4.5

n
Assign the "Internal" tag to the desktop pools that should be accessible only to internal users.
n
Assign the "External" tag to the desktop pools that should be accessible only to external users.
External
users cannot see the desktop pools tagged as Internal because they log in through the View Connection
Server tagged as External, and internal users cannot see the desktop pools tagged as External because they log
in through the View Connection Server tagged as Internal. Figure 6-1 illustrates this configuration.
Figure 6-1. Restricted Entitlement Configuration
DMZ
external network
remote
View Client
View
Connection
Server
Tag: “External”
desktop pool A
Tag: “External”
View
Security
Server
VM VM
VM VM
local
View Client
View
Connection
Server
Tag: “Internal”
desktop pool B
Tag: “Internal”
VM VM
VM VM
You can also use restricted entitlements to control desktop access based on the user-authentication method
that you configure for a particular View Connection Server instance. For example, you can make certain
desktop pools available only to users who have authenticated with a smart card.
Tag Matching
The
restricted entitlements feature uses tag matching to determine whether a View Connection Server instance
can access a particular desktop pool.
At the most basic level, tag matching determines that a View Connection Server instance with a specific tag
can access a desktop pool that has the same tag.
The absence of tag assignments can also affect whether a View Connection Server instance can access a desktop
pool. For example, View Connection Server instances that do not have any tags can only access desktop pools
that also do not have any tags.
Table 6-1 shows how the restricted entitlement feature determines when a View Connection Server can access
a desktop pool.
Table 6-1. Tag Matching Rules
View Connection Server
Desktop Pool Access Permitted?
No tags No tags Yes
No tags One or more tags No
Chapter 6 Entitling Users and Groups
VMware, Inc. 115