User manual

For information about using dynamic seed provisioning or file-based (CTF) provisioning, see the Web page
RSA SecurID Software Token for iPhone Devices at http://www.rsa.com/node.aspx?id=3652 or RSA SecurID
Software Token for Android at http://www.rsa.com/node.aspx?id=3832.
Instructions to End Users
When you create a CTFString URL or CT-KIP URL to send to end users, you can generate a URL with or
without a password or activation code. You send this URL to end users in an email that must include the
following information:
n
Instructions for navigating to the Install Software Token dialog box.
Tell end users to tap External Token in the Horizon Client dialog box that prompts them for RSA
SecurID credentials when they connect to View Connection Server.
n
CTFString URL or CT-KIP URL in plain text.
If the URL has formatting on it, end users will get an error message when they try to use it in
Horizon Client.
n
Activation code, if the CT-KIP URL that you create does not already include the activation code.
End users must enter this activation code in a text field of the dialog box.
n
If the CT-KIP URL includes an activation code, tell end users that they need not enter anything in the
Password or Activation Code text box in the Install Software Token dialog box.
Configure Advanced SSL Options
You can select the security protocols that Horizon Client can use. You can also specify the cipher control
string.
Prerequisites
Verify the security protocol that the View server can use. If you configure a security protocol for
Horizon Client that is not enabled on the View server to which the client connects, an SSL error occurs and
the connection fails. For information about configuring the security protocols that are accepted by View
Connection Server instances, see the View Security document.
You should change the security protocols in Horizon Client only if your View administrator instructs you to
do so, or if your View server does not support the current settings.
Procedure
1 Tap the Settings (gear) icon in the upper-right corner of the Horizon Client screen and tap General
settings.
2 Tap Advanced SSL Options.
3 Make sure that Use Default Settings is unchecked.
4 To enable or disable a security protocol, tap the check box next to the security protocol name.
In Horizon Client 3.0 through 3.4, TLS v1.0 and TLS v1.1 are enabled by default. In Horizon Client 3.5,
TLS v1.0, TLS v1.1, and TLS v1.2 are enabled by default.
5 To change the cipher control string, replace the default string.
In Horizon Client 3.0 through 3.4, the default cipher control string is "AES:!aNULL:@STRENGTH". In
Horizon Client 3.5, the default cipher control string is "!aNULL:kECDH+AES:ECDH+AES:RSA
+AES:@STRENGTH".
6 (Optional) If you need to revert to the default settings, tap to select the Use Default Settings option.
7 Tap OK to save your changes.
Chapter 1 Setup and Installation
VMware, Inc. 9