You can deploy Unified Access Gateway with Horizon Cloud with On-Premises Infrastructure and Horizon Air cloud infrastructure. For the Horizon deployment, the Unified Access Gateway appliance replaces Horizon security server.

Prerequisites

If you want to have both Horizon and a web reverse proxy instance such as Workspace ONE Access configured and enabled on the same Unified Access Gateway instance, see Advanced Edge Service Settings.

Procedure

  1. In the admin UI Configure Manually section, click Select.
  2. In the General Settings > Edge Service Settings, click Show.
  3. Click the Horizon Settings gearbox icon.
  4. In the Horizon Settings page, change NO to YES to enable Horizon.
  5. Configure the following edge service settings resources for Horizon:
    Option Description
    Identifier Set by default to Horizon. Unified Access Gateway can communicate with servers that use the Horizon XML protocol, such as Horizon Connection Server, Horizon Air, and Horizon Cloud with On-Premises Infrastructure.
    Connection Server URL Enter the address of the Horizon server or load balancer. Enter as https://00.00.00.00.
    Connection Server URL Thumbprint Enter the list of Horizon server thumbprints.

    If you do not provide a list of thumbprints, ensure that the server certificates are issued by a trusted CA. Enter the hexadecimal thumbprint digits. For example, sha1= C3 89 A2 19 DC 7A 48 2B 85 1C 81 EC 5E 8F 6A 3C 33 F2 95 C3.

    Enable PCOIP Change NO to YES to specify whether the PCoIP Secure Gateway is enabled.
    Disable PCOIP Legacy Certificate Change NO to YES to specify to use the uploaded SSL server certificate instead of Legacy certificate. Legacy PCoIP clients will not work if this parameter is set to YES.
    PCOIP External URL

    URL used by Horizon clients to establish the Horizon PCoIP session to this Unified Access Gateway appliance. It must contain an IPv4 address and not a hostname. For example, 10.1.2.3:4172. The default is the Unified Access Gateway IP address and port 4172.

    Enable Blast To use the Blast Secure Gateway, change NO to YES.
    Connection Server IP mode Indicates the IP mode of a Horizon Connection Server

    This field can have the following values: IPv4, IPv6, and IPv4+IPv6.

    Default is IPv4.

    • If all NICs in the Unified Access Gateway appliance are in IPv4 mode (no IPv6 mode), then this field can have one of the following values: IPv4 or IPv4+IPv6 (mixed mode).
    • If all NICs in the Unified Access Gateway appliance are in IPv6 mode (no IPv4 mode), then this field can have one of the following values: IPv6 or IPv4+IPv6 (mixed mode).
    Re-Write Origin Header If an incoming request to Unified Access Gateway has the Origin header and the Re-Write Origin Header field is enabled, Unified Access Gateway rewrites the Origin header with the Connection Server URL.

    The Re-Write Origin Header field works alongside the checkOrigin CORS property of the Horizon Connection Server. When this field is enabled, the Horizon administrator can bypass the need to specify Unified Access Gateway IP addresses in the locked.properties file.

    For information about Origin Checking, see Horizon 7 Security documentation.
  6. To configure the authentication method rule, and other advanced settings, click More.
    Option Description
    Auth Methods The default is to use pass-through authentication of the user name and password.

    The following authentication methods are supported: SAML, SAML and Unauthenticated, RSA SecurID, SecurID and Unauthenticated, RADIUS, RADIUS and Unauthenticated, and Device Certificate.

    Important: If you have chosen any of the Unauthenticated methods as the auth method, ensure that you configure the Login Deceleration Level in the Horizon Connection Server to Low. This configuration is necessary to avoid long delay in login time for endpoints while accessing the remote desktop or application.

    For more information about how to configure Login Deceleration Level, see the Horizon Administration documentation at VMware Docs.
    Enable Windows SSO This can be enabled when Auth Methods is set to RADIUS and when the RADIUS passcode is the same as the Windows domain password. Change NO to YES to use the RADIUS username and passcode for the Windows domain login credentials to avoid the need to prompt the user again.

    If Horizon is setup on a multi domain enviornment, if the user name provided does not contain a domain name, then the doman will not be sent to CS.

    If NameID suffix is configured and if the user name provided does not contain a domain name, then the configure NameID suffix value will be appended to the username. For example, if a user provided jdoe as the username and NameIDSuffix is set to @north.int, Username sent would be [email protected].

    If NameID suffix is configured and if username provided is in UPN format, NameID suffix will be ignored. For example, if a user provided [email protected], NameIDSuffix - @south.int, Username would be [email protected]

    If the username provided is in the format <DomainName\username>, for example, NORTH\jdoe, Unified Access Gateway sends the username and domain name separately to CS.
    RADIUS Class Attributes This is enabled when Auth Methods is to set to RADIUS. Click '+' to add a value for the class attribute. Enter the name of the class attribute to be used for user authentication. Click '-' to remove a class attribute.
    Note: If this field is left blank, then the additional authorization is not performed.
    Disclaimer Text

    The Horizon disclaimer message that is displayed to the user and accepted by the user in cases where Auth Method is configured.
    Smart Card Hint Prompt Change NO to YES to enable password hint for certificate authentication.
    Health Check URI Path The URI path for the connection server that Unified Access Gateway connects to, for health status monitoring.
    Blast External URL URL used by Horizon clients to establish the Horizon Blast or BEAT session to this Unified Access Gateway appliance. For example, https://uag1.myco.com or https://uag1.myco.com:443.

    If the TCP port number is not specified, the default TCP port is 8443. If the UDP port number is not specified, the default UDP port is also 8443.

    Enable UDP Server Connections are established through the UDP Tunnel server if there is a low bandwidth.
    Blast Proxy Certificate

    Proxy certificate for Blast. Click Select to upload a certificate in the PEM format and add to the BLAST trust store. Click Change to replace the existing certificate.

    If the user manually uploads the same certificate for the Unified Access Gateway to the load balancer and needs to use a different certificate for Unified Access Gateway and Blast Gateway, establishing a Blast desktop session would fail as the thumbprint between the client and the Unified Access Gateway does not match. The custom thumbprint input to Unified Access Gateway or Blast Gateway resolves this by relaying the thumbprint to establish the client session.

    Enable Tunnel If the Horizon secure tunnel is used, change NO to YES. The client uses the external URL for tunnel connections through the Horizon Secure Gateway. The tunnel is used for RDP, USB, and multimedia redirection (MMR) traffic.
    Tunnel External URL URL used by Horizon clients to establish the Horizon Tunnel session to this Unified Access Gateway appliance. For example, https://uag1.myco.com or https://uag1.myco.com:443.

    If the TCP port number is not specified, the default TCP port is 443.

    Tunnel Proxy Certificate

    Proxy certificate for Horizon Tunnel. Click Select to upload a certificate in the PEM format and add to the Tunnel trust store. Click Change to replace the existing certificate.

    If the user manually uploads the same certificate for the Unified Access Gateway to the load balancer and needs to use a different certificate for Unified Access Gateway and Horizon Tunnel, establishing a Tunnel session would fail as the thumbprint between the client and the Unified Access Gateway does not match. The custom thumbprint input to Unified Access Gateway or Horizon Tunnel resolves this by relaying the thumbprint to establish the client session.

    Endpoint Compliance Check Provider Select the endpoint compliance check provider.

    Default is OPSWAT.
    Proxy Pattern
    Enter the regular expression that matches the URIs that are related to the Horizon Server URL (proxyDestinationUrl). It has a default value of (/|/view-client(.*)|/portal(.*)|/appblast(.*)).
    Note: The pattern can also be used to exclude certain URLs. For example, to allow all URLs through but block /admin you can use the following expression. ^/(?!admin(.*))(.*)
    SAML SP Enter the name of the SAML service provider for the Horizon XMLAPI broker. This name must either match the name of a configured service provider metadata or be the special value DEMO.
    Logout on Certificate Removal
    Note: This option is available when any of the smart card authentication methods is selected as an Auth Method.

    If this option is set to YES and the smart card is removed, the end user is forced to log out from a Unified Access Gateway session.
    User name label for RADIUS Enter text to customize the user name label in the Horizon client. For example, Domain Username

    RADIUS authentication method must be enabled. To enable RADIUS, see Configure RADIUS Authentication.

    The default label name is Username.

    Maximum length of label name is 20 characters.
    Passcode label for RADIUS Enter a name to customize the passcode label in the Horizon client. For example, Password

    RADIUS authentication method must be enabled. To enable RADIUS, see Configure RADIUS Authentication.

    The default label name is Passcode.

    Maximum length of label name is 20 characters.
    Match Windows User Name Change NO to YES to match RSA SecurID and Windows user name. When set to YES, securID-auth is set to true and the securID and Windows user name matching is enforced.

    If Horizon is setup on a multi domain enviornment, if the user name provided does not contain a domain name, then the doman will not be sent to CS.

    If NameID suffix is configured and if the user name provided does not contain a domain name, then the configure NameID suffix value will be appended to the username. For example, if a user provided jdoe as the username and NameIDSuffix is set to @north.int, Username sent would be [email protected].

    If NameID suffix is configured and if username provided is in UPN format, NameID suffix will be ignored. For example, if a user provided [email protected], NameIDSuffix - @south.int, Username would be [email protected]

    If the username provided is in the format <DomainName\username>, for example, NORTH\jdoe, Unified Access Gateway sends the username and domain name separately to CS.

    Note: In Horizon 7 if you enable the Hide server information in client user interface and Hide domain list in client user interface settings and select two-factor authentication (RSA SecureID or RADIUS) for the Connection Server instance, do not enforce Windows user name matching. Enforcing Windows user name matching prevents users from entering domain information in the user name text box and login always fails. For more information, see the topics about two-factor authentication in the Horizon 7 Administration document.
    Gateway Location The location from where the connection request originates. The security server and Unified Access Gateway set the gateway location. The location can be External or Internal.
    Important: The location must be set to Internal when any of the following auth methods are selected: SAML and Unauthenticated, SecurID and Unauthenticated, or RADIUS and Unauthenticated.
    JWT Settings
    Note: For Workspace ONE Access JWT SAML artifact validation, ensure that the Name field is configured in the JWT Settings section of Advanced Settings.
    Select the name of one of the configured JWT settings.
    JWT Audiences Optional list of intended recipients of the JWT used for Workspace ONE Access Horizon SAML Artifact validation.

    For JWT validation to be successful, at least one of the recipients in this list must match with one of the audiences specified in Workspace ONE Access Horizon configuration. If no JWT Audiences are specified, JWT validation does not consider audiences.
    Trusted Certificates Add a trusted certificate to this edge service. Click '+' to select a certificate in PEM format and add to the trust store. Click "-" to remove a certificate from the trust store. By default, the alias name is the filename of the PEM certificate. Edit the alias text box to provide a different name.
    Response Security Headers Click '+' to add a header. Enter the name of the security header. Enter the value. Click '-' to remove a header. Edit an existing security header to update the name and the value of the header.
    Important: The header names and values are saved only after you click Save. Some standard security headers are present by default. The headers configured are added to the Unified Access Gateway response to client only if the corresponding headers are absent in the response from the configured back-end server.
    Note: Modify security response headers with caution. Modifying these parameters might impact the secure functioning of Unified Access Gateway .
    Host Redirect Mappings

    For information about how UAG supports the HTTP Host Redirect capability and certain considerations required for using this capability, see Unified Access Gateway Support for HTTP Host Redirect.

    • Source Host

      Enter the host name of the source (load balancer).

    • Redirect Host

      Enter the host name of the UAG (Unified Access Gateway) applicance whose affinity needs to be maintained with the Horizon client.
    Host Entries Enter the details to be added in /etc/hosts file. Each entry should include an IP, a hostname, and an optional hostname alias in that order, separated by a space. For example, 10.192.168.1 example1.com, 10.192.168.2 example2.com example-alias. Click the '+" sign to add multiple host entries.
    Important: The host entries are saved only after you click Save.
    SAML Audiences

    Ensure that either SAML or SAML and Passthrough authentication method is chosen.

    Enter the audience URL.
    Note: If the text box is left empty, audiences are not restricted.

    To understand how UAG supports SAML Audiences, see SAML Audiences.
    SAML Unauthenticated Username Attribute Enter the custom attribute name
    Note: This field is available only when the value of Auth Methods is SAML and Unauthenticated.
    When UAG validates the SAML assertion, if the attribute name specified in this field is present in the assertion, then UAG provides unauthenticated access to the user name configured for the attribute in the Identity Provider.

    For more information about the SAML and Unauthenticated method, see Authentication Methods for Unified Access Gateway and Third-Party Identity Provider Integration.
    Default Unauthenticated Username Enter the default user name that must be used for unauthenticated access

    This field is available in the Admin UI when one of the following Auth Methods is selected: SAML and Unauthenticated, SecurID and Unauthenticated, and RADIUS and Unauthenticated.

    Note: For SAML and Unauthenticated authentication method, the default user name for unauthenticated access is used only when the SAML Unauthenticated Username Attribute field is empty or the attribute name specified in this field is missing in the SAML assertion.
    Disable HTML Access If set to YES, disables web access to Horizon. See Configure Endpoint Compliance Check Provider Settings for Horizon for details.
  7. Click Save.