Horizon View 2FA Activation needs two AD authentifications

[ProjectD22]

Hello there!

We've newly constructed our Horizon environment from the ground up. For the access from the internet we are using 2FA. The configuration should be the same as on the old environment.

So now when I try to log in with 2FA enabled I need to enter my active directory credentials twice. The second time I need to enter the user principal name to successfully log in.

Here's the log in process (web client and desktop client):

1. Log in using AD credentials

     <AD username>

     <AD password>

2. 2FA SMS Token (RADIUS)

     <SMS Token>

3. Second Login using AD credentials

     <ad_username@ad_domain.com>

     <AD password>

This happens to both the web and windows client.

Is there a way to skip the second AD authentification?

I'm currently using Horizon View 7.11. If you need any more information, feel free to ask!

Thank you!

[Marcin4]

What kind of solution u use for 2FA?

[ProjectD22]

We are using a RADIUS from the company airlock.

Thank you!

[Shreyskar · Accepted solution]

Hi ProjectD22

Yes.You can achieve it utilizing TrueSSO technology with Horizon 7.

TrueSSO provides a way to authenticate to Microsoft Windows, retaining all of the users’ normal domain privileges, without requiring them to provide AD credentials!

Take a look:

Introducing True SSO (Single Sign-On) in VMware Horizon 7 | VMware End-User Computing Blog

VMware Horizon 7 True SSO: Setting Up In a Lab | VMware End-User Computing Blog

Mark the reply as helpful/correct if it helps you.

[ahoien]

We just built a Horizon 7.8 environment last month and had the same issue using Microsoft Azure MFA.  Are you using UAG's or security servers?  We had the same issue when using UAG's.  Dumped them for security servers to resolve the double AD auth issue. I believe the issue doesn't exist if you have RSA for 2FA.

[ProjectD22]

We are using a security gateway. But I've found a solution to this problem. I just had to enable the following check box:

Interestingly, this option was not needed in the old environment.