> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # VMware Horizon View This procedure describes how to integrate a VMware Horizon View and Identity as a Service. Although this document specifically covers the VMware View KVM appliance (v), the information provided applies to all VMware View Series appliances using the Device Manager software. The aim of this integration is to provide strong, second-factor authentication for your VMware View Series appliance solution using Identity as a Service. The VMware Horizon View software supports the Identity as a Service authentication methods and authentication protocols listed in the table below. The capabilities may depend on the Identity as a Service configuration, or the setup of other 3rd party authentication resources (Active Directory, for example). ## Supported authentication methods | Authentication method | Notes | Supported protocols | | ------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------- | | Password | Password authentication is first-factor authentication with Identity as a Service password feature. | PAP, CHAP | | RADIUS | RADIUS authentication is first-factor authentication with a RADIUS server. | PAP, CHAP | | External | External authentication is first-factor authentication with an LDAP-compliant directory or a Windows domain controller through Kerberos. | PAP, CHAP | | Grid | Two-step authentication only. | PAP, CHAP | | Token | Identity as a Service supports response-only tokens. One-step and Two-step authentication (including push). | PAP, CHAP | | Temporary Access Code | Grid or token authentication must be configured. | PAP, CHAP | | One-time password | Two-step authentication only. | PAP, CHAP | | Knowledge-based questions and answers | The RADIUS proxy only supports a single question and answer. Two-step authentication only. | PAP, CHAP | | Mobile ST | Mobile Soft Token Push authentication (supports response-only tokens for second-factor authentication). | PAP, CHAP Classic token authentication for fallback. | note VMWare Horizon View supports PAP and CHAP only. ## Prerequisites Complete the following steps before integrating your authentication system with Identity as a Service: - Install and configure your first-factor authentication resource using the documentation provided by the vendor. The first-factor authentication resource can be a RADIUS server or an external authentication resource (a Local DB, LDAP-compliant directory or Windows domain controller through Kerberos). - Install and configure the RADIUS appliance using the documentation provided by the vendor. The device must be able to route traffic before integrating with Identity as a Service. - Install and configure Identity as a Service and an Identity as a Service Gateway (containing a RADIUS proxy agent). Take note of the shared secrets, IP addresses, and ports you use. You need this information to configure the RADIUS appliance and first-factor authentication resource. - If you want to configure your RADIUS appliance and first-factor authentication resource to recognize Identity as a Service user groups, you must define the Identity as a Service user groups first. ## Integrate VMware Horizon View Complete the following to integrate VMware Horizon View with IDaaS. ### Step 1: Configure IDaaS as a client on VMware Horizon View as an AAA client This procedure assumes that you have already configured vCenter Server and VDI resource pool in VMware Horizon View server. Configure Identity as a Service on VMware Horizon View as an AAA client: 1. Open a browser and enter ****, or go to **Start > VMware > Horizon8 Administrator Console** and open the VMware Horizon View Administrator Console. note You must enter https:///admin (for example, ) to open the VMware Horizon View admin console on different windows or computers, where the IP address is the Windows server 2012 static IP address. 2. When the VMware login page appears, sign in: - In the **User Name** field, enter **administrator**. - In the **Password** field, enter the Active Directory Server administrator password. - Select the required **Domain** from the drop-down list, for example, **IDaaSUSER**. - Click **Log In**. The **VMware View Administrator Dashboard** page appears. 3. In the dashboard, expand **View Configuration > Servers**, then select the **Connection Servers** tab. 4. Select the **Connection Server** from the list and click **Edit** to open the **Edit Connection Server Settings** page. 5. Open the **Authentication** tab and from the **Advanced Authentication** **2-factor authentication** drop-down list, select **RADIUS**. Configure the authentication options: - Select the **Enforce 2-Factor and Windows user name matching** check box to require the Entrust username value to match your Active Directory username (including any Realm prefix and suffix). Clear the check box to allow different usernames. - Select **Use the same user name and password for RADIUS and Windows authentication** if the Entrust password must match the Windows/AD password and the **Entrust** First-Factor authentication method is configured for External. If disabled, the user is prompted separately for Entrust password and multi-factor authentication and for the Windows/AD password. note For one-step authentication, **Use the same user name and password for RADIUS and Windows authentication** must be disabled. If enabled, the user receives an "Unknown user name or bad password" error and is prompted for the Active Directory password. When disabled, the user is prompted for the **Active Directory** password after Entrust multi-factor authentication. Create the RADIUS authenticator: 1. From the **Authenticator** drop-down list, select **Create New Authenticator**. 2. On the **Client Customization** page: - In the **Authenticator Name** field, enter a name that indicates the configuration is for Identity as a Service (for example, EntrustIDaaS). - Optional: In the **Description** field, add details about the RADIUS server. - In the **Username Label** field, enter the label that displays during log in. - In the **Passcode Label** field, enter the label that displays during log in. 3. On the **Add RADIUS Authenticator - Primary Authentication Server** page, enter: - **Hostname/Address**: the hostname or IP address of your Identity as a Service gateway. - **Authentication Port**: **1812**. - **Accounting Port**: leave blank. - **Authentication type**: select **PAP** or **CHAP**. - **Shared secret**: the RADIUS shared secret value you share with Identity as a Service. - **Server timeout**: a value greater than the IDaaS VPN timeout value if you are using TVS Authentication. - **Max attempts**: **10**. Leave other settings at their default values. 4. Optional: On the **Add RADIUS Authenticator – Secondary Authentication Server** page, enable **Use a secondary server if primary is unavailable** and provide the **Hostname/Address**, **Authentication port**, **Authentication type**, **Shared secret**, **Server timeout**, and **Max attempts**. 5. Click **Finish**, then **OK** to close the **Edit Connection Server Settings**. You have finished adding and configuring the RADIUS server settings in VMware View. ### Step 2: Add VMware Horizon View to Identity as a Service note Entrust recommends that when multiple RADIUS applications are configured that each RADIUS application is given a unique shared secret. Integrate a RADIUS client: 1. Click Menu icon **> Security > Applications**. The **Applications** page appears. 2. Click **Add** to open the **Select an Application Template** page. 3. Do one of the following: - Select **RADIUS and VPN Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS. - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS. 4. Click **VMware**. The **Add VMware** page appears. 5. Optional: Edit the **Application Name** and enter a **Description**. 6. Optional: Add a custom application logo: - Click Circle Plus icon next to **Application Logo**. - Click Arrow Up From Line icon to upload an image file, select it, and click **Open**. - Resize if required, then click **OK**. 7. Click **Next** to open the **Setup** page. 8. Click **Add** next to **Hosts** to add the host name of the VPN server. Enter the host name in the **Host** dialog box and click **OK**. Repeat to add more host names. 9. In the **Port** field, enter the port on which the RADIUS agent accepts messages. **Tip:** Do not enter 8443 as the port number for this application. Port 8443 is used by the Entrust Identity Enterprise agent in your Gateway. Attention: **T**he RADIUS agent uses the host name that sent a request and the port number that it received the request from to determine which RADIUS application made the request. Because of that: - Two RADIUS applications with the same port value cannot share any host names. - Two RADIUS applications that have one or more matching host names must have different port values. 10. In the **Shared Secret** field, enter the shared secret that is used by your VPN server. This is the RADIUS secret shared between your VPN server and the RADIUS server. The shared secret value must match a shared secret in your RADIUS client. 11. From the **Select RADIUS Agent** drop-down list, select the name of the Gateway containing the **RADIUS agent** to which this application will be assigned. 12. Optional: From the **Select RADIUS Attribute for IP Address** drop-down list, select the RADIUS attribute that corresponds to your IP location. 13. Set the following fields: - **Challenge Response Queue Max Time**: number of seconds that the RADIUS agent waits for a response to first-factor authentication (default 180 seconds). - **Challenge Response Queue Max Size**: maximum number of second-factor challenge requests allowed in the queue (default 1000; maximum 10,000). - **Request Cache Timeout**: number of seconds to cache requests (default 10 seconds). - **Character Set**: select the character set used to decode and encode string values in RADIUS messages (options include ISO-8859-1). 14. Optional: Select **Log RADIUS messages** to enable RADIUS message logging. 15. Optional: Configure Authentication Settings: - **Enable Push Authentication Fallback** and set the **Push Authentication Fallback Timeout** if needed. - **When authenticating the user will be asked to select their second-factor authenticator** to prompt users to select their second-factor authenticator; options depend on the resource rule. 16. Supported strings matched to authentication types: - Grid: grid - Knowledge-based Authentication: kba - One-time password: email, sms, voice - Smart Credential Push: scpush - Temporary Access Code: tac - Token: token - Token push: push 17. Additional options: - Select **Indicate if requests must include the message-authenticator attribute for incoming messages** to include the message-authenticator attribute for incoming messages. - Select **Indicate if requests must include the message-authenticator attribute for outgoing messages** to include the message-authenticator attribute for outgoing messages. - Select **Remove domain from user ID for incoming requests** to remove the domain value from the user ID during authentication when the user ID provided by the RADIUS client is in the format domain\username and the user ID in IDaaS is in the format username. - Select **Indicate if Active Directory password authentication requests are handled by the same Gateway Instance that initiated the request** to require Active Directory password authentication and change requests to be handled by a Gateway Instance in the same Gateway cluster that initiated it. If disabled, the request is handled by any Gateway Instance. - Select **Enable one-step multi-factor authentication** to allow the user to enter user ID, password, and token response in the password field. When enabled, second-factor authenticators available in the resource rule are limited to token and temporary access code. - Enter the **One-step multi-factor authentication security token length** for the token or temporary access code response when one-step multi-factor authentication is enabled. 18. Optional: Add Response Attributes to return information (such as user group information) to the VPN server after successful authentication. When adding response attributes, you can optionally add group filters. Users in IDaaS may belong to one of the following groups CANADA, US, UK, FRANCE. The VPN server may want the FilterID attribute returned from the IDaaS RADIUS agent to be the value NA or EUROPE, depending on whether the user is in NA (Canada, US) or Europe (UK, France). To do this, use a RADIUS attribute filter for the FilterID attribute with a Groups value with the following filters: - match CANADA, replace NA - match US, replace NA - match UK, replace EUROPE - match FRANCE, replace EUROPE Set the **Response Attributes** as follows: - Click Circle Plus icon **Add** to open the **Add a Response Attribute** dialog box. - Select the **RADIUS Attribute ID** from the drop-down list. The option you select depends on your VPN vendor. - Select the **Value Type** from the drop-down list. - To return a static value specified in the RADIUS attribute definition, select **Static**, enter a **Value**, and click **Add**. - To return the user's group membership, select **Group** and optionally: 1. **Click Add** to add filters. 2. **Enter the Match** and the **Replace** attribute filters. 3. **Click Add** to add more attribute filters. 4. If you add multiple filters, drag and drop them in order of preference. 5. Select **Stop after matching filter** if you only want one filter to return one value. Using the example above, list Canada and US first if you want NA to have preference over Europe. 6. For **Multiple Values Per Attribute**, enter the **Value Separator** and click **Add**. note If a user belongs to more than one group, you can either add a separate attribute to your RADIUS response for each group or you can combine all of the groups into a single attribute. For example, if the user belongs to G1,G2,G3 then you would - return a RADIUS response with three attributes - return a RADIUS response with one attribute and a value like "G1,G2,G3" where the comma is defined in the Value Separator setting or a value like "G1 G2 G3" where the Value Separator is defined as a space. Attention: The default group separator is a space. If you have group names that are separated by a space, use another separator, such as a comma. Repeat these steps to add more response attributes. 19. Optional: Configure the **EAP Settings** to set up the application to use the EAP RADIUS authentication protocol: - Select **EAP Enabled** to allow the RADIUS application to accept EAP messages. - When enabled, authentication messages with EAP content are treated as EAP requests. The application can accept only EAP authentication requests. - When disabled, incoming authentication requests are processed as standard RADIUS authentication requests (even if the request includes EAP content). In this case, the application can accept only standard RADIUS authentication requests. - Select the **EAP Protocol** from the drop-down list (options include PEAPv1 with GTC). - Select **Return MPPE Keys** to include the MPPE **recv** and **mppe send** keys in the Access-Accept message returned during a successful EAP authentication (enabled by default). - Select **Use PEAPv1 label when calculating MPPE Keys** to use the PEAPv1 label when calculating the **mmpe recv** and **mppe send** keys. - Leave **Minimum TLS Version**, **Maximum TLS Version**, and **Allow Weak Ciphers** at the default settings unless you need compatibility with older VPN servers. 20. Configure the **Deprecated Settings** if your RADIUS application is connected to a Gateway version older than 3.0. These values are required only for backwards compatibility. Select **No first-factor** as the **Authentication Type** for a RADIUS application that relies on a gateway RADIUS agent configured before release 3.1. note MSCHAPv2 authentication is not supported when **No first-factor** authentication is configured for the RADIUS application. 21. Click **Submit**. ### Step 3: Add a resource rule See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md). ### Step 4: Test the integration using the following procedures #### Test VMware Horizon View for one-step authentication 1. Launch the VMware Horizon View Client and initiate connection to the VMware Horizon Server. 2. In the **Username** field, enter the Identity as a Service username. 3. In the **Passcode** field, enter the Identity as a Service Password/TOKEN/Temporary Access Code. 4. Respond to the second-factor challenge and then click **Login**. You are prompted to enter the **Active Directory** password. 5. Enter the Active Directory password and then click **Login**. You are successfully logged in and now have access to the resources. note Make sure you have already unchecked **Use the same username and password for RADIUS and Windows authentication**. #### Test VMware Horizon View for two-step authentication 1. Launch the VMware Horizon View Client and initiate connection to the VMware Horizon Server. 2. In the **Username** field, enter the Identity as a Service username. 3. In the **Passcode** field, enter the Identity as a Service Password. 4. Respond to the second-factor challenge and then click **Login**. 5. Provide the second-factor authentication response (based on the configured second-factor authentication in Identity as a Service) and click **Login**. #### Test VMware Horizon View HTML access for one-step authentication 1. Access VMWare Horizon View in a web browser. 2. In the **Username** field, enter the Identity as a Service username. 3. In the **Passcode** field, enter the Identity as a Service Password/TOKEN/Temporary Access Code. 4. Respond to the second-factor challenge and then click **Login**. You are prompted to enter the **Active Directory** password. 5. Enter the Active Directory password and then click **Login**. You are successfully logged in and now have access to the resources. note Make sure you have already unchecked **Use the same username and password for RADIUS and Windows authentication**. #### Test VMware Horizon View HTML access for two-step authentication 1. Access VMWare Horizon View in a web browser. 2. In the **Username** field, enter the Identity as a Service username. 3. In the **Passcode** field, enter the Identity as a Service Password. 4. Respond to the second-factor challenge and then click **Login**. 5. Provide the second-factor authentication response (based on the configured second-factor authentication in Identity as a Service) and click **Login**.