Installation and Setup Guide

n
If you are connected to a remote desktop or application from an Amazon Fire TV device, you must use
a pop-up menu to display Horizon Client Seings and to disconnect from the remote desktop or
application. On a remote control or external keyboard, press the Menu buon to display the pop-up
menu.
Using Embedded RSA SecurID Software Tokens
If you create and distribute RSA SecurID software tokens to end users, they need enter only their PIN, rather
than their PIN and a token code, to authenticate.
Setup Requirements
You can use Compressed Token Format (CTF) or dynamic seed provisioning, which is also called CT-KIP
(Cryptographic Token Key Initialization Protocol), to set up an easy-to-use RSA authentication system. With
this system, you generate a URL to send to end users. To install the token, end users paste this URL directly
into Horizon Client on their client devices. The dialog box for pasting this URL appears when end users
connect to a Connection Server instance with Horizon Client.
Horizon Client also supports le-based provisioning. When a le-based software token is issued to a user,
the authentication server generates an XML-format token le called an SDTID le. Horizon Client can
import the SDTID le directly. Users can also launch Horizon Client by tapping the SDTID le in a le
browser.
After the software token is installed, end users enter a PIN to authenticate. With external RSA tokens, end
users must enter a PIN and the token code generated by a hardware or software authentication token.
The following URL prexes are supported for end users that copy and paste the URL into Horizon Client
when Horizon Client is connected to an RSA-enabled Connection Server instance:
n
viewclient-securid://
n
http://127.0.0.1/securid/
End users can install the token by tapping the URL. Both the viewclient-securid:// and
http://127.0.0.1/securid/ prexes are supported. Not all browsers support hyperlinks that begin with
http://127.0.0.1. Some le browsers, such as the File Manager app on the ASUS Transformer Pad, cannot
link the SDTID le with Horizon Client.
For information about using dynamic seed provisioning or le-based (CTF) provisioning, see the Web page
RSA SecurID Software Token for iPhone Devices at hp://www.rsa.com/node.aspx?id=3652 or RSA SecurID
Software Token for Android at hp://www.rsa.com/node.aspx?id=3832.
Instructions to End Users
When you create a CTFString URL or CT-KIP URL to send to end users, you can generate a URL with or
without a password or activation code. You send this URL to end users in an email that must include the
following information:
n
Instructions for navigating to the Install Software Token dialog box.
Tell end users to tap External Token in the Horizon Client dialog box that prompts them for RSA
SecurID credentials when they connect to a Connection Server instance.
n
CTFString URL or CT-KIP URL in plain text.
If the URL has formaing on it, end users will get an error message when they try to use it in
Horizon Client.
n
Activation code, if the CT-KIP URL that you create does not already include the activation code.
End users must enter this activation code in a text eld of the dialog box.
Chapter 1 Setup and Installation
VMware, Inc. 21