- Open your Workspace ONE Access, Admin console URL
  - Under Username
    - enter Administrator
  - Under Password
    - enter VMware1!
  - Select Sign In

In the Web Intelligent Hub Console
- To the right,
  - select TA
- From the dropdown
  - select Workspace ONE Access Console

In the Workspace ONE Access Console
- select Resources
- Under the Resources > WEB Apps area
  - select NEW

In the New SaaS Application window
1. In the Definition area
  - under Name
    - enter Unified Access Gateway SAML SP
  - Under Icon
    - select SELECT FILE ...

In the File Explorer > Open window
- In the Quick Access pane
  - select Desktop
  - in the Desktop area
    - select software > UAG > Icons
      - in the Icons folder
        
        select UAG.png
      - select Open

In the New SaaS Application window
1. In the Definition area
  - Select NEXT

On the ControlCenter server
- from the Taskbar
  - select the Folder icon

In the File Explorer window
- from the Quick Access pane
  - select Downloads

In the File Explorer window
- Downloads folder
  - select corp.euc-livefire.com
    - select & right-click Edit with Notepad++

In the Notepad++ application
- with your keyboard
  - enter CTRL + A
  - enter CTRL + C
- switch back to the New SaaS Application wizard

In the New SaaS Application window
1. In the Configuration area
  - the box below URL / XML
    - paste your corp.euc-livefire.com.xml metadata
  - scroll down the Configuration area to the bottom
    - below Show in User Portal
      - change the Toggle from ON to OFF
  - select NEXT

In the New Saas Application window,
1. In the Access Policies section
  - Select NEXT

In the New Saas Application window,
1. In the Summary section
  - Select SAVE & ASSIGN

In the Assign window
- Under Users / Groups
  - Enter Sales
    - Select [email protected]
  - Enter Devel
    - Select [email protected]
- Under Deployment type
  - From the dropdowns
    - Ensure both Sales and Developers are set to
      - Automatic
- In the bottom right corner
  - select SAVE

In your Workspace ONE Access Console
- Web Apps interface
  - Note your Unified Access Gateway SAML SP Web APP

Part 4. Deploying VMware Horizon Deep Links for entitlements

As we are not using the Workspace ONE Access Connector to sync entitlements, we will create Deep Links for our Entitlements and assign these to our Security Groups

In this Part we will create Deep Links for existing entitlements

Step 1. Deploying a Deep link for the Enterprise Corp Instant Clone Global Entitlement

On your ControlCenter server
- Open your Workspace ONE Access, Admin console URL
  - Under Username
    - enter Administrator
  - Under Password
    - enter VMware1!
  - Select Sign In

In the Web Intelligent Hub Console
- To the right,
  - select TA
- From the dropdown
  - select Workspace ONE Access Console

In the Workspace ONE Access Console
- select Resources
- Under the Resources > WEB Apps area
  - select NEW

In the New SaaS Application window
1. In the Definition area
  - under Name
    - enter Enterprise Instant Clone Windows 11 Desktops
  - under Icon
    - select SELECT FILE ...

In the File Explorer > Open window
- In the Quick Access pane
  - select Desktop
  - in the Desktop area
    - select software > software > Icons
      - in the Icons folder
        
        select Enterprise Desktop.jpg
      - select Open

In the New SaaS Application window
1. In the Definition area
  - Select NEXT

In the New SaaS Application window
1. In the Configuration area
  - below Authentication Type *
    - from the dropdown
      - select Web Application Link

In the New SaaS Application window
1. In the Configuration area
  - below Target URL *
    - enter the following URL

https://corp.euc-livefire.com/portal/nativeclient/Enterprise_Desktop?action=start-session&desktopProtocol=BLAST&launchMinimized=false

In the bottom right corner
- select NEXT

In the New Saas Application window,
1. In the Summary section
  - Select SAVE & ASSIGN

In the Assign window
- Under Users / Groups
  - Enter Devel
    - Select [email protected]

In the Assign window
- Under Users / Groups
  - Enter sales
    - select [email protected]
- Under Deployment type
  - From the dropdowns
    - Ensure both Sales and Developers are set to
      - Automatic
- In the bottom right corner
  - select SAVE

In your Workspace ONE Access Console
- Web Apps interface
  - Note your Enterprise Instant Clone Windows 11 Desktops Web Application Link

Step 2. Deploying a Deep link for the Enterprise Full Clone Global Entitlement

In the Workspace ONE Access Console
- under the Resources > WEB Apps area
  - select NEW

In the New SaaS Application window
1. In the Definition area
  - under Name
    - enter Enterprise Full Clone Desktops
  - under Icon
    - select SELECT FILE ...

In the File Explorer > Open window
- In the Quick Access pane
  - select Desktop
  - in the Desktop area
    - select software > software > Icons
      - in the Icons folder
        
        select desktop-developer.jpg
      - select Open

In the New SaaS Application window
1. In the Definition area
  - Select NEXT

In the New SaaS Application window
1. In the Configuration area
  - below Authentication Type *
    - from the dropdown
      - select Web Application Link

In the New SaaS Application window
1. In the Configuration area
  - below Target URL *
    - enter the following URL

https://corp.euc-livefire.com/portal/nativeclient/Developers?action=start-session&desktopProtocol=BLAST&launchMinimized=false

In the bottom right corner
- select NEXT

In the New Saas Application window,
1. In the Summary section
  - Select SAVE & ASSIGN

In the Assign window
- Under Users / Groups
  - Enter Devel
    - Select [email protected]

In the Assign window
- Under Deployment type
  - From the dropdown
    - Developers are set to
      - Automatic
- In the bottom right corner
  - select SAVE

In your Workspace ONE Access Console
- Web Apps interface
  - Note your Enterprise Full Clone Desktops Web Application Link

Part 5. Testing the Horizon desktop sessions in Workspace ONE Access

Part 5 brings everything we have done on Day 2 together.

We will look at 3 primary testing scenarios

Step 1: Testing Site 1 based network traffic

On your ControlCenter server
- from the Desktop
  - Open the Remote Desktops \ Site 1 folder
  - Launch the W11Client-01a.rdp shortcut

In the Windows Security page
- ensure Craig is the username
- in the password area
  - enter VMware1!
- select OK

On your W11Client-01a desktop
- From the taskbar or Desktop
  - launch your VMware Horizon Client
  - In the VMware Horizon Client window
    - select corp.euc-livefire.com broker URL

In the Microsoft login login window
- in the username area
  - enter craig@corpXXX.euc-livefire.com
    - XXX is your assigned domain name
  - select Next

In the Microsoft login login window
- below Enter password
  - enter VMware1!
  - select Sign in

In the Microsoft login login window
- below Stay signed in?
  - select No

In the Open VMware Horizon Client? window
- select Open VMware Horizon Client

In the VMware Horizon Client login window
- select the Enterprise Desktop entitlement

On your Horizon Desktop session
- from the taskbar
  - select and right-click the START button
  - from the inventory
    - select Run

In the Run window
- next to Open:
  - enter cmd.exe
  - select OK

In the CMD.exe window
- In the prompt area:
  - enter hostname
    - with your keyboard
      - select ENTER
- Notice that you have a Horizon virtual desktop with the BLR naming convention representing Bangalore

Step 2: Testing Site 2 based network traffic

On your ControlCenter server
- from the Desktop
  - Open the Remote Desktops \ Site 2 folder
  - Launch the W11Client-02a.rdp shortcut

In the Windows Security page
- ensure Jackie is the username
- in the password area
  - enter VMware1!
- select OK

On your W11Client-02a desktop
- From the taskbar or Desktop
  - launch your VMware Horizon Client
  - In the VMware Horizon Client window
    - select corp.euc-livefire.com broker URL

In the Microsoft login login window
- in the username area
  - enter jackie@corpXXX.euc-livefire.com
    - XXX is your assigned domain name
  - select Next

In the Microsoft login login window
- below Enter password
  - enter VMware1!
  - select Sign in

In the Microsoft login login window
- below Stay signed in?
  - select No

In the Open VMware Horizon Client? window
- select Open VMware Horizon Client

In the VMware Horizon Client login window
- select the Enterprise Desktop entitlement

On your Horizon Desktop session
- from the taskbar
  - select and right-click the START button
  - from the inventory
    - select Run

In the Run window
- next to Open:
  - enter cmd.exe
  - select OK

In the CMD.exe window
- In the prompt area:
  - enter hostname
    - with your keyboard
      - select ENTER
- Notice that you have a Horizon virtual desktop with the SEA naming convention representing Seattle

Step 3. Testing Horizon integration with Workspace ONE Access using CPA Global Entitlements

On your Control Center server
- On your Chrome browser
  - Open up an Incognito session
  - In the address bar enter your Workspace ONE Access tenant url

In the Microsoft Sign in window
- enter
  - craig@corpXXX.euc-livefire.com
    - where XXX is your assigned domain

select Next

In the Microsoft Sign in window
- Under Enter password
  - enter VMware1!
- select Sign in
- In the Stay signed in? window
  - select NO

In the web Intelligent Hub
- Select Apps

In the web Intelligent Hub
- Under New Apps
  - select Enterprise Desktop

In the Open VMware Horizon Client? window
- select Open VMware Horizon Client

On your Horizon Desktop session
- from the taskbar
  - select and right-click the START button
  - from the inventory
    - select Run

In the Run window
- next to Open:
  - enter cmd.exe
  - select OK

In the CMD.exe window
- In the prompt area:
  - enter hostname
    - with your keyboard
      - select ENTER
- Notice that you have a Horizon virtual desktop with the BLR naming convention representing Bangalore

Conclusion

To summarize. The started off the labs for Day 2 with first configuring

On both Site 1 and Site 2 using VMware AVi Local load-balancing of 4 UAG servers
Using a VMware AVi . You configured a Global Load balancing solution across site 1 and site 2
We then enabled and configured VMware Horizon Cloud Pod Architecture across site 1 and site 2
We then enabled a Federation of Workspace ONE access with Unified Access Gateway and VMware Horizon
- From our ControlCenter server. We launched a Web based Intelligent Hub session
- From the Intelligent Hub we did a Horizon Desktop launch and our GLSB redirected us to Site 1
- Feel free to repeat the same steps on a Site 2 based desktop for Intelligent Hub

EUC

4. Unified Access Gateway / VMware Horizon integration into Workspace ONE Access

Part 1. Enabling SAML federation with the VMware Unified Access Gateway for Workspace ONE Access as the IDP

Part 2. Configuring the SAML Federation for Horizon

Part 3. Configuring Workspace ONE Access for VMware Unified Access as the Service Provider

Part 4. Deploying VMware Horizon Deep Links for entitlements

Part 5. Testing the Horizon desktop sessions in Workspace ONE Access

0 Comments

Add your comment

Topics

Last Updated