hi my name is Peter Bjork and i'm a
principal architect at VMware in this video i'll cover how to
integrate Workspace ONE Access with VMware Horizon VMware Horizon
is VMware's published virtual desktop and application solution allowing for
remoting windows desktop and apps running protected in the data center
to any device integrating Workspace ONE Access with Horizon
will provide your end users with easy access to their Horizon entitlements
from within the application catalog as well
as providing single sign-on both for desktops and published applications
let's first cover some communication flows beginning with the entitlement
synchronization it is the Workspace ONE Access connector
who performs the synchronization of horizon entitlements to access
it is also important that you synchronize users from the same active
directory as your Horizon environment is connected
to Access will not manage the Horizon
entitlements but read and display them in the catalog
you configure the entitlements in the Horizon admin console
the launch of a Horizon resource flow is somewhat different than
any other application types within Access
the user starts with logging into Access and when requesting a Horizon resource
Workspace ONE Access generates a SAML artifact message
the artifact is sent via the user's device and Horizon client
to the Horizon connection server now the connection server sends an
artifact resold message to Workspace ONE Access service Access
validates the artifact and delivers a SAML assertion to the
connection server now the connection server knows who the user
is and issues a connection string which tells the Horizon client to which
resource to connect to you may or may not place a Unified
Access Gateway in front of your connection server
with Unified Access Gateway deployed the communication between the client
and the connection server is through the Unified Access Gateway
next let's have a look at how we can achieve single sign-on
when it comes to performing an interactive log on to windows you have
basically two options you either provide a username and
password or you present a valid user certificate
with this in mind it is easier to understand the many different single
sign-on or sso options when integrating Horizon and
Access
Workspace ONE Access can cache the user's password
and deliver it to verizon for a single sign-on access
there is a global setting under preferences in access called enable
password caching once enabled access can store
the user's password for a period of the user's active session with access
access has some other horizon instance specific
sso settings like smart card and true sso
but for now let's leave them disabled so with this setting let's have a look
at the flow users log in to access if using password
authentication method in other words logging in using their ad
username and password access will cache the password in an
encrypted format and in memory only when a user launches
a Horizon resource access generates the SAML artifact which
is sent via the client to Horizon connection server connection
server performs the saml artifact resolved
and access will reply with a sample assertion containing the user principal
name or upn and the user's password this
communication is backend to backend and never passes the client as well as
protected using https now the connection server
has the password so it can perform an interactive logon of the user
and it sends a connection string to the client
so it can connect to the right resource allowing access to cache the password
allows for a single sign-on like experience for the users
but it does allow access to cache the password for the time of the active user
session and this might not be what you want if you
turn off password caching and will still leave the horizon
instance specific authentication settings disabled
access will prompt the users for their aed password
each time they try to launch a Horizon resource
but we have other options for a good user experience
than relying on password we have the smart card authentication
and true sso settings enabling smart card authentication will
tell access to not get involved in the flow of authentication
but let's have a look at the flow the user logs into access
which method doesn't matter in this case when the user requests a
Horizon resource Access simply sends a launch message to the client
access doesn't prompt for password or anything
connection server still retrieves the SAML assertion so
it knows which resource the user is looking for
but when the client connects to horizon it is expected to present a certificate
and make use of the native certificate authentication support within horizon
once successfully authenticated into horizon
the client gets a connection string and connects to the resource
by activating the smart card authentication Access isn't
involved in the act of authenticating the user to horizon
at all and therefore no need for access to know the user's password
access is simply providing a catalog for easier finding
and accessing horizon resources if we take a look at the user experience
it could look something like this the user logs in and
launches their horizon resource if the client isn't configured with a
certificate the horizon client authentication dialog
box will be presented and the user must manually type in his or her credentials
before granted access to the resource but
with a certificate in place there wouldn't be any prompt for user
credentials of course and last we have true sso true sso
is a feature of horizon which allows for horizon to accept a similar assertion
without a password and still achieving an interactive logon
and Workspace ONE Access supports this feature of course
for horizon true sso to work there are a couple more components
involved in the flow we have the horizon enrollment server
as well as the microsoft certificate service or
microsoft certificate authority it doesn't matter what method of
authentication the user used to login to access
when the user launches a horizon resource
access generates a SAML artifact and horizon performs a SAML artifact resolve
the connection server checks the user and if not already available
the connection server will request a certificate from the enrollment server
the enrollment server requests a short-lived certificate on behalf of the
user from the microsoft certificate authority
the certificate is delivered to the connection server
and is placed on the resource the user wants to access
at the same time the client receives the connection string
and references the certificate to perform a certificate-based
authentication into active directory using true sso
allows for true single sign-on using the SAML protocol
any authentication method into access is supported
and since no password is used no need for password caching
and true sso delivers the most seamless method of accessing horizon resources
when requesting access users gets immediate
and seamless access if true sso isn't configured correctly
on the horizon side for example users will get prompted by the local
authentication prompt of the resource one access supports the use of the
native horizon client as well as the web client users can
change their preferred clients under settings using the horizon client
will of course launch the native client and if changed to browser the horizon
resource will be launched in a new tab in the user's browser but
how do we configure the integration let's start with the horizon admin
console and the connection server settings
here you can specify the authentication settings
you can choose between no SAML support or allowing or requiring SAML
allowing SAML will support both traditional native horizon methods of
authentication as well as from access using SAML
when enabling SAML support you must establish the saml trust
you simply add a SAML authenticator by providing a name for it
and point to the idp metadata url if you require SAML authentication you
can also turn on Workspace ONE mode this means
horizon will support an sp-initiated flow
forcing users trying to connect to horizon directly
to be redirected to access for authentication
Workspace ONE mode will allow for enforcements
of Workspace ONE Access conditional access policies
in Workspace ONE Access admin console you add horizon integration
in the catalog virtual apps collection when adding a new horizon collection you
start by giving it a name and then select which of your connectors
you want to perform the synchronization and in which order of priority
next you add your pods you enter the fqdn of one of your connection servers
this is the connection server's own fqdn not a load balancer address
you must provide a horizon admin console user and
its password smart card and true sso we already covered
the sync local assignments specifies if you want to synchronize
this connection server's local entitlements
or only the global entitlements if you have implemented horizon cloud
pod architecture you can enable support of it here and
add federation settings you provide a name for the setting and
the client access fqdn the client access fqdn is often your
global load balancer last you choose which parts to include
and in which failover order the sync frequency specifies how often
access will synchronize horizon entire elements new changes are
of course not reflected in access until synced sync duplicated apps
specifies if you want to sync the same application from multiple horizon
servers or only soon can display one activating
this feature might result in duplicates of applications within the catalog
and might confuse users next is how the application will be
activated for users by themselves or automatic it is really
only if you are planning on using an approval flow you should pick user
activated and last the default launch client the
native client or browser users can always change their own
default client under their personal settings
but this is what will be the client used if they do not
specify any once synced all entitlements can be
viewed under catalog virtual apps and here you can add
categories and change access policies for
individual resources but we're not quite done yet we must
cover the network ranges and the launch urls or client access fqdn
in the virtual app collection and clicking on a collection
not editing it you will see the edit network range button
you can specify what fqdn clients will use to connect your horizon
on a per network basis ok let me try to explain when you configure
horizon synchronization you point to a single horizon connection
server and its own fqdn but most likely
your users should connect to a different fqdn
most likely a load balancer and or a unified access gateway
the fqdn to be used is what you configure as the client
access fqdn and this is what Access will redirect the user's clients to
let's say this was the network range or ranges
but you may very well want to send internal users to another load balancer
or sets of unified access gateways this is easily
done by creating new network ranges and
specified different client access fqdn's but you may wonder what is these
JWT settings well JWT stands for JSON web tokens
and JWT is often pronounced jot so this basically means that we can wrap
the sample artifact sent to horizon in a json web token
providing extra security wrapping the artifact in a jot message looks like
this user requests a horizon resource access
generates the artifact and wraps it in a json web
token the token allows for unified access gateway to validate the message
before stripping the jot away and only sending the artifact
to the horizon connection server providing an extra layer of validation
not allowing for rogue artifacts to hit the connection server
you configure the jot wrapping in access by enabling it
and provide an audience that will state to whom this chat message is intended
and since access signs the message UAG will know it originated from a trusted
entity in unified access gateway you first need
to configure the jots settings you provide a name and upload the access
public signing key you can add a url pointing to the key so
if changed uag can automatically update it
next in unified access gateway and the horizon
edge service setting you reference the newly created jot
setting and specify the audience the same as you specified in access
and that was it iIhope this video helped you configure Horizon and Access
integration for more technical content please visit
techzone.vmware.com