PCoIP and ZCM (Zenworks)

[MrBeatnik]

Hello!

• View 5.0
  
• Windows 7
  
• Zenworks 10.3 (we also have Novell Client, but hopefully that is disappearing soon) - Zenworks uses AD as usersource.
  

When we use RDP to connect to a provisioned machine, Zenworks logs in automatically as it should.

Seems like "credential chaining" works fine; View/Novell Client/Zenworks/Windows all get logged in through SSO.

However, when using PCoIP, Zenworks does NOT get logged in; we have to manually do a log in once at the desktop.

The others SSO fine - View/Novell Client/Windows are happy; it's just Zenworks that has the issue under PCoIP.

The order of install on our master was:

Novell Client, Zenworks, View Agent.

Does anyone have any information on this?

I have seen a couple of posts that mainly relate to XP (which have GINAs). With Windows 7, there is no GINA to chain, so we still have an issue, and I haven't found any solution so far. I see there is a ZCM11 appliance on the marketplace which may help, but unfortunately this is for v11 and not v10.3 which we are running. We will be moving to 11 eventually, but unsure on the time scale...

Thanks!

[StephanEPP]

Hi,

from Novell we have got the information that VMWare View 4.6 is full supported with ZCM 11 SP2 and W7. View 5.0 is not supported!!

We have a View 5.0 installation and it worked with ZCM SP2 and PCoIP and W7. It don't work with ZCM11 SP1!!!

Important from my point of view was that we have startup from the scratch with an ZCM installation. The first try was to update our "old" installation ZCM10 to ZCM 11 over SP1 to SP2. This installation never worked with View 5.0 and PCoIP but maybe worked in other environments.

Stephan

[MrBeatnik]

Hi,

I actually got the same message from Novell just a couple of days ago, although it was unclear if they meant View 5.0 was unsupported, or vSphere 5. After chatting to VMWare, we decided that it probably meant vSphere as there are no major changes in the way that PCoIP sends the credentials to the VMs from View 4.6 to View 5.0, however the infrastructure that it is hosted on (vSphere) may cause the main headache.... I am going to reply to Novell just now to clarify that.

In your current setup, are you using View 5.0 on vSphere 5?

We are currently upgrading our ZCM infrastructure from 10.3 to 11 (will be SP2 at least by thte time it's completed).

The problem has not just been with Zenworks...

VMWare say there are other companies that take credentials that do not work with Windows 7 and PCoIP. In these cases the 3rd party software has been updated to workaround the problem, but it appears that VMWare acknowledge that the way PCoIP sends the data is the issue.

Thanks for the details

[StephanEPP]

Hi,

we are running under vSphere 5 and View 5. We have never tried to run earlier versions of  vSphere  with View 5.0.0 build-481677

The officical answer from Novell was:

Stephan,  4.6 is fully supported on ZCM 11.2 and that is the first version where  VMWare View or VDI had full support, as far as I remember.  ZCM 11.2 was just released a few weeks ago. 11.3 will be released in  12-18 months but no specific timeframe beyond that has been decided.  There is a possibility that an update to 11.2 such as 11.2.1 or 11.2.2  may include support for 5.0 but likely support will not be added until  11.3. In most cases such as this, support is added with a new release  but back-patches are not made because, as with VMWare View 5.0, there is  significant changes in the way the agent operates that would need to be  made. There would likely not be patches for 11.1 or 11.2.  I will add your notes to the active defects or enhancement requests and  will put you on my list for updates.

Good Luck

[kmuthanna]

We are having a similar issue where GINA chaining (VMWare + our cred provider) on Windows 7. It all works fine in XP.

The VMWare credential provider appears to be fully custom and therefore requires us to provide a special workaround in order to properly chain into it in the win 7 deployments.

Have you had any luck resolving this issue or any insights you have gathered so far?

Appreciate a response.

Thanks,

-Kavya

[MrBeatnik]

The concept of "GINA" has changed from Windows XP to Windows 7 (and Vista); essentially, there is no GINA, but instead a "credential provider API". This means it cannot be "chained" as you may have done in XP. Instead, credentials are fed to the API, and anything registered should receive the credentials.

Unfortunately, PCoIP does not appear to feed the credentials to the API, so nothing is passed through correctly (I don't know the exact way PCoIP interfaces with the API, but this is how I understand it).

Novell have altered the way that Zenworks collects credential details, and I have heard that ZCM 11.2 can do the job, but may not be "supported". Official word from Novell is that 11.3, probably next year, is likely to address the situation in a supported manner.

It seems that the PCoIP SSO is affecting many cred providers, but since its a Teradici development, VMWare can't fix it directly...