Workspace ONE Access Integration with Horizon Blast (optional)
In this section we are going to enhance the integration experience between VMware Identity Manager, our Horizon Infrastructure and the Horizon Blast Protocol.
The steps in this lab are outlined in VMware KB 2088354
- On your ControlCenter server open your Chrome browser and navigate to your WorkspaceOne Access custom url.
- Log in as User4 to euc-livefire.com domain
- Navigate to Apps / All apps and click on Open next to W10-PD1
- Notice the browser gets stuck on an IP address redirection. This affects the single sign-on user experience. The objective of this session is to enhance this.
- Cancel the session by closing your Browser
- On your ControlCenter server, select and open the Remote Desktops folder and login to W10Parent01a as euc-livefire\administrator with the password VMware1!
- Select and right click the Start button and select Run
- In the Run box, in the Open: section type mmc and select OK
- In the MMC Console window select File > Add / Remove Snap-in, select Certificates and select Add> . On the Certificates snap-in window, select the Computer account radio button select `Next accept the default on the select Computer window
- Select Finish, select OK to close the Add or Remove Snap-ins page
- On the Certificates Snap-in, expand Certificates (Local Computer) > Personal > Certificates
- Notice there is a default Blast certificate on the local Computer. This as a result of the Horizon Agent being installed on this system. We will replace this default certificate with a CA signed certificate.
- Select the Blast certificate right click and select Delete . When prompted select Yes
- In the mmc under Personal, select the Certificates folder and right-click and select All Tasks > select Import
- On the Welcome to the Certificate Import Wizard select Next
- On the File to Import window Paste the following path in under File Name \\cs1-pd1.euc-livefire.com\software\certificates and select Browse
- In the file extension section above Open, select the drop down arrow , select Personal Information Exchange
- In the Name field select the wildcard.pfx certificate and select Open
- On the File to Import window select Next
- On the Private Key protection window under Password: type VMware1! Under Import options: select the Mark the key as exportable. This will allow you to back up or transport your keys at a later time check box and select Next
- On the Certificate Store window, accept the default and select Next
- On the Completing the Certificate Import Wizard page select Finish.
- When the import was succesful window appears select OK
Notice the entire certificate chain has been imported. We are now going to register this certificates' thumbprint in the registry
- Select and double click the *.euc-livefire.com certificate.
- Select the Details tab, scroll down until you find Thumbprint. Select Thumbprint and then select the code behind the Thumbprint and copy by typing Ctrl + A and then Ctlr + C on your keyboard
- Right click the start menu and select Run. Type notepad.exe
- After Notepad has launched, using your keyboard, type Ctrl + V. You will notice the Thumbprint has no spaces
- For every 2 Characters of the Thumbprint, create a space except on the last 2 characters. Using the keyboard, copy the Thumbprint selecting typing Ctrl + A and Ctrl + C
- Select the Start button, right-click select Run and type regedit.exe and select Ok.
- Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config registry key.
- Select the SslHash value
- Right click and select Modify
- In the Edit String window, under the Value data: field, paste the spaced Thumbprint
5a 78 89 3c 8a 2a e5 73 bd a3 d2 20 9a 51 79 fc f1 4f fd 36
4. Select OK, Close the registry editor
- On the W10Parent-01a virtual machine select the start menu and shut down the system.
- On the ControlCenter Server desktop, open the Chrome browser to launch the vSphere client by using the vSphere bookmark
- to allow flash click on the "not secure" portion of your address bar (or padlock icon) and select Allow from the flash dropdown menu.
- Login with the username section type firstname.lastname@example.org in the password section type VMware1!
- In the vCenter inventory, select the w10Parent01a virtual machine, right click > Select Snapshots > Take Snapshot
- In the Take VM Snapshot for w10Parent01a window. In the Name box type Blast Certificate and select OK
- On the ControlCenter Desktop, open the Chrome browser and on the favorites bar select the Horizon Shortcut
- In the User Name section type Administrator, In the password section type VMware1! and select Log in
- Under the Inventory, expand Catalog and select Desktop Pools, to the right select the W10-InstantClone Desktop Pool
- Double click the W10-InstantClone desktop pool, to the right of Status, select the drop down arrow next to Push Image and select Schedule.
- On the Schedule Push Image window, select the Blast Certificate snapshot and select Next
- On the Scheduling window select the Force users to log off radio button and select Next
- On the Ready to Complete window, select Finish
The update of the instant clones will take about 25 minutes.
VERY IMPORTANT! Do not move on to the Broker configuration using ADSIEDIT until this process updating the Instant Clone Machines is complete.
In the meantime : We will now repeat this process of replacing the Blast certificate for the RDS based Host so that we also have a seamless user experience when launching RDS based Applications that are Published, then synced and launched through VMware Identity Manager.
Replacing the RDS Host Certificate
1. On your ControlCenter server open your Remote Desktops Folder and launch the RDSH01a.RDP client. Login as Administrator@euc-livefire.com with the password VMware1!
2. Right-click the Start Button and select Run
3. In the Run Console type MMC
4. In the MMC window, select File > Add/ Remove Snap-in
5. In the Available Snap-ins window select Certificates and select Add
6. In the Certificates Snap-in windows select the Computer account radio button and select Next
7. On the Select Computer window, select Finish
8. Select Ok to close the Add / Remove Snap-ins Window
9. Expand Certificates (Local Computer) > Personal > Certificates
10. Select and right-click the Blast certificate and select Delete
11. When prompted in the Certificates window select Yes
12. In the Inventory pane select Certificates and right-click, select All Tasks, select Import
13 On the Certificate Import Wizard window select Next
14. In the Certificate to Import window select Browse
15. In the Open window browse to \\cs1-pd1.euc-livefire.com\software\certificates
16. In the Open window ensure that Personal information exchange file type is selected and select the Wildcard.pfx certificate and select Open
17. In the File to Import window select Next
18. In the Private key Protection window, type the password vmware and select the Private key exportable... check box,
19. Ensure the Include All extended properties check box is selected
20. Select Next
21. On the Certificate Store window select Next
22. On the Completing the Certificate Import Wizard window select Finish
23. On the Import was succesful window select OK
Notice you have a Wildcard Certificate imported along with the Key Chain. This is a requirement for this to work.
24. Select the *.euc-livefire.com certificate and double-click the certificate to open the Certificate window
25. Select the Details tab and scroll down to Thumbprint
26. Select Thumbprint and then select the code behind the Thumbprint and copy by typing Ctrl + A and then Ctlr + C on your keyboard
30. On your RDSH-01A Server. Select the Start button, right-click select Run and type regedit.exe and select Ok.
31. Navigate to the HKEY_LOCAL_MACHINE\SOFTWARE\VMware, Inc.\VMware Blast\Config registry key.
32. Select the SslHash value
33. Right click and select Modify
34. In the Edit String window, under the Value data: field, paste the spaced Thumbprint
5a 78 89 3c 8a 2a e5 73 bd a3 d2 20 9a 51 79 fc f1 4f fd 36
35. Select OK, Close the registry editor
36. Close all Consoles and disconnect your RDP session on the RDSH-01a server
Broker Configuration Using ADSIEDIT
In the first stage we replaced the Blast self-signed Certificate with a CA signed Certificate. We will now proceed to the second Phase of this process, which requires us to make an edit in the LDS database on the Broker. A reboot is required.
NB! Do not perform the reboot until you are sure that your Instant Clone provisioning has been successful. On does this by check the summary tab on the Desktop Pool itself.
- On the ControlCenter server, select the Remote Desktops folder, select the cs1-pd1 RDP client and log in as Euc-livefire.com\administrator with the password VMware1!
- On the cs1-pd1 desktop select the Start menu, right click and select Run. In the Run window, type adsiedit.msc, select OK
- Select and expand the object OU=Properties, expand and select OU=Global select CN = Common
- Select and right click CN = Common and select Properties
- Scroll down and select pae-PreferDNS and select Edit
- In the Integer Attribute Editor set the value to 1. Select OK. Select OK to close the CN = Common Properties window. Close the Adsiedit window.
- Shut down and restart CS-PD1
- On the ControlCenter server, open the Chrome browser in incognito mode, navigate to your custom workspace one access url , on the Select your Domain window. make sure euc-livefire.com is selected and click Next
- In the Username section Log in as user4 with the password VMware1! select Sign In
- In the CATALOG area, select Open to launch the W10-PD1 desktop pool
- Notice we now have a single sign-on experience that is seamless without hiccup