ADV1591BE Delivering Virtual Desktops and Apps via the Digital Workspace with Workspace ONE and VMware Horizon VMworld 2017 Content: Not for publication Johan van Amersfoort & Stephane Padique #VMWORLD #ADV1591BE
Disclaimer This presentation may contain product features that are currently under development. This overview of new technology represents no commitment from VMware to deliver these features in any generally available product. Features are subject to change, and must not be included in contracts, purchase orders, or sales agreements of any kind. Technical feasibility and market demand will affect final delivery. Pricing and packaging for any new technologies or features discussed or presented have not been determined. 2
Agenda 1 What is Workspace ONE? 2 Setting up Horizon with Workspace ONE 3 User experience and Demo 3
Agenda 1 What is Workspace ONE? 2 Setting up Horizon with Workspace ONE 3 User Experience and Demo 4
IT/it used to be simple.. 5
Bridging Two Worlds Client-Server Era Mobile-Cloud Era 6
Bridging Two Worlds Client-Server Era Domain joined Network based security Managing devices OPEX heavy 1:150 ratio Slow Migration Projects Mobile-Cloud Era 7
Bridging Two Worlds Client-Server Era Domain joined Network based security Managing devices OPEX heavy 1:150 ratio Slow Migration Projects Mobile-Cloud Era Enrollment Identity based security Managing policies Massive scale 1:15 000 ratio Fast Continuous Delivery 8
Applications in the Enterprise Universal Windows Apps 9
Bridging Two Worlds Client-Server Era Mobile-Cloud Era 10
Bridging Two Worlds Client-Server Era Workspace One AirWatch ThinApp Flex Horizon BLAST Unified Access Horizon PCoIP Mirage VMware Identity Gateway App Volumes Manager UEM Horizon Cloud Mobile-Cloud Era 11
You can t transform business without a great user experience VMware Empowers the Digital Workspace VMworld 2017 Content: Not for publication You don t need to compromise security to get there 12
Simple App Delivery Through a Unified Catalog Web-based Mobile app Any app to any device 13
Agenda 1 What is Workspace ONE? 2 Setting up Horizon with Workspace ONE 3 User Experience and Demo 14
Simple Access to Apps & Desktops Access to Horizon 7 and Horizon Cloud desktops from Workspace ONE / IDM Full support for Horizon 7.x Virtual Desktops Published Applications Horizon Cloud Pod Architecture Single Sign On & True SSO Support for Horizon Air / Cloud Horizon Cloud Hosted with WS1 Horizon Cloud On-premises with IDM SSO to virtual desktops and apps Support for Citrix XenApp 5/6 XenDesktop 7.x 15
Horizon Deployment Options ACTIVE DIRECTORY Horizon Cloud with Hosted Infrastructure MOBILE USERS USER APP DATA CLOUD PROVIDER OPEX model of utility based pricing Scalability on demand Minimal internal expertise required Remote locations where building data center capacity is impossible SECURE VPN CUSTOMER IT ENVIRONMENT REMOTE USERS SECURE VPN CORP USER DEVICES Horizon Cloud with On-premises Infrastructure VIRTUAL DESKTOPS & APPS ON HYPER-CONVERGED INFRASTRUCTURE Hybrid OPEX/CAPEX model Management infrastructure in the cloud On-premises virtual desktops & apps on hyper-converged infrastructure Minimal internal expertise required and easily scalable G CLOUD PROVIDER CONTROL PLANE ACCESS POINTS ACTIVE DIRECTORY LOAD BALANCERS CAPEX Model CONNECTION BROKERS CUSTOMER IT ENVIRONMENT On Premises (Horizon 7) Greater flexibility in desktop options Scalable to customer requirements Feature rich management MANAGEMENT SERVERS SANSTORAGE ACTIVE DIRECTORY COMPUTE SERVERS RUNNING VIRTUAL DESKTOPS 16
Hosted Applications RDS Farm Connection Server VMware Identity Manager VMworld 2017 Content: Not for Get Resources, Entitlements publication Horizon Client 17
Horizon 7 Integration 18
End to End SSO with TrueSSO Streamlined single sign on to Horizon via Workspace ONE
Horizon TrueSSO VMworld 2017 Users authenticate to VMware Identity Manager using a variety of credential options Once authenticated, users select Horizon desktop or hosted application No need to enter AD credentials or SmartCard Uses SAML to connect the Identity Provider s (IdP) authentication with user s UPN for access to AD credentials Content: Not for publication True SSO generates unique, short-lived certificate to manage Windows logon process 20
Horizon TrueSSO Benefits VMworld 2017 Separates Authentication (validating a user s identity) from Access (user can use a Windows desktop or application Enhanced security. User credentials are secured by digital certificate, no passwords are vaulted or transferred within the datacenter Supports a wide range of authentication methods enterprises can select or change authentication protocols with limited impact to the infrastructure Content: Not for publication 21
Horizon TrueSSO Workflow 1 VMware Identity Manager 2 3 VMware Enrollment Service Horizon Broker VMworld 2017 Content: Not for 4 5 Microsoft Certificate Authority publication AD 6 Horizon Client 7 Virtual Desktop 22
Horizon TrueSSO Support & Requirements Horizon 7+ or Horizon Cloud (latest version) Horizon Enrollment Server Recent Horizon Client (v4+) Identity Manager On-Premises or SaaS (v2.9+) Joined to Active Directory Domain Enterprise Microsoft CA Custom CA templates for short lived certs 23
Horizon Client SP Init Flow Access Policy Support in Horizon VMworld 2017 Content: Not for publication
Access Policy support for Horizon Applications Previously, SP Init launch supported only for web applications like socialcast, Salesforce, Office 365, Slack, etc. User experience was confusing or launch resulted in errors from Horizon client, file type association or other shortcuts Horizon Administrator enables Workspace ONE mode with server hostname Supported use cases: Users launch Horizon client and click on login (a.k.a SP-Init workflow) Handling file type association (FTA) by Horizon View client Application Shortcut or URL launch 25
Limitations/Known Issues Supported as of Horizon 7.2 Currently supporting only browser based flows, Workspace ONE native client flow is not supported For any change in Workspace ONE mode configuration, customer needs to remove the connection server from the server selector & to cleat the cache to see the change 26
Gotchas!
Horizon Metadata Expired https://kb.vmware.com/kb/2144331 Change metadata expire period to 4-5 days Make sure VMware Identity Manager syncs Horizon Entitlements once per day Also mentioned in manual: http://pubs.vmware.com/horizon-7- view/index.jsp?topic=%2fcom.vmware.horizon-view.administration.doc%2fguid-3e170c23-097f- 46D0-82BD-7CACFF04FC9A.html 28
Integrating Horizon Cloud Pod Multiple Horizon instances with Workspace ONE
Horizon Cloud Pod Architecture Layout and Sync Core tcserver IDM VA API SUSE Linux Connector Sync Traffic Connector vpostgres Connector Sync Traffic London Site / POD 1 Paris Site / POD 2 Global Entitlement Home Site AD Groups Global Finance Home Site London Paris Cloud Pod Federation 31
Horizon Cloud Pod Architecture Local Configurations 32
Horizon Cloud Pod Architecture Global Configurations 33
Agenda 1 What is Workspace ONE? 2 Setting up Horizon with Workspace ONE 3 User Experience and Demo 36
DEMO Horizon TrueSSO and Workspace ONE
Questions!