V-286752

Discussion

The Horizon Connection Server temporarily caches user authentication information to facilitate SSO access to entitled virtual desktops and applications following successful authentication to the broker. While this capability improves usability by reducing the number of authentication prompts presented to the user, retention of authentication information for extended periods increases the risk of unauthorized access. If cached SSO credentials remain available for an excessive amount of time, an unauthorized user who gains access to the client device, active session, or authentication context may be able to access virtual desktops and applications without independently proving their identity. Extended credential caching reduces assurance that access requests originate from the authenticated user and increases the potential impact of unattended workstations, compromised endpoints, or session hijacking. To minimize this risk, cached SSO credentials must be retained only for the minimum period necessary to support the intended user experience. Authentication information cached by the Horizon Connection Server must be discarded after 15 minutes. Once the 15-minute period has elapsed, users must reauthenticate before establishing new desktop or application sessions, even if they remain connected to the broker. This requirement helps maintain positive user identification, reduces exposure associated with cached credentials, and preserves accountability for access to organizational resources.

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Global Settings.

3. In the right pane, click the "General Settings" tab and locate "Discard SSO credentials" under "Single Sign-On (SSO) Settings".

If the "Discard SSO Credentials" setting is set to "Never", or the value of "Discard SSO Credentials" is set to anything greater than 15 minutes, this is a finding.