{"id":53860,"date":"2022-07-26T09:00:17","date_gmt":"2022-07-26T07:00:17","guid":{"rendered":"https:\/\/nolabnoparty.com\/?p=53860"},"modified":"2026-04-29T12:24:20","modified_gmt":"2026-04-29T10:24:20","slug":"vmware-horizon-configure-smart-card-authentication","status":"publish","type":"post","link":"https:\/\/nolabnoparty.com\/en\/vmware-horizon-configure-smart-card-authentication\/","title":{"rendered":"VMware Horizon: configure smart card authentication"},"content":{"rendered":"<p><img decoding=\"async\" class=\"aligncenter wp-image-53861 size-full\" title=\"horizon-configure-smart-card-authentication-01\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-01.jpg\" alt=\"horizon-configure-smart-card-authentication-01\" width=\"602\" height=\"202\" \/><\/p>\n<p><a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-manage-outlook-ost-files\/\">VMware Horizon<\/a> can leverage smart card technology to <strong>better secure the authentication process<\/strong> when a user tries to access the entitled virtual desktop.<\/p>\n<p>If also Active Directory is configured to authenticate users through smart cards, users need to <strong>enter the PIN when requested<\/strong> and they can directly access the entitled virtual desktop making the login process faster and more secure.<!--more--><\/p>\n<p>&nbsp;<\/p>\n<h2>Pre-requisites<\/h2>\n<p>To implement smart card authentication in <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-grant-permissions-in-active-directory\/\">VMware Horizon<\/a>, you need the following prerequisites:<\/p>\n<ul>\n<li>A working public key infrastructure (PKI)<\/li>\n<li>Active Directory configured to authenticate users using smart cards<\/li>\n<\/ul>\n<p>&nbsp;<\/p>\n<h2>Export the root certificate from CA<\/h2>\n<p>If you have a working CA infrastructure, login to the server with the Certification Authority role and open the <strong>Certification Authority manager<\/strong>.<\/p>\n<p>Right click the Root CA item and select <strong>Properties<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53871 size-full\" title=\"horizon-configure-smart-card-authentication-03\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-03.jpg\" alt=\"horizon-configure-smart-card-authentication-03\" width=\"584\" height=\"258\" \/><\/p>\n<p>Go to <strong>General<\/strong> tab, select the certificate and click <strong>View Certificate<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53873 size-full\" title=\"horizon-configure-smart-card-authentication-04\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-04.jpg\" alt=\"horizon-configure-smart-card-authentication-04\" width=\"400\" height=\"537\" \/><\/p>\n<p>Go to <strong>Details<\/strong> tab and click <strong>Copy to File<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53875 size-full\" title=\"horizon-configure-smart-card-authentication-05\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-05.jpg\" alt=\"horizon-configure-smart-card-authentication-05\" width=\"405\" height=\"515\" \/><\/p>\n<p>Click <strong>Next<\/strong> in the <strong>Certificate Export Wizard<\/strong> page.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53877 size-full\" title=\"horizon-configure-smart-card-authentication-06\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-06.jpg\" alt=\"horizon-configure-smart-card-authentication-06\" width=\"537\" height=\"525\" \/><\/p>\n<p>Select <strong>Base-64 encoded X.509 (.CER)<\/strong> option and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53879 size-full\" title=\"horizon-configure-smart-card-authentication-07\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-07.jpg\" alt=\"horizon-configure-smart-card-authentication-07\" width=\"537\" height=\"525\" \/><\/p>\n<p>Enter the <strong>File name<\/strong> and click <strong>Next<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53881 size-full\" title=\"horizon-configure-smart-card-authentication-08\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-08.jpg\" alt=\"horizon-configure-smart-card-authentication-08\" width=\"537\" height=\"525\" \/><\/p>\n<p>Click <strong>Finish<\/strong> to export the certificate to the specified path.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53883 size-full\" title=\"horizon-configure-smart-card-authentication-09\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-09.jpg\" alt=\"horizon-configure-smart-card-authentication-09\" width=\"537\" height=\"525\" \/><\/p>\n<p>The certificate has been exported successfully. Click <strong>OK<\/strong>\u00a0to exit the wizard.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53885 size-full\" title=\"horizon-configure-smart-card-authentication-10\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-10.jpg\" alt=\"horizon-configure-smart-card-authentication-10\" width=\"179\" height=\"133\" \/><\/p>\n<p>Now we need to copy the exported root CA certificate and paste it into the Connection Server.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53887 size-full\" title=\"horizon-configure-smart-card-authentication-11\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-11.jpg\" alt=\"horizon-configure-smart-card-authentication-11\" width=\"675\" height=\"456\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Import the Root certificate into Horizon<\/h2>\n<p>Login to the <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-7-12-installing-connection-server-pt-1\/\">Connection Server<\/a> and <strong>paste the previously exported root certificate<\/strong>\u00a0anywhere in the server.<\/p>\n<p>Open the <strong>Command Prompt<\/strong> as <strong>Administrator<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53889 size-full\" title=\"horizon-configure-smart-card-authentication-12\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-12.jpg\" alt=\"horizon-configure-smart-card-authentication-12\" width=\"479\" height=\"323\" \/><\/p>\n<p>Go to the folder <em>Program Files\\VMware\\VMware View\\Server\\jre\\bin<\/em>.<\/p>\n<p><span style=\"color: #0000ff;\">C:\\&gt; cd \"Program Files\\VMware\\VMware View\\Server\\jre\\bin\"<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53891 size-large\" title=\"horizon-configure-smart-card-authentication-13\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-13-600x79.jpg\" alt=\"horizon-configure-smart-card-authentication-13\" width=\"600\" height=\"79\" \/><\/p>\n<p>Run the following command:<\/p>\n<p><span style=\"color: #0000ff;\">C:\\..&gt; keytool.exe -import -alias RootCA -file c:\\cert\\RootCA.cer -keystore truststorefile.key -storetype JKS<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53893 size-large\" title=\"horizon-configure-smart-card-authentication-14\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-14-600x87.jpg\" alt=\"horizon-configure-smart-card-authentication-14\" width=\"600\" height=\"87\" \/><\/p>\n<p>Enter a <strong>password for the certificate<\/strong> twice then press <strong>Enter<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53895 size-large\" title=\"horizon-configure-smart-card-authentication-14\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-15-600x530.jpg\" alt=\"horizon-configure-smart-card-authentication-14\" width=\"600\" height=\"530\" \/><\/p>\n<p>Type <strong>yes<\/strong> and press <strong>Enter<\/strong> to trust the certificate. The <strong>truststorefile.key file<\/strong> is created in the selected folder.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53897 size-large\" title=\"horizon-configure-smart-card-authentication-15\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-16-600x68.jpg\" alt=\"horizon-configure-smart-card-authentication-15\" width=\"600\" height=\"68\" \/><\/p>\n<p>Once the <em>truststorefile.key<\/em> has been created, you need to copy the file to the correct folder. <strong>Copy the truststorefile.key<\/strong> to the folder <em>C:\\Program Files\\VMware\\VMware View\\Server\\sslgateway\\conf\\<\/em>.<\/p>\n<p><span style=\"color: #0000ff;\">C:\\..&gt; copy truststorefile.key \"C:\\Program Files\\VMware\\VMware View\\Server\\sslgateway\\conf\\\"<\/span><\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53899 size-large\" title=\"horizon-configure-smart-card-authentication-16\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-17-600x54.jpg\" alt=\"horizon-configure-smart-card-authentication-16\" width=\"600\" height=\"54\" \/><\/p>\n<p>Now you need to <strong>edit the locked.properties<\/strong> file (create the file if it doesn't exist) located in the folder <em>C:\\Program Files\\VMware\\VMware View\\Server\\sslgateway\\conf\\<\/em> to add the configuration required to use the smart card authentication.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53901 size-large\" title=\"horizon-configure-smart-card-authentication-17\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-18-600x357.jpg\" alt=\"horizon-configure-smart-card-authentication-17\" width=\"600\" height=\"357\" \/><\/p>\n<p>Add the following rows to the <em>locked.properties<\/em> file:<\/p>\n<blockquote><p>trustKeyfile = truststorefile.key<br \/>\ntrustStoretype = jks<br \/>\nuseCertAuth = true<\/p><\/blockquote>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53903 size-full\" title=\"horizon-configure-smart-card-authentication-18\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-19.jpg\" alt=\"horizon-configure-smart-card-authentication-18\" width=\"600\" height=\"178\" \/><\/p>\n<p>Save the file and <strong>restart<\/strong> the <em>VMware Horizon View Connection Server<\/em> service.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53905 size-large\" title=\"horizon-configure-smart-card-authentication-19\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-20-600x342.jpg\" alt=\"horizon-configure-smart-card-authentication-19\" width=\"600\" height=\"342\" \/><\/p>\n<p>&nbsp;<\/p>\n<h4>Configure additional Connection Servers<\/h4>\n<p>If you have <strong>multiple Connection Servers<\/strong> configured in your <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-8-customize-the-login-page\/\">Horizon infrastructure<\/a>, you need to configure each Connection Server accordingly.<\/p>\n<p>From the configured Connection Server <strong>select and copy<\/strong> both <em>locked.properties<\/em> and <em>truststorefile.key<\/em> files.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53907 size-large\" title=\"horizon-configure-smart-card-authentication-20\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-21-600x379.jpg\" alt=\"horizon-configure-smart-card-authentication-20\" width=\"600\" height=\"379\" \/><\/p>\n<p>Login to the other Connection Servers and <strong>paste the files<\/strong> to the same folder <em>C:\\Program Files\\VMware\\VMware View\\Server\\sslgateway\\conf\\<\/em>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53909 size-large\" title=\"horizon-configure-smart-card-authentication-21\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-22-600x363.jpg\" alt=\"horizon-configure-smart-card-authentication-21\" width=\"600\" height=\"363\" \/><\/p>\n<p>Restart the <em>VMware Horizon View Connection Server<\/em> service.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53911 size-large\" title=\"horizon-configure-smart-card-authentication-22\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-23-600x342.jpg\" alt=\"horizon-configure-smart-card-authentication-22\" width=\"600\" height=\"342\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Enable the smart card authentication in Horizon<\/h2>\n<p>From the Connection Server, go to <strong>Settings &gt; Servers<\/strong> area and select the <strong>Connection Servers<\/strong> tab. Select the first Connection Server (CS1 in the example) and click <strong>Edit<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53913 size-large\" title=\"horizon-configure-smart-card-authentication-23\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-24-600x324.jpg\" alt=\"horizon-configure-smart-card-authentication-23\" width=\"600\" height=\"324\" \/><\/p>\n<p>Select the <strong>Authentication<\/strong> tab and scroll down to the <strong>Smart card authentication<\/strong> section.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53915 size-large\" title=\"horizon-configure-smart-card-authentication-24\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-25-600x420.jpg\" alt=\"horizon-configure-smart-card-authentication-24\" width=\"600\" height=\"420\" \/><\/p>\n<p>From the drop-down menu\u00a0<strong>Smart card authentication for users<\/strong> select the <strong>Required<\/strong> option and if you need to increase the security enable the <strong>Disconnect user sessions on smart card removal<\/strong> option. Click <strong>OK<\/strong>\u00a0to save the configuration.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53917 size-large\" title=\"horizon-configure-smart-card-authentication-25\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-26-600x420.jpg\" alt=\"horizon-configure-smart-card-authentication-25\" width=\"600\" height=\"420\" \/><\/p>\n<p>If you have multiple Connection Servers in your infrastructure, <strong>repeat same procedure<\/strong> on each server.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53919 size-large\" title=\"horizon-configure-smart-card-authentication-26\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-27-600x282.jpg\" alt=\"horizon-configure-smart-card-authentication-26\" width=\"600\" height=\"282\" \/><\/p>\n<p>&nbsp;<\/p>\n<h2>Test the smart card authentication<\/h2>\n<p>Once the configuration has been completed, it's time to test if everything works as expected.<\/p>\n<p>Remember to <strong>connect the reader and insert the smart card<\/strong> before logging in to Horizon otherwise you will receive an error. Make sure also to <strong>enable the Smartcard Redirection<\/strong> feature in the View Agent installed in the Golden Image.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53921 size-full\" title=\"horizon-configure-smart-card-authentication-27\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-28.jpg\" alt=\"horizon-configure-smart-card-authentication-27\" width=\"542\" height=\"588\" \/><br \/>\nInsert the smart card in the used computer, open the View Client and connect to your <a href=\"https:\/\/www.vmware.com\/products\/horizon.html\" target=\"_blank\" rel=\"noopener\">VMware Horizon<\/a> infrastructure.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53928 size-large\" title=\"horizon-configure-smart-card-authentication-28\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-29-600x422.jpg\" alt=\"horizon-configure-smart-card-authentication-28\" width=\"600\" height=\"422\" \/><\/p>\n<p>Compared to the standard login, you are now prompted to <strong>enter the PIN<\/strong> associated with your smart card. Click <strong>Login<\/strong>.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53930 size-full\" title=\"horizon-configure-smart-card-authentication-29\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-30.jpg\" alt=\"horizon-configure-smart-card-authentication-29\" width=\"365\" height=\"155\" \/><\/p>\n<p>The entitled Desktop Pool is displayed. Click the desired Desktop Pool to connect the virtual desktop.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53940 size-large\" title=\"horizon-configure-smart-card-authentication-31\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-31-600x422.jpg\" alt=\"horizon-configure-smart-card-authentication-31\" width=\"600\" height=\"422\" \/><\/p>\n<p>The system is connecting to the VDI.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53942 size-full\" title=\"horizon-configure-smart-card-authentication-32\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-32.jpg\" alt=\"horizon-configure-smart-card-authentication-32\" width=\"359\" height=\"147\" \/><\/p>\n<p>After few seconds you are connected to the virtual desktop without entering the Windows credentials.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter wp-image-53944 size-large\" title=\"horizon-configure-smart-card-authentication-33\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/2022\/07\/horizon-configure-smart-card-authentication-33-600x459.jpg\" alt=\"horizon-configure-smart-card-authentication-33\" width=\"600\" height=\"459\" \/><\/p>\n<p>Smart card authentication is useful when the business requires an <strong>extra level of security<\/strong> and is one of the available options provided by VMware Horizon. <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-uag-configure-azure-mfa-saml\/\">SAML<\/a>, <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-secure-logins-with-azure-mfa-nps-extension\/\">RADIUS<\/a>, <a href=\"https:\/\/nolabnoparty.com\/en\/vmware-horizon-true-sso-configuration-pt-1\/\">True SSO<\/a> are some of the available options you can use for the authentication process in Horizon.<\/p>\n<p><img decoding=\"async\" title=\"signature\" src=\"https:\/\/nolabnoparty.com\/wp-content\/uploads\/images\/firma.jpg\" alt=\"signature\" \/><\/p>\n","protected":false},"excerpt":{"rendered":"<p>VMware Horizon can leverage smart card technology to better secure the authentication process when a user tries to access the entitled virtual desktop. If also Active Directory is configured to authenticate users through smart cards, users need to enter the PIN when requested and they can directly access the entitled virtual desktop making the login process faster and more secure.<\/p>\n","protected":false},"author":3,"featured_media":53861,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"rop_custom_images_group":[],"rop_custom_messages_group":[],"rop_publish_now":"initial","rop_publish_now_accounts":{"linkedin_93tdZWzMZc_93tdZWzMZc":"","facebook_2879994398731222_17841400390232720":"","twitter_113568041_113568041":"","mastodon_115463926174894442_115463926174894442":""},"rop_publish_now_history":[],"rop_publish_now_status":"pending","footnotes":""},"categories":[1025,2905],"tags":[668,1711,2484],"class_list":["post-53860","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-horizon-en","category-omnissa-en","tag-authentication-en","tag-horizon","tag-smart-card","has_thumb"],"_links":{"self":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/53860","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/comments?post=53860"}],"version-history":[{"count":0,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/posts\/53860\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media\/53861"}],"wp:attachment":[{"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/media?parent=53860"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/categories?post=53860"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/nolabnoparty.com\/en\/wp-json\/wp\/v2\/tags?post=53860"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}