Administration

n
If you congured smart card authentication on a View Connection Server instance, check the smart card
authentication seing in View Administrator.
a Select View  > Servers.
b On the Connection Servers tab, select the View Connection Server instance and click Edit.
c If you congured smart card authentication for users, on the Authentication tab, verify that Smart
card authentication for users is set to either Optional or Required.
d If you congured smart card authentication for administrators, on the Authentication tab, verify
that Smart card authentication for administrators is set to either Optional or Required.
You must restart the View Connection Server service for changes to smart card seings to take eect.
n
If the domain a smart card user resides in is dierent from the domain your root certicate was issued
from, verify that the user’s UPN is set to the SAN contained in the root certicate of the trusted CA.
a Find the SAN contained in the root certicate of the trusted CA by viewing the certicate
properties.
b On your Active Directory server, select Start > Administrative Tools > Active Directory Users and
Computers.
c Right-click the user in the Users folder and select Properties.
The UPN appears in the User logon name text boxes on the Account tab.
n
If smart card users select the PCoIP display protocol or the VMware Blast display protocol to connect to
single-session desktops, verify that the View Agent or Horizon Agent component called Smartcard
Redirection is installed on the single-user machines. The smart card feature lets users log in to single-
session desktops with smart cards. RDS hosts, which have the Remote Desktop Services role installed,
support the smart card feature automatically and you do not need to install the feature.
n
Check the log les in drive:\Documents and Settings\All Users\Application Data\VMware\VDM\logs
on the View Connection Server or security server host for messages stating that smart card
authentication is enabled.
Using Smart Card Certificate Revocation Checking
You can prevent users who have revoked user certicates from authenticating with smart cards by
conguring certicate revocation checking. Certicates are often revoked when a user leaves an
organization, loses a smart card, or moves from one department to another.
View supports certicate revocation checking with certicate revocation lists (CRLs) and with the Online
Certicate Status Protocol (OCSP). A CRL is a list of revoked certicates published by the CA that issued the
certicates. OCSP is a certicate validation protocol that is used to get the revocation status of an X.509
certicate.
You can congure certicate revocation checking on a View Connection Server instance or on a security
server. When a View Connection Server instance is paired with a security server, you congure certicate
revocation checking on the security server. The CA must be accessible from the View Connection Server or
security server host.
You can congure both CRL and OCSP on the same View Connection Server instance or security server.
When you congure both types of certicate revocation checking, View aempts to use OCSP rst and falls
back to CRL if OCSP fails. View does not fall back to OCSP if CRL fails.
n
Logging in with CRL Checking on page 54
When you congure CRL checking, View constructs and reads a CRL to determine the revocation
status of a user certicate.
Chapter 3 Setting Up Smart Card Authentication
VMware, Inc. 53