Configure VMware Horizon View to Interoperate with Okta via RADIUS

ConfiguringVMware Horizon View to use the Okta RADIUS Agent requires pre-configuration of the RADIUS agent.

1. Download the Okta RADIUS Agent from the Settings > Downloads page in Okta.
2. Install the agent using the instructions in Installing and Configuring the Okta RADIUS Server Agent.
3. For throughput, availability and other considerations, see Okta RADIUS Server Agent Deployment Best Practices.

After installing the Okta RADIUS Agent ensure that you have met these minimum requirements for network connectivity

In this step, add the VMware Horizon View (RADIUS) appAn abbreviation of application. Essentially, it is a web-based site used to perform any number of specific tasks, and requires authentication from end users by signing in. from the OINAn acronym for the Okta Integration Network. The OIN is comprised of thousands of public, pre-integrated business and consumer applications. As an on-demand service, OIN integrations are continuously validated, always up to date, and constantly growing both in number and capability. Okta performs a single integration with an ISV or SP, providing thousands of end users with point-and-click customization for their orgs. and apply settings specific to your deployment. In this section we will configure the following:

• AuthenticationAuthentication is distinct from authorization, which is the process of giving individuals access to system objects based on their identity. Authentication merely ensures that the individual is who he or she claims to be, but says nothing about the access rights of the individual. Authentication methods and protocols include direct auth, delegated auth, SAML, SWA, WS-Fed, and OpenID Connect. configuration

• UDP Port

• Secret Key

• Application Username Format

Note: The U2F Security and Windows Hello MFA factors are not compatible with RADIUS-enabled implementations. For additional information about the Radius apps refer to Configuring RADIUS applications in Okta.

There are some optional advanced radius configuration options that are listed at the end of this document to help with Reporting the Client IP and Sending GroupsGroups allow you to organize your end users and the apps they can access. Assigning apps to large sets of end users is made easier with groups. information to the firewall.

1. In Okta, navigate to Applications > Applications> Add Application, search for VMware Horizon View (RADIUS), and then click Add Application:

   

2. Enter a unique name.

3. Provide the following Sign On values:

   • Authentication: Retaining this default button allows Okta to perform primary authentication.

   • UDP Port: Required. Each RADIUS app has a unique number. Enter it here.

   • Secret Key: Required. Enter the secret key that will be used to encrypt and decrypt the user password. This key must be identical to what is configured on the VMware Horizon View (RADIUS) app.

   • Application username format:This determines how the RADIUS client sends in the username. Select an option from the drop-down menu.

   • After completing the setup, assign the app to the users/groups that require access.

For additional information, including guidance on advanced authentication and adaptive multifactor configuration options, see Using the Okta RADIUS App.

In Part 3 you add your Okta RADIUS Server Agent as a RADIUS Authenticator in your VMware Horizon View Connection Server.

Step 1 – Define a RADIUS Authenticator

1. Sign in to the VMware Horizon Administrator console with sufficient privileges.
2. Navigate to View Configuration > Servers > Connection Servers, and highlight the connection server to work with.
3. Click Edit in the submenu at the top.
4. In the dialog that opens, select the Authentication tab.
5. Scroll down to the Advanced Authentication section.
6. Set the 2-factor authentication value to RADIUS.
7. Click the Manage Authenticators button. In the dialog that opens, click Add. The screen shown below opens.

   

8. Enter a label and description that are unique and appropriate, and enter the following values, as shown above.

   • Hostname/Address: IP or Name of Okta RADIUS Server Agent

   • Authentication port: Port configured in step x (1812)

   • Accounting port: 0

   • Authentication type: PAP

   • Server timeout: 60

   • Max attempts: 1

   • Realm prefix: Optional see username assignment value

   • Realm suffix: Optional see username assignment value

9. Click Next.
10. Optionally, you can configure a Secondary Authentication Server, using the same settings in step 8 above with a different label and description.
11. Click Finish to save all settings.

Step 2 – Configure Advanced Authentication Settings

The advanced authentication settings are used to control the behavior that the View Connection Server uses and enforces. Once enabled, the View Connection server performs authentication against the two-factor authentication first. User experiences can differ.

• Enforce two-factor and Windows user name matching

  If you force two-factor and Windows user name matching, the VMware Horizon View (RADIUS) application username value (set in Part 2, above) must match your Active DirectoryActive Directory (AD) is a directory service that Microsoft developed for the Windows domain networks. It is included in most Windows Server operating systems as a set of processes and services. Initially, Active Directory was only in charge of centralized domain management. username, including any Realm prefix and Realm suffix values.

  This feature is usually enabled. One situation in which you may choose to disable this feature is to allow these usernames to differ so users can perform their initial authentications using their own Okta credentials and then sign in to Windows/AD using a shared or common account.

  The screen shown below uses this configuration. In this flow the VMware Horizon View (RADIUS) application MUST have its RADIUS Authentication Behavior configured so that Okta performs primary authentication is unchecked.

  

  Tests 1 and 3, below use this configuration.

• Use the same user name and password for RADIUS and Windows authentication

  If you force two-factor and Windows user name matching, the VMware Horizon View (RADIUS) application username value (set in Part 2, above) must match your Active Directory username, including any Realm prefix and Realm suffix values.

  If you enable this setting, the Okta password and Windows/AD Password for the user must match, and the VMware Horizon View (RADIUS) application must be configured to perform primary authentication. You can use this setting when Okta is performing delegated authentication for users.

  If you disable this setting, the Okta username can be different than the Windows/AD username and the VMware Horizon View (RADIUS) application can be configured to NOT perform primary authentication making the Okta password irrelevant.

  The screen shown below uses this configuration. In this flow the the VMware Horizon View (RADIUS) application MUST have its RADIUS Authentication Behavior configured so that Okta performs primary authentication is checked.

  

  Tests 2 and 4, below use this configuration.

Important: The values you select for these two options change the sign in experience and dictate what settings you can configure in Okta.

There are four configuration tests to verify the VMware Horizon Client app and the VMware Horizon HTML access. Each configuration is tested with both Okta Primary and MFA and Okta MFA only.

Test 1 – Test with the VMware Horizon Client app with Okta Primary and MFA

1. Launch VMware Horizon Client and initiate connection to Server.

   

2. Enter the Username and Okta/AD Password.

   

3. Select an Okta factor from the list.

   

4. Enter the response that corresponds to the selected factor.

   • For Push verification, accept the incoming push notification on the enrolled device.
   • For SMS, receive and enter the six-digit one-time password (OTP).
   • For a question, provide the answer to the enrolled security question.
   • For Okta or other OTP factors, enter the current six-digit code from Okta Verify, Google Authenticator, or from any other enrolled OTP factor; for example, a Yubikey in OAuth OTP mode.
5. Upon successful completion, access is granted.

   

 

Test 2 – Test with the VMware Horizon Client app with Okta MFA only

1. Launch VMware Horizon Client and initiate connection to Server.

   

2. Enter the Username and Okta OTP value or keyword such as Push or SMS.

   

3. Enter the AD password.

   

4. Upon successful completion, access is granted.

   

 

Test 3 – Test with the VMware Horizon HTML Access with Okta Primary and MFA

1. Navigate to Horizon HTML Access.

   

2. Enter the Username and Okta/AD Password.

   

3. Select an Okta factor from the list.

   

4. Enter the response that corresponds to the selected factor.

   • For Push verification, accept the incoming push notification on the enrolled device.
   • For SMS, receive and enter the six-digit one-time password (OTP).
   • For a question, provide the answer to the enrolled security question.
   • For Okta or other OTP factors, enter the current six-digit code from Okta Verify, Google Authenticator, or from any other enrolled OTP factor; for example, a Yubikey in OAuth OTP mode.
5. Upon successful completion, access is granted.

   

Test 4 – Test with the VMware Horizon HTML Access with Okta MFA only

1. Navigate to Horizon HTML Access.

   

2. Enter Username and Okta OTP value or keyword such as Push or SMS.

   

3. Enter the AD password.

   

4. Enter the response that corresponds to the selected factor.

5. Upon successful completion, access is granted.

   

 

• Okta Documentation - Configuring Sign On Policies

• VMware docs – Enable Two-Factor Authentication in View Administrator : https://docs.vmware.com/en/VMware-Horizon-7/7.0/com.vmware.horizon-view.administration.doc/GUID-71458AA2-E2A2-43AC-85D1-35404AF09B79.html

• VMware docs – Using Two-Factor Authentication: https://docs.vmware.com/en/VMware-Horizon-7/7.3/horizon-administration/GUID-70879B1F-1DB3-45EA-8D12-C93906F11959.html