Administration

n
If the domain a smart card user resides in is different from the domain your root certificate was issued
from, verify that the user’s UPN is set to the SAN contained in the root certificate of the trusted CA.
a Find the SAN contained in the root certificate of the trusted CA by viewing the certificate
properties.
b On your Active Directory server, select Start > Administrative Tools > Active Directory Users
and Computers.
c Right-click the user in the Users folder and select Properties.
The UPN appears in the User logon name text boxes on the Account tab.
n
If smart card users select the PCoIP display protocol or the VMware Blast display protocol to connect
to single-session desktops, verify that the View Agent or Horizon Agent component called Smartcard
Redirection is installed on the single-user machines. The smart card feature lets users log in to
single-session desktops with smart cards. RDS hosts, which have the Remote Desktop Services role
installed, support the smart card feature automatically and you do not need to install the feature.
n
Check the log files in drive:\Documents and Settings\All Users\Application
Data\VMware\VDM\logs on the View Connection Server or security server host for messages stating
that smart card authentication is enabled.
Using Smart Card Certificate Revocation Checking
You can prevent users who have revoked user certificates from authenticating with smart cards by
configuring certificate revocation checking. Certificates are often revoked when a user leaves an
organization, loses a smart card, or moves from one department to another.
View supports certificate revocation checking with certificate revocation lists (CRLs) and with the Online
Certificate Status Protocol (OCSP). A CRL is a list of revoked certificates published by the CA that issued
the certificates. OCSP is a certificate validation protocol that is used to get the revocation status of an X.
509 certificate.
You can configure certificate revocation checking on a View Connection Server instance or on a security
server. When a View Connection Server instance is paired with a security server, you configure certificate
revocation checking on the security server. The CA must be accessible from the View Connection Server
or security server host.
You can configure both CRL and OCSP on the same View Connection Server instance or security server.
When you configure both types of certificate revocation checking, View attempts to use OCSP first and
falls back to CRL if OCSP fails. View does not fall back to OCSP if CRL fails.
n
Logging in with CRL Checking
When you configure CRL checking, View constructs and reads a CRL to determine the revocation
status of a user certificate.
n
Logging in with OCSP Certificate Revocation Checking
When you configure OCSP certificate revocation checking, View sends a request to an OCSP
Responder to determine the revocation status of a specific user certificate. View uses an OCSP
signing certificate to verify that the responses it receives from the OCSP Responder are genuine.
View Administration
VMware, Inc. 60