Installation and Setup Guide

After the software token is installed, end users enter a PIN to authenticate. With external RSA tokens,
end users must enter a PIN and the token code generated by a hardware or software authentication
token.
The following URL prefixes are supported for end users that copy and paste the URL into Horizon Client
when Horizon Client is connected to an RSA-enabled Connection Server instance:
n
viewclient-securid://
n
http://127.0.0.1/securid/
End users can install the token by tapping the URL. Both the viewclient-securid:// and
http://127.0.0.1/securid/ prefixes are supported. Not all browsers support hyperlinks that begin
with http://127.0.0.1. Some file browsers, such as the File Manager app on the ASUS Transformer
Pad, cannot link the SDTID file with Horizon Client.
For information about using dynamic seed provisioning or file-based (CTF) provisioning, see the Web
page RSA SecurID Software Token for iPhone Devices at http://www.rsa.com/node.aspx?id=3652 or RSA
SecurID Software Token for Android at http://www.rsa.com/node.aspx?id=3832.
Instructions to End Users
When you create a CTFString URL or CT-KIP URL to send to end users, you can generate a URL with or
without a password or activation code. You send this URL to end users in an email that must include the
following information:
n
Instructions for navigating to the Install Software Token dialog box.
Tell end users to tap External Token in the Horizon Client dialog box that prompts them for RSA
SecurID credentials when they connect to a Connection Server instance.
n
CTFString URL or CT-KIP URL in plain text.
If the URL has formatting on it, end users will get an error message when they try to use it in
Horizon Client.
n
Activation code, if the CT-KIP URL that you create does not already include the activation code.
End users must enter this activation code in a text field of the dialog box.
n
If the CT-KIP URL includes an activation code, tell end users that they need not enter anything in the
Password or Activation Code text box in the Install Software Token dialog box.
Configure Advanced TLS/SSL Options
You can select the security protocols and cryptographic algorithms that are used to encrypt
communications between Horizon Client and Horizon servers and between Horizon Client and the agent
in the remote desktop.
By default, TLSv1.0, TLSv1.1, and TLSv1.2 are enabled. SSL v2.0 and 3.0 are not supported. The default
cipher control string is "!aNULL:kECDH+AESGCM:ECDH+AESGCM:RSA+AESGCM:kECDH
+AES:ECDH+AES:RSA+AES".
VMware Horizon Client for Android Installation and Setup Guide
VMware, Inc. 23