V-286763

Discussion

The Horizon Connection Server controls access to virtual desktops, published applications, and other organizational resources. To ensure accountability and prevent unauthorized access, users must be positively identified and authenticated before access to any Horizon-managed resource is granted. The Horizon Connection Server includes an "Unauthenticated Access" capability that allows users to launch designated published applications without authenticating to the Horizon environment. This feature is typically intended for kiosk-style deployments or applications that implement their own authentication and authorization mechanisms. While convenient in certain commercial use cases, unauthenticated access bypasses the primary authentication controls provided by the Horizon infrastructure and reduces assurance that users have been properly identified before accessing organizational resources. Allowing access without authentication increases the risk of unauthorized use, weakens accountability, and prevents the organization from reliably attributing actions to an individual user. Even when an application provides its own authentication mechanism, permitting unauthenticated access through the Horizon Connection Server bypasses centralized access control and may create opportunities for misuse or unauthorized access to resources. To maintain positive user identification, enforce organizational authentication policies, and preserve accountability for access to organizational resources, the Horizon Connection Server must not permit unauthenticated access. All users must be authenticated through an approved authentication mechanism before access to Horizon-managed resources is granted.

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Servers.

3. In the right pane, click the "Connection Servers" tab.

4. For each connection server listed, select the server and click "Edit".

5. Click the "Authentication" tab.

6. Locate the drop-down for "Unauthenticated Access" under "Horizon Authentication".

If "Unauthenticated Access" is set to "Enabled", this is a finding.

Note: If "Smart card authentication for users" is set to "Required", this setting is automatically disabled and greyed out, making this control not applicable.