User`s guide

Using Embedded RSA SecurID Software Tokens
If you create and distribute RSA SecurID software tokens to end users, they need enter only their PIN, rather
than PIN and token code, to authenticate.
Setup Requirements
NOTE This feature is available only if you are using View Client 1.6 or later.
You can use Compressed Token Format (CTF) or dynamic seed provisioning, which is also called CT-KIP
(Cryptographic Token Key Initialization Protocol), to set up an easy-to-use RSA authentication system. With
this system, you generate a URL to send to end users. To install the token, end users paste this URL directly
into Horizon View Client on their client devices. The dialog box for pasting this URL appears when end
users connect to View Connection Server with Horizon View Client.
Horizon View Client for Android also supports file-based provisioning. When a file-based software token is
issued to a user, the authentication server generates an XML-format token file, which is called an SDTID file
for its .sdtid extension. Horizon View Client can import the SDTID file directly. With View Client 1.7 and
later versions, users can also launch Horizon View Client by tapping the SDTID file in a file browser.
After the software token is installed, end users enter a PIN to authenticate. With external RSA tokens, end
users must enter a PIN and the token code generated by a hardware or software authentication token.
The following URL prefixes are supported if end users will be copying and pasting the URL into
Horizon View Client when Horizon View Client is connected to an RSA-enabled View Connection Server:
n
viewclient-securid://
n
http://127.0.0.1/securid/
With View Client 1.7 or later, end users can install the token by tapping the URL. Both prefixes viewclient-
securid:// and http://127.0.0.1/securid/ are supported. Note that not all browsers support hyperlinks
that begin with http://127.0.0.1. Also some file browsers, such as the File Manager app on the ASUS
Transformer Pad, cannot link the SDTID file with Horizon View Client.
For information about using dynamic seed provisioning or file-based (CTF) provisioning, see the Web page
RSA SecurID Software Token for iPhone Devices at http://www.rsa.com/node.aspx?id=3652 or RSA SecurID
Software Token for Android at http://www.rsa.com/node.aspx?id=3832.
Instructions to End Users
When you create a CTFString URL or CT-KIP URL to send to end users, you can generate a URL with or
without a password or activation code. You send this URL to end users in an email that must include the
following information:
n
Instructions for navigating to the Install Software Token dialog box.
Tell end users to tap External Token in the Horizon View Client dialog box that prompts them for RSA
SecurID credentials when they connect to View Connection Server.
n
CTFString URL or CT-KIP URL in plain text.
If the URL has formatting on it, end users will get an error message when they try to use it in View
Client.
n
Activation code, if the CT-KIP URL that you create does not already include the activation code.
End users must enter this activation code in a text field of the dialog box.
n
If the CT-KIP URL includes an activation code, tell end users that they need not enter anything in the
Password or Activation Code text box in the Install Software Token dialog box.
Chapter 1 Setup and Installation
VMware, Inc. 11