6.1

Horizon vRealize Orchestrator Plug-In Architecture
vRealize Orchestrator and vRealize Automation provide the architecture that supports the
Horizon vRealize Orchestrator plug-in functions.
vRealize Orchestrator plug-ins allow seamless automation between the software environment in which the
workflows are executed and the products with which the workflows interact. With the
Horizon vRealize Orchestrator plug-in, workflows can be exposed natively, through the vSphere Web
Client, to delegated administrators, and through the vRealize Automation service catalog. Although
entitlement, scheduling, and execution of workflows are exposed through the vSphere Web Client and
vRealize Automation, you can customize and configure the workflows only in the vRealize Orchestrator
client.
The following diagram illustrates the Horizon vRealize Orchestrator plug-in architecture.
Figure 1‑1. Horizon vRealize Orchestrator Plug-In Architecture
Self-service
request and approval
multi-tenancy
vRealize Automation
service catalog
Run and schedule
workflows
vSphere Web Client
Install and customize
workflows
vRO Orchestrator
Self-service for
EU and DA
View management
and automation
Horizon vRO
plugin
IT
admin
End
users
IT
admin
VMware
Horizon vRealize Orchestrator Security Model
The Horizon vRealize Orchestrator plug-in uses a trusted account security model. The administrator
provides the credentials to the initial configuration between the View pod, the Horizon Air tenant, and the
plug-in, and that trusted account is the security context that all workflows use between
vRealize Orchestrator and VMware Horizon 6.
Additional levels of permissions also restrict which users can see and edit the workflows within
vRealize Orchestrator. All Horizon vRealize Orchestrator plug-in workflows must be explicitly configured
for execution. Access to the workflows requires both the permissions and the vRealize Orchestrator client
interaction with the client.
In addition, the third level of security is an access layer between where the workflows are executed, in
vRealize Orchestrator, and where they are exposed to delegated administrators and end users, in the
vSphere Web Client and vRealize Automation.
n
Administrators use the vCenter Single Sign-On implementation to allow access by users or groups to
run workflows within vSphere Web Client.
Chapter 1 Introduction to the Horizon vRealize Orchestrator Plug-In
VMware, Inc. 11