Rule ID
SV-286754r1291681_rule
Version
V1R1
CCIs
Before clients can select a desktop or application to access, they must first authenticate to the broker, which is the connection server itself. If the client is accessing the broker directly, then the allowed authentication methods must be specified. These include RADIUS, SecurID, username/password and smart card. In the DoW, common access card (CAC) login must be enforced at all times, for all client connections. This can be accomplished through the native capabilities of the connection server or through a paired (separately configured) SAML 2.0 IdP. If the client is connecting through the Unified Access Gateway (UAG) appliance, this requirement does not apply.
If the connection server is paired with a UAG that is performing authentication, this requirement is not applicable. 1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Servers. 3. In the right pane, select the "Connection Servers" tab. 4. For each connection server listed, select the server and click "Edit". 5. Click the "Authentication" tab. 6. Locate the drop-down for "Smart card authentication for users" under "Horizon Authentication". If "Smart card authentication for users" is set to "Optional" or "Not Allowed", a SAML Authenticator must be configured, and that external IdP must be configured to require CAC authentication. If these requirements are not met, this is a finding. If "Smart card authentication for users" is set to "Required" on each of the listed Connection Servers, this is not a finding. If another form of DoW-approved PKI is used and configured to be required for client logins, this is not a finding.
If the connection server is paired with a UAG that is performing authentication, this requirement is not applicable. Option One - Use Horizon's native CAC authentication: 1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Servers. 3. In the right pane, select the "Connection Servers" tab. 4. For each connection server listed, select the server and click "Edit". 5. Click the "Authentication" tab. 6. Under "Horizon Authentication", in the drop-down below "Smart card authentication for users", select "Required". 7. Click "OK". Option Two - Delegate CAC authentication to an external IdP: 1. Log in to the Horizon Connection Server Console. 2. From the left pane, navigate to Settings >> Servers. 3. In the right pane, select the "Connection Servers" tab. 4. For each connection server listed, select the server and click "Edit". 5. Click the "Authentication" tab. 6. Under "Horizon Authentication", in the drop-down under "Smart card authentication for users", select "Optional" or "Not Allowed". 7. In the drop-down under "Delegation of authentication to Horizon (SAML 2.0 Authenticator)", select "Allowed" or "Required" depending on the native capability settings in the previous step. 8. Click "Manage SAML Authenticators". 9. Click "Add", then complete the necessary fields. 10. Verify "Enabled for Connection Server" is checked, then click "OK" on each subsequent screen to save the settings. 11. Restart the Omnissa Horizon Connection Server service for changes to take effect.