User manual

n
To hide security information in Horizon Client, including server URL information and the Domain
drop-down menu, enable the Hide server information in client user interface and Hide domain list in
client user interface seings in Horizon Administrator. These global seings are available in Horizon 7
version 7.1 and later. For information about conguring global seings, see the View Administration
document.
To authenticate when the Domain drop-down menu is hidden, users must provide domain information
by entering their user name in the format domain\username or username@domain in the User name text
box.
I If you enable the Hide server information in client user interface and Hide domain list
in client user interface seings and select two-factor authentication (RSA SecureID or RADIUS) for the
Connection Server instance, do not enforce Windows user name matching. Enforcing Windows user
name matching will prevent users from being able to enter domain information in the user name text
box and login will always fail. For more information, see the topics about two-factor authentication in
the View Administration document.
Using Embedded RSA SecurID Software Tokens
If you create and distribute RSA SecurID software tokens to end users, they need enter only their PIN, rather
than PIN and token code, to authenticate.
Setup Requirements
You can use Compressed Token Format (CTF) or dynamic seed provisioning, which is also called CT-KIP
(Cryptographic Token Key Initialization Protocol), to set up an easy-to-use RSA authentication system. With
this system, you generate a URL to send to end users. To install the token, end users paste this URL directly
into Horizon Client on their client devices. The dialog box for pasting this URL appears when end users
connect to Connection Server with Horizon Client.
After the software token is installed, end users enter a PIN to authenticate. With external RSA tokens, end
users must enter a PIN and the token code generated by a hardware or software authentication token.
The following URL prexes are supported if end users will be copying and pasting the URL into
Horizon Client when Horizon Client is connected to an RSA-enabled Connection Server instance:
n
viewclient-securid://
n
http://127.0.0.1/securid/
End users can install the token by tapping the URL. Both prexes viewclient-securid:// and
http://127.0.0.1/securid/ are supported. Note that not all browsers support hyperlinks that begin with
http://127.0.0.1. Also some le browsers, such as the File Manager app on the ASUS Transformer Pad,
cannot link the SDTID le with Horizon Client.
For information about using dynamic seed provisioning or le-based (CTF) provisioning, see the Web page
RSA SecurID Software Token for iPhone Devices at hp://www.rsa.com/node.aspx?id=3652 or RSA SecurID
Software Token for Android at hp://www.rsa.com/node.aspx?id=3832.
Instructions to End Users
When you create a CTFString URL or CT-KIP URL to send to end users, you can generate a URL with or
without a password or activation code. You send this URL to end users in an email that must include the
following information:
n
Instructions for navigating to the Install Software Token dialog box.
Tell end users to tap External Token in the Horizon Client dialog box that prompts them for RSA
SecurID credentials when they connect to a Connection Server instance.
Chapter 1 Setup and Installation
VMware, Inc. 9