VMware Horizon JMP Server Installation and Setup Guide. Modified on 06 SEP 2018 VMware Horizon 7 7.6

Transcription

1 VMwre Horizon JMP Server Instlltion nd Setup Guide Modified on 06 SEP 2018 VMwre Horizon 7 7.6

2 You cn find the most up-to-dte technicl documenttion on the VMwre wesite t: If you hve comments out this documenttion, sumit your feedck to VMwre, Inc Hillview Ave. Plo Alto, CA Copyright 2018 VMwre, Inc. All rights reserved. Copyright nd trdemrk informtion. VMwre, Inc. 2

3 Contents 1 VMwre Horizon JMP Server Instlltion nd Setup Guide 5 2 Overview of Tsks for Instlling nd Configuring JMP Server 6 3 System Requirements For JMP Server 8 Required JMP Technology Components 8 Hrdwre Requirements for JMP Server 8 Supported Operting System for JMP Server 9 Network Requirements for JMP Server 9 Dtse Requirements for JMP Server 10 Supported We Browser for JMP Integrted Workflow 10 4 Prepring the SQL Server Dtse nd Login for JMP Server 12 Crete SQL Server Dtse for JMP Server 12 Crete SQL Server Login for the JMP Server Host 13 Crete SQL Server Windows Authentiction Login for the JMP Server Host 14 Crete SQL Server Authentiction Login for the JMP Server Host 15 Grnting Dtse Owner nd System Administrtion Permissions for Windows User 16 5 Instlling nd Upgrding JMP Server 18 Instll JMP Server 18 Upgrde JMP Server 21 6 Configuring the JMP Server Instnce 22 Synchronize Time Between Horizon Connection Server nd JMP Server Hosts 22 Configuring TLS Certifictes nd Cipher Suites for JMP Server 23 Overview of Tsks for Setting Up TLS Certifictes for JMP Server 23 Replce the Defult TLS Certificte 25 Configure JMP Server to Use Certificte Chin File 27 Configure JMP Server to Use the Certificte for Active Directory 27 Configure JMP Server to Use the Horizon Connection Server Certificte 28 Configure JMP Server to Use the App Volumes Mnger Certificte 30 Configuring Cipher Suites for JMP Server 31 Use More Restrictive CORS Policy on Your JMP Server 32 7 Updting the Dtse Pssword After JMP Server Instlltion 34 Updte the Dtse Pssword for VMwre JMP Pltform Services 34 Updte Dtse Pssword for VMwre JMP File Shre Service 36 VMwre, Inc. 3

4 8 Trouleshooting Your JMP Server 38 JMP Server Is Unville Error 38 Uninstll JMP Server 39 VMwre, Inc. 4

5 VMwre Horizon JMP Server 1 Instlltion nd Setup Guide VMwre Horizon JMP Server Instlltion nd Setup Guide descries how to instll nd configure VMwre Horizon Just-in-Time Mngement Pltform (JMP) Server. After the JMP Server is instlled, nd the JMP settings configured, you cn egin defining JMP ssignments using the JMP Integrted Workflow fetures in VMwre Horizon Console. The informtion in this document is intended for nyone who wnts to instll JMP Server. It is written for experienced Windows system dministrtors who re fmilir with virtul mchine technology nd dt center opertions. VMwre, Inc. 5

6 Overview of Tsks for Instlling 2 nd Configuring JMP Server You must perform certin tsks efore nd fter you instll Horizon JMP Server, nd efore you cn egin using the Horizon JMP Integrted Workflow fetures. The following list provides high-level description of the tsks tht you must complete. The procedures for crrying out these tsks re descried in the topics tht follow this overview. 1 Ensure tht the JMP Server system requirements re met. See Chpter 3 System Requirements For JMP Server. 2 Crete SQL Server dtse tht is used to store informtion out the JMP Server services tht re creted during instlltion. See Crete SQL Server Dtse for JMP Server. 3 Crete the SQL Server login tht is used y the JMP Server host to connect to the SQL Server dtse tht you creted in the previous step. See Crete SQL Server Login for the JMP Server Host for more informtion. 4 Ensure tht the Windows user login tht is used to instll JMP Server hs sufficient privileges to modify the SQL Server dtse tht you creted to store the informtion for the JMP Server services. See Grnting Dtse Owner nd System Administrtion Permissions for Windows User. 5 (Optionl) If the SQL Server used in the previous steps uses TLS encryption, import its TLS certificte into the Windows locl certificte store on the JMP Server host. See the "Enle encryption for specific client" section in the Microsoft TechNet rticle How to enle SSL encryption for n instnce of SQL Server y using Microsoft Mngement Console for detils on exporting nd importing the SQL Server's TLS certificte. 6 Instll JMP Server. See Instll JMP Server. 7 Synchronize time etween your Horizon Connection Server host nd the Windows host for your JMP Server instnce. See Synchronize Time Between Horizon Connection Server nd JMP Server Hosts. 8 Configure TLS certifictes for your JMP Server instnce to communicte securely with the instnces of VMwre Horizon 7 Connection Server, VMwre App Volumes Mnger, VMwre User Environment Mnger, nd other systems in your orgniztion's network. See Configuring TLS Certifictes nd Cipher Suites for JMP Server. 9 (Optionl) Chnge the defult cipher suites tht your JMP Server instnce supports with cipher suites tht your orgniztion supports. See Configuring Cipher Suites for JMP Server. VMwre, Inc. 6

7 10 (Optionl) Use more restrictive Cross-Origin Resource Shring (CORS) policy on your JMP Server instnce for n dded secure communiction with your Horizon 7 Connection Server instnce. See Use More Restrictive CORS Policy on Your JMP Server. 11 Using Windows Systems Mnger, restrt the JMP Server services efore configuring the JMP settings using "Configure JMP Settings for the First Time" in the VMwre Horizon Console Administrtion document. VMwre, Inc. 7

8 System Requirements For JMP Server 3 Specific hrdwre nd softwre requirements must e met efore VMwre Horizon JMP Server cn e instlled nd the JMP Integrted Workflow fetures cn e used. This chpter includes the following topics: Required JMP Technology Components Hrdwre Requirements for JMP Server Supported Operting System for JMP Server Network Requirements for JMP Server Dtse Requirements for JMP Server Supported We Browser for JMP Integrted Workflow Required JMP Technology Components Supported versions of the VMwre products tht comprise the JMP technology must e instlled efore you cn instll JMP Server nd use the JMP Integrted Workflow fetures. The following versions of the VMwre products must e instlled efore you egin instlling JMP Server. VMwre Horizon 7 version 7.5 or lter VMwre App Volumes 2.14 or lter VMwre User Environment Mnger or lter VMwre Identity Mnger or lter (for integrtion with VMwre Workspce ONE ) Hrdwre Requirements for JMP Server You must instll JMP Server on dedicted physicl or virtul mchine tht meets specific hrdwre requirements. The following tle lists the minimum hrdwre requirements for JMP Server instnce in production environment. VMwre, Inc. 8

9 Tle 3 1. Horizon JMP Server Hrdwre Requirements for Production Environment Hrdwre Component Processor Memory Storge Minimum Required in Production Environment 4 core CPUs 8 GB 100 GB The following tle lists the minimum hrdwre requirements for JMP Server instnce in proof-ofconcept (PoC) or lortory environment. Tle 3 2. Horizon JMP Server Hrdwre Requirements for Lortory Environment Hrdwre Component Processor Memory Storge Minimum Required in Lortory Environment 4 core CPUs 4 GB 25 GB Supported Operting System for JMP Server You must instll JMP Server on supported Windows Server operting system. The two types of JMP Server instlltion, proof-of-concept (POC) nd production, re supported on the following Windows Server operting systems. Tle 3 3. Operting System Support for JMP Server Operting System Version Edition Windows Server 2008 R2 SP1 64-it Stndrd Enterprise Dtcenter Windows Server 2012 R2 64-it Stndrd Dtcenter Windows Server it Stndrd Dtcenter Network Requirements for JMP Server The physicl or virtul mchine on which you pln to instll JMP Server must e le to rech ll product endpoints for ll the points of delivery (PoDs) cross your network. Before you egin using the JMP Integrted Workflow fetures, ll the security nd CA-signed certificte uthentiction must lredy e configured for the JMP Server instnce nd ll the technology endpoints tht interct with your JMP Server instnce. See Configuring TLS Certifictes nd Cipher Suites for JMP Server for more informtion. VMwre, Inc. 9

10 Dtse Requirements for JMP Server The JMP Server instller requires specific SQL Server dtse versions to perform the JMP Server instlltion. JMP Server supports the following SQL Server versions nd editions in the two supported worklod environments: proof-of-concept (PoC) or production. Tle 3 4. Dtse Requirements for JMP Server Worklod Type Dtse Server Version Edition Proof-of-Concept (PoC) SQL Server Express it Free Production SQL Server 2012 (SP1, SP2, SP3, nd SP4) 64-it Stndrd nd Enterprise Production SQL Server 2014 (SP1 nd SP2 with CU7 or lter) 64-it Stndrd nd Enterprise Production SQL Server 2016 (SP1 with CU6 or lter) 64-it Stndrd nd Enterprise Before running the JMP Server instller, you must crete the SQL Server dtse tht the JMP Server instller uses during the instlltion process. See Crete SQL Server Dtse for JMP Server for detils. You must lso provide the login credentils tht the JMP Server instller must use to connect to the SQL Server dtse tht you creted. You cn select the type of uthentiction tht the JMP Server instller uses. The defult used is the Windows uthentiction. Whether you select the Windows uthentiction or SQL Server uthentiction, the login credentils tht the JMP Server instller uses must lredy exist in the SQL Server instnce efore you cn egin instlling JMP Server. See Crete SQL Server Login for the JMP Server Host for detils. In ddition, you must crete SQL Server login for the Windows Server user ccount tht you pln to use to instll the JMP Server. This Windows user must e configured to hve the proper credentils to modify the SQL Server dtse you creted. If your SQL Server is enled with TLS encryption, you must export its TLS certificte nd import the certificte into your JMP Server instnce to enle n encrypted communiction with the SQL Server. Supported We Browser for JMP Integrted Workflow You ccess the JMP Integrted Workflow user interfce (UI) using the VMwre Horizon Console, which is We-sed ppliction tht is instlled with VMwre Horizon 7 Connection Server version 7.5 nd lter. The following We rowsers re supported for use with the JMP Integrted Workflow fetures. Google Chrome (ltest versions supported) Mozill Firefox (ltest versions supported) VMwre, Inc. 10

11 Internet Explorer 10 nd 11 Microsoft Edge VMwre, Inc. 11

12 Prepring the SQL Server Dtse nd Login for JMP Server 4 Before running the JMP Server instller, you must crete SQL Server dtse for your JMP Server instnce to use. You lso need to crete the SQL Server login ccount tht the JMP Server instller requires to connect to tht SQL Server dtse. The Windows Server login ccount used to run the JMP Server instller must lso hve proper ccess to the SQL Server dtse tht you creted for the JMP Server. This chpter includes the following topics: Crete SQL Server Dtse for JMP Server Crete SQL Server Login for the JMP Server Host Grnting Dtse Owner nd System Administrtion Permissions for Windows User Crete SQL Server Dtse for JMP Server Informtion out the JMP Server services nd the JMP ssignments tht Horizon desktop dministrtors crete re stored in SQL Server dtse. You must crete this dtse efore running the JMP Server instller. Note Using remote SQL server is useful in cses of host filures. Prerequisites Verify tht supported version of SQL Server is instlled on system tht is remote from the host on which you pln to instll JMP Server, ut is in your network environment. For detils, see Dtse Requirements for JMP Server. Ensure tht you use SQL Server Mngement Studio to crete nd dminister the dtse. If you re instlling JMP Server in PoC environment, you cn use SQL Server Mngement Studio Express. Downlod nd instll it from the following wesite. Procedure 1 On the system where your Microsoft SQL Server is instlled, select Strt > All Progrms > Microsoft SQL Server 2016, Microsoft SQL Server 2014, or Microsoft SQL Server Select SQL Server Mngement Studio. VMwre, Inc. 12

13 3 In the Oject Explorer pne, connect to n instnce of the SQL Server Dtse Engine, nd then expnd the node for tht instnce. 4 Right-click Dtses nd select New Dtse. 5 In the Dtse nme text ox, enter nme, using ASCII chrcters only, for the dtse you re creting for JMP Server. For exmple: JMPDB Importnt Non-ASCII chrcters re not supported. 6 Use the defult vlues for the Initil size nd Autogrowth prmeters for the dtse nd log files. 7 Click OK. SQL Server Mngement Studio dds your dtse to the Dtses folder in the Oject Explorer pne. 8 Exit Microsoft SQL Server Mngement Studio. Wht to do next Before you instll JMP Server, crete SQL Server login for the JMP Server host. See Crete SQL Server Login for the JMP Server Host. Crete SQL Server Login for the JMP Server Host During the JMP Server instlltion, the instller ccesses the SQL Server dtse tht you creted to store the informtion out the JMP Server services eing instlled. You must select the SQL Server login type tht the JMP Server instller is to use. To ccess the SQL Server dtse you creted, select either Windows uthentiction login or SQL Server Authentiction login. By defult, the Windows uthentiction login is used. Before you run the JMP Server instller, ensure tht the credentils exist for the SQL Server login type tht you selected. Use the following tle to determine which tsks you must finish to crete the SQL Server login tht the JMP Server instller is to use. Tle 4 1. SQL Server Login Types SQL Server Login Type Windows uthentiction (defult) SQL Server uthentiction Use Tsk Detils in Section Crete SQL Server Windows Authentiction Login for the JMP Server Host Crete SQL Server Authentiction Login for the JMP Server Host VMwre, Inc. 13

14 Crete SQL Server Windows Authentiction Login for the JMP Server Host You cn specify the JMP Server instller to use Windows uthentiction login when ccessing the SQL Server dtse you creted. Before you run the JMP Server instller, the credentils for tht SQL Server login must exist for the JMP Server host on which you re instlling JMP Server. Users connected to the JMP Server host cn ccess the JMP SQL Server dtse. However, you must lso ensure tht the Windows Server user ccount tht is used to instll JMP Server hs write ccess to the SQL Server dtse tht you creted for JMP Server. See Grnting Dtse Owner nd System Administrtion Permissions for Windows User Prerequisites Ensure tht you hve creted the SQL Server dtse for your JMP Server instnce. To crete the dtse, see Crete SQL Server Dtse for JMP Server. Procedure 1 Log in to SQL Server Mngement Studio session s the sysdmin (SA) or use user ccount with SA privileges. 2 In the Oject Explorer pne, expnd the folder for the SQL server instnce in which you creted the dtse for your JMP Server instnce. 3 Expnd the Security folder, right-click Logins, nd select New Login. 4 In the Login - New dilog ox, on the Generl pge, enter login nme in the formt domin_nme\computer_nme$, where computer_nme is the nme of the JMP Server host nd domin_nme is the domin in which the host elongs. For exmple: mycompny\jmpserver$ 5 Select Windows uthentiction. 6 From the Defult dtse list, select defult dtse for the login. The mster dtse is the defult vlue for this item. 7 From the Defult lnguge list, select defult lnguge to use for the login. 8 Assign sysdmin Server role for the new login ccount. Click the Server Roles t in the Select Pge pne on the left side. In the Server roles pge, select the sysdmin check ox. 9 Click OK. The new login is dded under the Logins folder in the Oject Explorer pne. VMwre, Inc. 14

15 Wht to do next Crete the SQL Server login credentils for the Windows Server user ccount tht is used to instll JMP Server. See Grnting Dtse Owner nd System Administrtion Permissions for Windows User. Crete SQL Server Authentiction Login for the JMP Server Host You cn specify the JMP Server instller to use SQL Server login tht uses SQL Server Authentiction login to ccess the SQL Server dtse tht you creted. Before you run the JMP Server instller, the login credentils for tht SQL Server login type must exist for the JMP Server host. Prerequisites Ensure tht you hve creted the SQL Server dtse for JMP Server. To crete the dtse, see Crete SQL Server Dtse for JMP Server. Procedure 1 Log in to SQL Server Mngement Studio session s the sysdmin (SA) or using user ccount with SA privileges. 2 In the Oject Explorer pne, expnd the folder for the SQL server instnce in which you creted the JMP Server dtse. 3 Expnd the Security folder, right-click Logins, nd select New Login. 4 In the Login - New dilog ox, on the Generl pge, enter vlue in the Login nme text ox using ASCII chrcters only. Alterntively, click Serch nd use the Select User or Group dilog ox to locte the login you wnt to use. Importnt Non-ASCII chrcters re not supported. 5 Select SQL Server uthentiction. 6 In the Pssword nd Confirm Pssword text oxes, enter pssword for the new login nme. Use ASCII chrcters only. 7 If you re chnging n existing pssword, select Specify old pssword, nd then enter the old pssword in the Old pssword text ox. 8 Depending on your orgniztion's policy, select or deselect the Enforce pssword policy, Enforce pssword expirtion, nd User must chnge pssword t next login check oxes. 9 From the Defult dtse list, select defult dtse for the login. The mster dtse is the defult vlue for this item. 10 From the Defult lnguge list, select defult lnguge for the login. 11 Assign sysdmin Server role for the new login ccount. Click the Server Roles t in the Select Pge pne on the left side. In the Server roles pge, select the sysdmin check ox. 12 Click OK. VMwre, Inc. 15

16 The new login is dded under the Logins folder in the Oject Explorer pne. Wht to do next Crete the SQL Server login credentils for the Windows Server user ccount tht is used to instll JMP Server. See Grnting Dtse Owner nd System Administrtion Permissions for Windows User. Grnting Dtse Owner nd System Administrtion Permissions for Windows User Besides creting SQL Server login for the JMP Server host mchine, the Windows user ccount tht you pln to use to instll the JMP Server instnce must e creted. This Windows user ccount must e given sysdmin nd dtse owner privileges in the SQL Server dtse tht you creted. Prerequisites Ensure tht the SQL Server dtse hs een creted for the JMP Server you pln to instll. See Crete SQL Server Dtse for JMP Server. Verify tht SQL Server login hs een creted for the JMP Server host. See Crete SQL Server Login for the JMP Server Host. Procedure 1 Log in to SQL Server Mngement Studio session s the sysdmin (SA) or use user ccount with SA privileges. 2 In the Oject Explorer pne, connect to the SQL server instnce tht you creted for the JMP Server. 3 Crete the SQL Server Login for the Windows user ccount you pln to use for instlling the JMP Server. c d e Expnd the Security folder, right-click Logins, nd select New Login. In the Login - New dilog ox, click Serch. In the Select User or Group dilog ox, select the vlid Active Directory user tht you pln to use to instll JMP Server. In the Login - New dilog ox, under Select Pge, choose Server Roles nd select the sysdmin check ox. Click OK to close the Login-New dilog ox. 4 Grnt permissions to the Windows user ccount. c In the left pne, click Dtses. Select the dtse you creted for your JMP Server instnce, click Security, nd then click Users In the Users pne, right-click your Windows user login, nd select Properties from the contextul menu. VMwre, Inc. 16

17 d e Under Dtse role memership, select d_owner role. Click OK. The new login is dded under the Logins folder in the Oject Explorer pne. Wht to do next Instll the JMP Server instnce using the informtion in Instll JMP Server. VMwre, Inc. 17

18 Instlling nd Upgrding 5 JMP Server To use the JMP Integrted Workflow fetures, you must first instll nd configure JMP Server instnce nd the required VMwre JMP technology products. You cn upgrde your JMP Server instlltion using new version of the JMP Server instller. Note In Horizon 7 version 7.5 relese, you cn instll only one instnce of JMP Server. This chpter includes the following topics: Instll JMP Server Upgrde JMP Server Instll JMP Server Before you cn use the JMP Integrted Workflow fetures, you must instll nd configure JMP Server. The JMP Server instller file is included when you downlod VMwre Horizon 7 version 7.5 or lter. You must run the JMP Server instller seprtely fter you successfully instll Horizon 7 version 7.5 or lter. Prerequisites Confirm tht you hve met the system requirements for the components tht re required to instll JMP Server. See Chpter 3 System Requirements For JMP Server. To run the JMP Server instller on Windows Server host, you must use domin user ccount with dministrtive privileges on tht host system. Ensure tht the SQL Server dtse tht your JMP Server instnce must use hs een creted on remote system nd tht you hve the pproprite ccess to it. See Crete SQL Server Dtse for JMP Server. Verify tht the SQL Server logins nd permissions hve een configured for the JMP Server host nd Windows domin user ccount tht you pln to use to instll JMP Server. See Crete SQL Server Login for the JMP Server Host. Gther the informtion for the secure or insecure HTTP port, UI port, nd signed certifictes to e used with the JMP Integrted Workflow fetures. VMwre, Inc. 18

19 Otin TLS certificte signed y Certificte Authority nd use it to replce the defult TLS certificte instlled y the JMP Server instller. Before you instll JMP Server, use the following tle to determine the type of instlltion to use. Instlltion Type Production Environment Development or Proof of Concept (PoC) Environment Action Tken y JMP Server Instller Genertes JMP Server instnce tht uses SQL Server Stndrd or Enterprise edition. Genertes JMP Server instnce tht uses SQL Server Express. Add the following files to the McAfee Antivirus exclusion list efore you instll JMP Server. C:\Progrm Files (x86)\vmwre\jmp\nssm-2.24\nssm-2.24\win32\nssm.exe C:\Progrm Files (x86)\vmwre\jmp\com\xmp\node_modules\winser\in\nssm.exe Procedure 1 To strt the VMWre JMP Instller wizrd, locte nd doule-click the JMP Server instller file. The JMP Server instller filenme is VMwre-Jmp-Instller-e.x.p-xxxxxxx.exe,where xxxxxxx is the uild numer. For exmple, VMwre-Jmp-Instller-e.x.p exe. Note If you wnt to log the instlltion process, run the JMP Server instller from commnd prompt using the following commnd, where Log_Folder_Pth is the folder where the log file is to e creted. VMwre-Jmp-Instller-e.x.p-xxxxxxx.exe /log:"log_folder_pth" 2 Click Next in the Welcome pge nd ccept the VMwre license terms. 3 To llow HTTPS trffic, click Next. Note JMP Server tkes up port 443 nd, optionlly, ports 80, , 888, nd To llow HTTP trffic over port 80, select the Allow HTTP? check ox. VMwre, Inc. 19

20 4 Provide the SQL Server instnce nd dtse ctlog informtion. Enter the IP Address or the nme of the SQL Server instnce for connecting to the dtse you creted for JMP Server. Optionlly, click Browse to mke the selection. Select which uthentiction credentils you wnt to use to connect to the SQL Server dtse. Option Windows uthentiction credentils of current user Server uthentiction using the Login ID nd pssword elow Description The dministrtor credentils you re using during this instlltion process is used to connect to the SQL Server dtse instnce. Provide the Login ID nd Pssword informtion to use to connect to the SQL Server dtse instnce. Note The login credentils you use must lredy e configured in the SQL Server instnce tht JMP Server is going to ccess. See Crete SQL Server Login for the JMP Server Host. c In the Nme of dtse ctlog text ox, enter the nme of the dtse you creted using Crete SQL Server Dtse for JMP Server. Optionlly, click Browse nd select the dtse ctlog from the ville list. The selected dtse ctlog is used to store informtion out the JMP Server services. d (Optionl) If you wnt to overwrite the existing dtse, select the Overwrite existing dtse check ox. Note The first time the JMP Server instller is run, the necessry dtse tles re creted. If you run the instller gin to crete more JMP Server instnces for lod lncing, the instller finds tht the dtse lredy exists nd does not recrete the tles. Selecting this option overwrites the existing informtion in the dtse. e To ensure secure communiction etween JMP Server nd the SQL Server instnce, verify tht the Enle SSL check ox is selected. The Enle SSL check ox is selected y defult. Importnt When the Enle SSL check ox is selected, ensure tht the TLS/SSL certificte used in SQL Server is imported into the Windows locl certificte store on the JMP Server host. Otherwise, the JMP Server instlltion process fils with the error "Filed to execute uem_migrte.t file" nd when you click OK in the error dilog ox, instlltion is rolled ck. See the "Enle encryption for specific client" section in the Microsoft TechNet rticle How to enle SSL encryption for n instnce of SQL Server y using Microsoft Mngement Console for detils on exporting nd importing the SQL Server's TLS/SSL certificte. f Click Next. 5 In the Redy to Instll Progrm pge, click Instll. 6 Click Finish when the instlltion finishes successfully. VMwre, Inc. 20

21 With successful instlltion, the following JMP Server services re instlled nd strted on your Windows Server host. VMwre JMP API Service VMwre JMP File Shre Service VMwre JMP Pltform Services Wht to do next Synchronize the time etween the newly instlled JMP Server instnce nd its ssocited Horizon Connection Server. See Synchronize Time Between Horizon Connection Server nd JMP Server Hosts. Upgrde JMP Server When you upgrde your current JMP Server instlltion to lter version of JMP Server, ll existing JMP settings configurtion nd JMP ssignments re preserved. The JMP Server instller file is included when you downlod Horizon 7 version 7.5 or lter. To upgrde your existing JMP Server instlltion, you must run the JMP Server instller seprtely fter you successfully instll Horizon 7 version 7.6 or lter. Prerequisites You must use domin user ccount with dministrtive privileges on tht host system to run the new JMP Server instller file. Procedure 1 To strt the VMWre JMP Instller wizrd, locte nd doule-click the new JMP Server instller file. The instller checks to see if n existing JMP Server instlltion exists. 2 Click OK in the JMP Upgrde dilog ox. 3 In the Welcome screen, click Next. 4 Red nd ccept the license greement terms nd click Next. 5 In the Dtse Server for the JMP Server Pltform Services pge, keep the existing dtse settings nd click Next. 6 In the Redy to Instll Progrm pge, click Instll. The instlltion proceeds nd tkes few minutes to complete. 7 Click Finish when the instlltion finishes successfully. With successful upgrde, the three JMP Server services re re-strted on your Windows Server host. VMwre, Inc. 21

22 Configuring the JMP Server 6 Instnce After successfully instlling the JMP Server instnce, you must perform configurtion tsks to ensure the JMP Server instnce cn successfully uthenticte with Horizon Connection Server nd cn communicte securely with other servers in your network. This chpter includes the following topics: Synchronize Time Between Horizon Connection Server nd JMP Server Hosts Configuring TLS Certifictes nd Cipher Suites for JMP Server Synchronize Time Between Horizon Connection Server nd JMP Server Hosts The time in oth the Horizon Connection Server nd JMP Server hosts must e synchronized in order for the uthentiction process etween the two servers to e successful. When you ccess the JMP Integrted Workflow fetures using the Horizon Console UI, JMP Server uthentictes the token it receives from Horizon Connection Server, which in turn returns token to JMP Server. If time is unsynchronized etween the two hosts, the Horizon Connection Server rejects the token provided y JMP Server, nd the JMP Integrted Workflow fetures ecome unville from the Horizon Console UI. The JMP Setting pne displys the following error messge. Horizon SSO token could not e verified. For successful uthentiction process, synchronize time on the Horizon Connection Server nd JMP Server hosts to common Network Time Protocol (NTP) Server. Procedure 1 Use the following VMwre Tool commnds on the Windows host. C:\Progrm Files\VMwre\VMwre Tools>VMwreTooloxCmd.exe timesync sttus C:\Progrm Files\VMwre\VMwre Tools>VMwreTooloxCmd.exe timesync enle 2 On the ESXi host, synchronize ESXi Clocks with Network Time Server. Strt the VMwre Host Client, nd connect to the ESXi host. Click Configure. VMwre, Inc. 22

23 c d e Under System, click Time Configurtion, nd click Edit. Select Use Network Time Protocol (Enle NTP client). In the Add NTP Server text ox, enter the IP ddress or fully qulified domin nme of one or more NTP servers to synchronize with. Wht to do next Configure the TLS certifictes for JMP Server. See Overview of Tsks for Setting Up TLS Certifictes for JMP Server. Configuring TLS Certifictes nd Cipher Suites for JMP Server To ensure tht your JMP Server instnce communictes securely with other servers in your network, you must configure your JMP Server instnce to use TLS certifictes tht vlid Certificte Authority (CA) signed. To enhnce the secure connections, you cn lso optionlly chnge the defult cipher suites tht other servers ccept nd propose when communicting with your JMP Server instnce. By defult, the JMP Server instller instlls self-signed TLS server certificte for the JMP Server instnce you instlled. You cn use the defult certificte for testing purposes. If you re using the JMP Server instnce in production environment, you must replce the defult certificte with CAsigned TLS server certificte s soon s possile. Use of certifictes tht CA did not sign cn llow untrusted prties to intercept trffic y msquerding s your server. See Overview of Tsks for Setting Up TLS Certifictes for JMP Server. Overview of Tsks for Setting Up TLS Certifictes for JMP Server After successfully instlling JMP Server, you must perform severl tsks to set up the TLS server certifictes tht re signed y vlid Certificte Authority (CA) for use with the JMP Server instnce. In ddition to the tsks outlined in this topic, the following digrm provides visul summry of the min steps required to configure the certifictes for JMP Server. Ensure tht you follow the detiled steps tht re descried in the topics tht follow this overview to configure the specific certifictes successfully. For the tsks tht re mrked s optionl, determine whether you hve to perform those tsks to ensure your JMP Server configurtion is more secure. After you complete the certificte configurtions, you must restrt the three JMP Server services using the Windows Services Mnger. VMwre, Inc. 23

24 Figure 6 1. Min Steps to Configure the Certifictes for JMP Server Step 1 If TLS/SSL is enled in your SQL Server, import the TLS/SSL certificte into the JMP Server host s locl certificte store. Step 2 -Sve the certificte to the C:\Progrm Files (x86)\vmwre\ JMP\com\XMS\nginx\conf\ jmp_self_vmwre.com.crt file. -Sve the privte key to the C:\Progrm Files (x86)\vmwre\ JMP\com\XMS\nginx\conf\ jmp_self_vmwre.com.key file. Step 3 Sve the c-chin.cert.pem file to C:\Progrm Files (x86)\vmwre\ JMP\com folder. SQL Server Your compny s TLS Certificte signed y CA Your compny s certificte chin file JMP Server Step 4 Copy the certificte file to the C:\Progrm Files (x86)\vmwre\ JMP\com\XMS\config\dCA.pem file. Active Directory Step 5 Copy the certificte file to the C:\Progrm Files (x86)\vmwre\ JMP\com\horizon.cert.pem file. Horizon 7 version 7.5 or lter Connection Server Step 6 Copy the certificte file to the C:\Progrm Files (x86)\vmwre\ JMP\com\v-selfsigned.cert.pem file. App Volumes Mnger 2.14 or lter 1 If TLS/SSL is enled in your SQL Server, ensure tht the TLS/SSL certificte hs een imported into the JMP Server's host's locl certificte store. 2 Replce the TLS server certificte tht the JMP Server instller generted. The defult server certificte tht the JMP Server instller generted is self-signed nd unrecognized y your orgniztion's network. Replce the self-signed certificte with vlid TLS certificte tht you otined from CA. See Replce the Defult TLS Certificte. If your orgniztion does not hve vlid TLS We server certificte, otin signed TLS server certificte from CA. Refer to the informtion in Scenrios for Setting Up TLS Certifictes for Horizon 7. 3 If n intermedite CA signed your orgniztion's server certifictes, configure JMP Server to use your orgniztion's certificte chin file, c-chin.cert.pem, to help JMP Server uthenticte other servers in your network. See Configure JMP Server to Use Certificte Chin File. Note If root CA trusted y NodeJS signed your orgniztion's TLS server certifictes directly, you do not need to provide certificte chin file or the root certificte file, c.cert.pem. 4 Otin the CA certificte which is used to sign the certificte for the Active Directory server, store it into dca.pem file, nd dd the file into the JMP Server XMS configurtion folder. See Configure JMP Server to Use the Certificte for Active Directory for detils. VMwre, Inc. 24

25 5 Export the CA-signed certificte for Horizon Connection Server into horizon.cert.pem file nd dd the file into the JMP Server home folder. See Configure JMP Server to Use the Horizon Connection Server Certificte for detils. With the horizon.cert.pem file, JMP Server cn uthenticte Connection Server s trustworthy server to which it cn connect. Note You must finish this tsk for ech Connection Server pod tht interfces with the JMP Server instnce. The contents of ech of the exported CA-signed certificte must e ppended into the sme horizon.cert.pem file. 6 If you re ssigning App Volumes AppStcks when creting JMP ssignments, configure your JMP Server instnce to use the App Volumes Mnger instnce's self-signed certificte so tht it cn securely communicte with the App Volumes Mnger instnce. See Configure JMP Server to Use the App Volumes Mnger Certificte. 7 (Optionl) Chnge the defult cipher suites tht your JMP Server instnce supports with ciphers tht your orgniztion supports. See Configuring Cipher Suites for JMP Server. 8 (Optionl) Enle more restrictive Cross-Origin Resource Shring (CORS) policy on your JMP Server for n dded secure communiction with your Horizon 7 Connection Server instnce. See Use More Restrictive CORS Policy on Your JMP Server. 9 Restrt the three JMP Server services using the Windows Services Mnger. After you configure the server certifictes, you cn proceed to Horizon Console to configure the JMP settings nd egin using the JMP Integrted Workflow fetures. See "Configure JMP Settings for the First Time" in VMwre Horizon Console Administrtion. Replce the Defult TLS Certificte Replce the defult TLS certificte instlled y the JMP Server instller with your orgniztion's TLS certificte tht is signed y Certificte Authority (CA). After you successfully instll the JMP Server instnce, you cn ccess it using the Horizon Console on We rowser. However, if your network does not recognize the defult TLS certificte tht ws instlled, the We rowser's security lert dilog ox ppers when you configure the JMP settings for the first time. Although you cn use the defult, self-signed certificte for testing purposes, to ensure secure connection with the JMP Server instnce, replce the defult certificte nd key with CA-signed TLS certificte nd privte key. Importnt If you decide to nme the certificte nd key files with filenmes tht re different from the defult nmes creted y the JMP Server instller, you must modify the JMP Server NGINX configurtion file to use the new filenmes. Prerequisites Instll JMP Server. See Instll JMP Server. VMwre, Inc. 25

26 Otin CA-signed TLS certificte nd replce the defult TLS certificte instlled y the JMP Server instller. You cn use certificte tools, such s Microsoft Certreq or OpenSSL on Windows, to generte certificte. Refer to informtion in "Otining TLS Certifictes from Certificte Authority" in Scenrios for Setting Up TLS Certifictes for Horizon 7. Procedure 1 In the JMP Server host, stop the three JMP Server services using the Windows Services Mnger tool. c Right-click the Windows Strt icon nd select Run. In the Run dilog ox, type services.msc in the Open text ox, nd click OK. Locte the following three JMP Server services in the Services (Locl) pne of the Services window nd for ech service, click Stop. VMwre JMP API Service VMwre JMP File Shre Service VMwre JMP Pltform Services 2 Sve your CA-signed TLS server certificte file s jmp_self_vmwre.com.crt in the NGINX configurtion folder on the JMP Server host. For exmple: C:\Progrm Files (x86)\vmwre\jmp\com\xms\nginx\conf\jmp_self_vmwre.com.crt 3 Sve the CA-signed TLS server certificte's ccompnying privte key s jmp_self_vmwre.com.key. For exmple: C:\Progrm Files (x86)\vmwre\jmp\com\xms\nginx\conf\jmp_self_vmwre.com.key 4 (Optionl) If you wnt to use filenmes tht re different from the expected certificte filenmes, jmp_self_vmwre.com.crt or jmp_self_vmwre.com.key, you must modify the NGINX configurtion file with the new filenmes. c Open the C:\Progrm Files (x86)\vmwre\jmp\com\xms\nginx\conf\nginx.conf configurtion file. Locte the occurrences of the jmp_self_vmwre.com.crt nd jmp_self_vmwre.com.key properties nd replce them with the new filenmes you hd selected. Sve the nginx.conf file. You cn now securely ccess the JMP Integrted Workflow fetures without the We rowser security lert dilog ox ppering. VMwre, Inc. 26

27 Wht to do next If n intermedite CA signed your orgniztion's entire certificte chin, configure your JMP Server instnce to use certificte chin file. See Configure JMP Server to Use Certificte Chin File. If not, proceed to configure your JMP Server instnce to use the certificte for Active Directory. See Configure JMP Server to Use the Certificte for Active Directory. Configure JMP Server to Use Certificte Chin File If n intermedite CA signed your orgniztion servers' certifictes, configure the JMP Server instnce with your orgniztion's entire certificte chin, which includes the root nd intermedite certifictes. Prerequisites Use Windows Services Mnger to stop the three JMP Server services. Procedure 1 Otin your orgniztion's entire certificte chin file, c-chin.cert.pem. 2 Copy the c-chin.cert.pem certificte chin file into the C:\Progrm Files (x86)\vmwre\jmp\com folder. With the certificte chin in plce, your JMP Server instnce cn uthenticte the Horizon 7 nd App Volumes instnces nd securely communicte with them. Wht to do next Configure the JMP Server instnce with the Active Directory certificte so tht the JMP Server instnce cn uthenticte the Active Directory server when desktop dministrtors use the JMP Integrted Workflow fetures. See Configure JMP Server to Use the Certificte for Active Directory. Configure JMP Server to Use the Certificte for Active Directory For JMP Server to vlidte the Active Directory with which Horizon Console is connected, you must configure JMP Server to use the certificte for tht Active Directory server. You must export the root CA certificte of the Active Directory domin into certificte file nmed dca.pem file nd plce this file in the JMP Server XMS configurtion folder. Prerequisites JMP Server must e instlled. Active Directory must e configured for LDAP over SSL (LDAPS) or StrtTLS (LDAP over TLS). VMwre, Inc. 27

28 Root CA certifictes of the Active Directory domins. If the certifictes re not in PEM (Bse64 encoded) formt, see the OpenSSL documenttion (or similr document) to convert the file to PEM formt. Note When you hve multiple root certifictes from different domins, you cn comine ll the PEM formtted certifictes into single file y copying the contents of ech file one y one to single.pem file. Procedure 1 Ensure tht nme of the PEM formtted certificte file is dca.pem. 2 Copy the dca.pem file to the JMP Server XMS configurtion folder. For exmple: C:\Progrm Files (x86)\vmwre\jmp\com\xms\config\dca.pem. With the Active Directory certificte configured for your JMP Server instnce, the Active Directory is recognized s trusted server nd Horizon Console users cn successfully use the JMP Integrted Workflow fetures. Wht to do next Configure JMP Server with the Connection Server certificte so tht JMP Server instnce cn uthenticte Connection Server when desktop dministrtors use the JMP Integrted Workflow fetures. See Configure JMP Server to Use the Horizon Connection Server Certificte. Configure JMP Server to Use the Horizon Connection Server Certificte For JMP Server to vlidte the Horizon 7 Connection Server to which Horizon Console is connected, you must configure JMP Server to use the Horizon 7 Connection Server certificte. You must export the Horizon 7 Connection Server certificte into certificte file nmed horizon.cert.pem file nd plce this file in the JMP Server home folder. Importnt The contents of ech of the exported CA-signed certifictes must e ppended into the sme horizon.cert.pem file. Use these sme procedures when dding CA-signed or self-signed Horizon 7 Connection Server certificte. Prerequisites JMP Server must e instlled. You must hve dministrtive ccess to Horizon 7 Connection Server. Procedure 1 Log in to the Windows Server host for the Horizon 7 Connection Server tht interfces with the Horizon Console nd the JMP Server you instlled. VMwre, Inc. 28

29 2 Right-click the Windows Strt icon, select Run, nd type mmc.exe. The MMC utility window ppers. 3 Add the Certifictes snp-in. c d e In the Console Root window, select File > Add/Remove Snp-in. In the Add or Remove Snp-ins window, select Certifictes from the Aville snp-ins pne, nd click Add. After the certifictes hve een dded, click OK. In the Certifictes snp-in window, select Computer ccount nd click Next. In the Select Computer window, select Locl computer nd click Finish. The Certifictes (Locl Computer) snp-in is dded in the Selected snp-ins pne. f Click OK to close the Add or Remove Snp-ins dilog ox. 4 Bck in the Console Root window, select Console Root > Certifictes (Locl Computer) nd select the Personl > Certifictes folder on the left pne to disply its contents. 5 Export the Horizon Connection Server certificte. In the certifictes content pne, locte the certificte with Friendly Nme of vdm. This certificte elongs to the Horizon Connection Server. c d e f Right-click the certificte nd select All Tsks > Export. In the Certificte Export Wizrd dilog ox, click Next. Select No, do not export the privte key, nd click Next. Select the Bse-64 encode X.509 (.CER) formt nd click Next. Enter the filenme s horizon.cert.pem nd click Browse to nvigte to the folder where you wnt to sve the exported certificte. Importnt You must sve the exported certificte file with the.pem file extension, nd not with the.cer or.crt file extensions. If necessry, open the exported certificte file in text editor nd sve it s horizon.cert.pem. g Click Next nd click Finish to close the Certificte Export Wizrd window. The certificte is exported successfully. 6 Nvigte to where you sved the exported horizon.cert.pem certificte nd copy it to the JMP Server home folder. For exmple: C:\Progrm Files (x86)\vmwre\jmp\com\horizon.cert.pem. With the Connection Server certificte configured for JMP Server, the Connection Server is recognized s trusted server nd Horizon Console users cn successfully use the JMP Integrted Workflow fetures. VMwre, Inc. 29

30 Wht to do next Review the optionl tsks listed in Overview of Tsks for Setting Up TLS Certifictes for JMP Server nd determine if you must lso complete them. If you hve finished ll the necessry configurtion tsks, restrt the JMP Server services nd configure the JMP settings. See "Configure JMP Settings for the First Time" in VMwre Horizon Console Administrtion for more informtion. Configure JMP Server to Use the App Volumes Mnger Certificte If you re ssigning App Volumes AppStcks when creting JMP ssignments, configure your JMP Server instnce to use the App Volumes Mnger instnce's certificte so tht it cn securely communicte with the App Volumes Mnger instnce. In PoC instlltion environment, you must export the self-signed certificte of the App Volumes Mnger instnce into certificte file nmed v-selfsigned.cert.pem file in order for JMP Server to use it. If App Volumes Mnger is using CA-signed certificte, configure JMP Server to use your orgniztion s certificte chin file, c-chin.cert.pem, to uthenticte the App Volumes Mnger instnce. See Configure JMP Server to Use Certificte Chin File. Prerequisites JMP Server must e instlled. You must hve dministrtive ccess to the App Volumes Mnger instnce or the lod lncer tht mnges it. Procedure 1 From your JMP Server host, use We rowser to log in to the App Volumes Mnger instnce or the lod lncer tht mnges the App Volumes Mnger instnces in your environment. 2 To locte the certificte informtion tht is used y App Volumes Mnger instnce or lod lncer, use your We rowser's certificte mnger nd export the certificte file in Bse-64 encoded X.509 (.CER) formt to the C:\Progrm Files (x86)\vmwre\jmp\com\v-selfsigned.cert.pem file. Importnt You must sve the exported certificte file with the.pem file extension, nd not with the.cer or.crt file extensions. If necessry, open the exported certificte file in text editor nd sve it s v-selfsigned.cert.pem. For exmple, when using Google Chrome We rowser, click Settings > Advnced nd select Mnge certifictes. In the Certifictes dilog ox, select the App Volumes Mnger certificte nd click Export. Use the Certificte Export Wizrd to export the Bse-64 encoded X.509 (.CER) formt of the App Volumes Mnger certificte file into the C:\Progrm Files (x86)\vmwre\jmp\com\v-selfsigned.cert.pem file. You might need to renme the file so tht it hs the.pem file extension only, insted of the.pem.cer file extension. VMwre, Inc. 30

31 3 If you hve finished ll the tsks necessry to configure the TLS certifictes necessry to mke JMP Server more secure, restrt the JMP Server services. See Overview of Tsks for Setting Up TLS Certifictes for JMP Server to review ny remining TLS certificte configurtion tsks. Configuring Cipher Suites for JMP Server The JMP Server instlltion includes defult server-side nd client-side cipher suites tht re ccepted nd proposed etween your JMP Server, Horizon Connection Server, App Volumes, nd User Environment Mnger instnces. You cn optionlly chnge these defult cipher suites tht JMP Server supports with cipher suites tht your orgniztion supports. Which cipher suite is used depends on whether JMP Server is cting s server receiving the secure connection request or when it is cting s client tht is inititing the secure connection request to Horizon Connection Server, App Volumes, or User Environment Mnger. You must specify the list of cipher suites using the formt tht is defined in The following list of cipher suites is the defult used for the server-side. ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128- SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256- SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:HIGH:!NULL:!eNULL:!EXPORT:!DES:!MD5:!PSK:!RC4 In ddition to the preceding cipher string, the ctul cipher suites used re lso determined y the ccepted protocols TLSv1.1 nd TLSv1.2, which re defined in the nginx.conf file. Procedure 1 In the JMP Server host, stop the three JMP Server services using the Windows Services Mnger tool. c Right-click the Windows Strt icon nd select Run. In the Run dilog ox, type services.msc in the Open text ox, nd click OK. In the Services (Locl) pne of the Services window, locte the following three JMP Server services nd for ech service, click Stop. VMwre JMP API Service VMwre JMP File Shre Service VMwre JMP Pltform Services 2 Modify the configurtion file tht contins the cipher suite. To modify the server-side cipher suite: c Nvigte to the C:\Progrm Files (x86)\vmwre\jmp\com\xms\nginx\conf folder. Crete ckup copy of the nginx.conf file efore modifying it. Open the nginx.conf file with Notepd. VMwre, Inc. 31

32 d e Locte the line tht egins with ssl_ciphers nd modify the cipher suite s necessry. Sve the chnges you mde to the nginx.conf file. To modify the client-side cipher suite: c d Nvigte to the C:\Progrm Files (x86)\vmwre\jmp\com\xmp\conf folder. Open the jmp.js file with Notepd. Crete ckup copy of the jmp.js file efore modifying it. Locte the line tht contins the following code snippet. ciphers:'!null:kecdh+aesgcm:ecdh+aesgcm:rsa+aesgcm:kecdh+aes:ecdh+aes:rsa+aes' e Modify the cipher suite fter the ciphers: section in the code snippet. For exmple: ciphers:'your_orgniztion_cipher_suite' f Sve the chnges you mde to the jmp.js file. 3 Use the Windows Services Mnger tool to restrt the three JMP Server services for the new list of cipher suites to tke effect. Use More Restrictive CORS Policy on Your JMP Server You cn use more restrictive Cross-Origin Resource Shring (CORS) policy on your JMP Server instnce y creting whitelist of the Horizon 7 Connection Server instnces tht re trusted to ccess your JMP Server. By defult, Horizon 7 Connection Server cn ccess your JMP Server instnce if it is using the sme certificte tht is in the certificte chin file tht you configured using Configure JMP Server to Use Certificte Chin File. To ensure tht only the pproved list of Horizon 7 Connection Server instnces hve ccess to your JMP Server, perform the following steps. Procedure 1 Using text editor, open the NGINX configurtion file t C:\Progrm Files (x86)\vmwre\jmp\com\xms\nginx\conf\nginx.conf. 2 Locte the two occurrences of the following text nd uncomment ech one y removing the leding # mrk so tht they pper s follows. dd_heder "Access-Control-Allow-Origin" "$cors_heder" lwys; 3 Locte the two occurrences of the following text nd comment them out y dding leding # mrk so tht they pper s follows. # dd_heder "Access-Control-Allow-Origin" "$http_origin" lwys; VMwre, Inc. 32