V-286753

Discussion

The Horizon Connection Server supports a "Log On As Current User" capability that allows a Horizon Client to use the credentials associated with the user's local endpoint session to authenticate to the Horizon environment. While this feature can improve user convenience by reducing authentication prompts, it reduces the assurance that the user accessing Horizon resources has been independently and currently authenticated by the Horizon infrastructure. When "Log On As Current User" is enabled, the Horizon Connection Server relies on the authentication state of the endpoint rather than requiring the user to directly authenticate to the Horizon environment. As a result, the server may be unable to verify the authentication method used at the endpoint, determine whether current organizational authentication requirements have been satisfied, or ensure that certificate-based credentials remain valid and have not been revoked since the endpoint session was established. Use of endpoint-derived credentials may also increase the risk of unauthorized access from unattended, compromised, or improperly authenticated systems. Requiring users to authenticate directly to the Horizon Connection Server ensures that current authentication policies, certificate validation requirements, account restrictions, and revocation checks are consistently enforced at the time access to Horizon resources is requested. To maintain strong user authentication and ensure compliance with organizational identity assurance requirements, the "Log On As Current User" capability must be disabled.

Check Content

1. Log in to the Horizon Connection Server Console.

2. From the left pane, navigate to Settings >> Servers.

3. In the right pane, select the "Connection Servers" tab.

4. For each connection server listed, select the server and click "Edit".

5. Click the "Authentication" tab.

6. Locate the "Accept logon as current user" checkbox under "Current User Authentication".

If the "Accept logon as current user" checkbox is checked, this is a finding.

Note: When "Smart card authentication for users" is set to "Required", this setting is automatically disabled and greyed out, and this control would be not applicable.