After sign-in, the browser will then prompt the user to open VMware Horizon Client.

If the user is already signed in then the user won’t see any sign-in prompt.

It opens the default browser and prompts the user to sign into your SAML Identity Provider.

When you use Horizon Client to connect to a UAG that is SAML-enabled:

For High Availability you can build two Horizon Enrollment Servers.

The Horizon Enrollment Server software must be installed on standalone servers (no other Horizon components).

This is an identity operation and thus the Horizon Enrollment Servers should be treated like Domain Controllers. Horizon Enrollment Servers ask Microsoft Certificate Authority servers to generate the SSO certificates for each user.

To eliminate the second logon on the Horizon Agent machine, implement True SSO, which generates certificates for each user and then uses those certificates to automatically sign into the Horizon Agent machine.

This usually means the user has to login twice. SAML does not provide the user’s password to Horizon, which means that Horizon cannot perform single sign-on to the Horizon Agent machine and thus the Horizon Agent machine will prompt the user to login again.For Windows 10 version 2004, deploy Horizon 2103 (8.2) or newer.To configure SAML on Unified Access Gateway (UAG), you must have the following versions:

Horizon uag