5.2

10 Click SAML 2.0 Authenticators.
11
Select the SAML server that you modified or added, verify the details, and click OK.
The View dashboard now displays the SAML 2.0 authenticator in a Healthy condition, which is indicated by
a green icon.
You can configure each View Connection Server instance with a Required, Allowed, or Disabled
authentication setting, depending on specific customer requirements.
Using Smart Card Authentication
You can configure a View Connection Server instance or security server so that View desktop users can
authenticate by using smart cards. Smart cards are sometimes referred to as Common Access Cards (CACs).
A smart card is a small plastic card that contains a computer chip. The chip, which is like a miniature computer,
includes secure storage for data, including private keys and public key certificates.
With smart card authentication, a user inserts a smart card into a smart card reader attached to the client
computer and enters a PIN. Smart card authentication provides two-factor authentication by verifying both
what the user has (the smart card) and what the user knows (the PIN).
See the VMware Horizon View Installation document for information on hardware and software requirements
for implementing smart card authentication. The Microsoft TechNet Web site includes detailed information
on planning and implementing smart card authentication for Windows systems.
Smart card authentication is not supported by View Client for Mac or View Administrator. See the VMware
Horizon View Architecture Planning document for complete information on smart card support.
Logging In with a Smart Card
When a user inserts a smart card into a smart card reader, the user certificates on the smart card are copied to
the local certificate store on the client system. The certificates in the local certificate store are available to all of
the applications running on the client computer, including the View client application.
When a user initiates a connection to a View Connection Server instance or security server that is configured
for smart card authentication, the View Connection Server instance or security server sends a list of trusted
certificate authorities (CAs) to the View client. The View client checks the list of trusted CAs against the
available user certificates, selects a suitable certificate, and then prompts the user to enter a smart card PIN. If
there are multiple valid user certificates, the View client prompts the user to select a certificate.
The View client sends the user certificate to the View Connection Server instance or security server, which
verifies the certificate by checking the certificate trust and validity period. Typically, users can successfully
authenticate if their user certificate is signed and valid. If certificate revocation checking is configured, users
who have revoked user certificates are prevented from authenticating.
Display protocol switching is not supported with smart card authentication. To change display protocols after
authenticating with a smart card, a user must log off and log in again.
Logging In to Local Desktops with Offline Smart Card Authentication
With offline smart card authentication, users can log in to a local desktop with a smart card when the desktop
is not connected to View Connection Server.
To use offline smart card authentication, users must use the same authentication method that they used to
authenticate to View Connection Server the last time they logged in. For example, if a user logged in with smart
card A, logged in again with password authentication, and then logged in a final time with smart card B, the
user must use smart card B to authenticate with offline smart card authentication.
Chapter 7 Setting Up User Authentication
VMware, Inc. 157