4.5

n
In the locked.properties file on the View Connection Server or security server host, verify that the
useCertAuth property is set to true and is spelled correctly.
The locked.properties file is located in
install_directory \VMware\VMware View\Server\sslgateway
\conf. The useCertAuth property is commonly misspelled as userCertAuth.
n
If you configured smart card authentication on a View Connection Server instance, check the smart card
authentication setting in View Administrator.
a Select View Configuration > Servers, select the View Connection Server instance, and click Edit.
b On the Authentication tab, verify that Smart card authentication is set to either Optional or
Required.
You must restart the View Connection Server service for changes to smart card settings to take effect.
n
If the domain a smart card user resides in is different from the domain your root certificate was issued
from, verify that the user’s UPN is set to the SAN contained in the root certificate of the trusted CA.
a Find the SAN contained in the root certificate of the trusted CA by viewing the certificate properties.
b On your Active Directory server, select Start > Administrative Tools > Active Directory Users and
Computers.
c Right-click the user in the Users folder and select Properties.
The UPN appears in the User logon name text boxes on the Account tab.
n
If smart card users use the PCoIP display protocol to connect to View desktops, verify that the View Agent
PCoIP Smartcard subfeature is installed on desktop sources. The PCoIP Smartcard subfeature lets users
authenticate with smart cards when they use the PCoIP display protocol.
NOTE The PCoIP Smartcard subfeature is not supported on Windows Vista.
n
Check
the log files in
drive :\Documents and Settings\All Users\Application Data\VMware\VDM\logs on
the View Connection Server or security server host for messages stating that smart card authentication is
enabled.
Using Smart Card Certificate Revocation Checking
You can prevent users who have revoked user certificates from authenticating with smart cards by configuring
certificate revocation checking. Certificates are often revoked when a user leaves an organization, loses a smart
card, or moves from one department to another.
View supports certificate revocation checking with certificate revocation lists (CRLs) and with the Online
Certificate Status Protocol (OCSP). A CRL is a list of revoked certificates published by the CA that issued the
certificates. OCSP is a certificate validation protocol that is used to get the revocation status of an X.509
certificate.
You can configure certificate revocation checking on a View Connection Server instance or on a security server.
When a View Connection Server instance is paired with a security server, you configure certificate revocation
checking on the security server. The CA must be accessible from the View Connection Server or security server
host.
You can configure both CRL and OCSP on the same View Connection Server instance or security server. When
you configure both types of certificate revocation checking, View attempts to use OCSP first and falls back to
CRL if OCSP fails. View does not fall back to OCSP if CRL fails.
n
Logging in with CRL Checking on page 128
When you configure CRL checking, View constructs and reads a CRL to determine the revocation status
of a user certificate.
Chapter 7 Setting Up User Authentication
VMware, Inc. 127