Vmware 4.6 win7 and Gemalto

[jwiseman]

I'm trying to set up a 2 factor authentication to a virtual desktop. I have the backend Vmware stuff configured already. The problem that I'm having  seems to be on my physical machine and the way that the View client accesses the Gemalto cards. I'm able to access/configure the cards via the Gemalto web interface and thier diagnostic tools don't show any errors. However, when I use the view client, it fails immediately saying that "The view connection server connection failed. Smart Card or Certificate authentication is required."

I am experiencing this on a desktop and a laptop. The laptop has an internal card reader which gemalto's diagnostic test picked up (see below)

***** Test Card Connect : *****

Reader :  Broadcom Corp Contacted SmartCard 0

Connect to card : No Card Detected

Reader :  Gemplus USB Smart Card Reader 0

Connect to card :Card Present

ATR (length 9 bytes): 3B 16 96 41 73 74 72 69 64

I've also noticed that the either reader utilizes the gemalto .net driver when the card is inserted. I thought there may be a conflict between the two readers but I'm experiencing the same thing on the desktop which only uses the usb reader.

The usb reader that I'm using is hwp114112b

Has anyone else experienced this issue and how was it resolved?

[continuum]

Hi and welcome

I moved your post from the WS section to the View forum

[Linjo]

Did you installa the Smartcard support in the View Agent? Its not enabled by default.

// Linjo

[jwiseman]

Thank you for your response. I don't think that It's even getting to that point though. The View client dies as soon as I hit connect. It looks like it never able to access the information on the card. Hoenestly, I don't remember an option for smart cards on the agent configuration. I just remember turning on USB redirection. How can check?

[jwiseman]

It's not even getting to that point. The View client dies as soon as I hit connect. It looks like it never able to access the information on the card.

[Linjo]

You do not have to redirect the USB Cardreader to the VM, it should be able to share it with the client.

Would you mind to post the log-files?

// Linjo

[grossag]

Can you post client logs that show why the client is dying?

[jwiseman]

Which logs would you like to see? Sorry I'm new to setting this type of system up.

This is off of the security server.

10:47:46,396 INFO  <2232> [ws_TunnelService] Log for VMware View Security Server, version=4.6.0 build-366101
10:47:46,396 INFO  <2232> [ws_TunnelService] hostname=Idc2-caeVsec-2
10:47:46,396 WARN  <AJP-14> [j] (Request15) AJP connection test failed: com.vmware.vdi.ob.tunnelservice.dy: Failed to write data to server: java.net.SocketException: Software caused connection abort: socket write error
14:41:15,327 WARN  <AJP-18> [j] (Request19) AJP connection test failed: com.vmware.vdi.ob.tunnelservice.dy: Failed to write data to server: java.net.SocketException: Software caused connection abort: socket write error

[grossag]

This blog post should give more information on how to troubleshoot it: http://blogs.vmware.com/view/2010/10/troubleshooting-smart-card-authentication-using-the-windows-vie...

[jwiseman]

Thank you. Here are the client logs.

08:41:02,741 INFO  <3856> [wswc] Log for VMware View Client, version=4.6.0 build-366101
08:41:02,741 INFO  <3856> [wswc] hostname=blv-smrtcd-01.caeglobal.com
08:40:57,500 INFO  <TimerService> [wswc_tunnel] Tunnel Unnamed: Client is disconnecting the tunnel on no activity timeout
08:41:02,741 INFO  <DesktopWindow> [wswc_rdp] The connection to the remote computer ended.
08:41:02,757 INFO  <TimerService> [wswc_tunnel] Tunnel Unnamed: Client session will timeout in 5 minutes
08:41:02,757 INFO  <TimerService> [MessageFrameWork] Aborting channel on missing keep alive responses
08:41:03,771 INFO  <TunnelRead> [wswc_tunnel] Tunnel Unnamed: disconnected, trying to reconnect
08:41:33,676 ERROR <TunnelRead> [MessageFrameWork] Socket: connect: Unable to resolve name 'view.caeglobal.com', Error 11004 (The requested name is valid, but no data of the requested type was found.)
08:41:33,676 INFO  <TunnelRead> [wswc_tunnel] Tunnel Unnamed: Could not start server view.caeglobal.com, reason: Socket: connect: Unable to resolve name 'view.caeglobal.com', Error = 11004 (The requested name is valid, but no data of the requested type was found.)
08:41:39,152 ERROR <TunnelRead> [wswc_tunnel] HttpConnection: BAD HttpResponse
08:41:39,152 INFO  <TunnelRead> [wswc_tunnel] Tunnel Unnamed: reconnect refused, the server has probably restarted
09:02:55,354 INFO  <MessageFrameWorkDispatch> [wswc] VMware View Windows Client received shutdown signal
09:02:57,694 INFO  <Main Thread> [wswc] VMware Windows Client stopped (exit code 0)
10:17:54,309 INFO  <3824> [MessageFrameWork] Program 'wswc - VMware View Client' started, version=4.6.0 build-366101, pid=2932, buildtype=release, usethread=1, closeafterwrite=0
10:17:54,324 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_command - VMware View Connection Server Command Handler' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,324 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_http - VMware View Client HTTP Handler' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_rdp - VMware View RDP Handler' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_rsa - VMware View RSA Handler' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_tunnel - VMware View Secure Tunnel Client' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_ui - VMware View Client UI handler' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'wssm_uimanager - VMware View Framework UI Host' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_usb - VMware View Virtual USB Device Service' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,340 INFO  <logloaded> [MessageFrameWork] Plugin 'ws_winauth - VMware View Framework Windows Authentication Support' loaded, version=4.6.0 build-366101, buildtype=release
10:17:54,355 INFO  <Main Thread> [wswc] Windows Client started
10:18:16,305 WARN  <MessageFrameWorkDispatch> [wswc_http] Resending server get-configuration when GPO SmartCardWaitForPrelogin is set but no prelogin message
10:18:17,303 ERROR <MessageFrameWorkDispatch> [wswc_command] brokerGetConfiguration (configuration) response xml ERROR = Authentication failure
10:18:33,355 WARN  <MessageFrameWorkDispatch> [wswc_http] Resending server get-configuration when GPO SmartCardWaitForPrelogin is set but no prelogin message
10:18:34,338 ERROR <MessageFrameWorkDispatch> [wswc_command] brokerGetConfiguration (configuration) response xml ERROR = Authentication failure
10:24:52,077 INFO  <MessageFrameWorkDispatch> [wswc_tunnel] Data frame policy set to NEGOTIATE (proposing 0 bytes)
10:24:52,077 INFO  <MessageFrameWorkDispatch> [wswc_tunnel] Received chunk window set to 2
10:24:52,420 INFO  <TunnelRead> [wswc_tunnel] Tunnel Unnamed: connected to server 'view.caeglobal.com', start tunnel protocol
10:24:52,514 INFO  <TunnelRead> [wswc_tunnel] Tunnel Unnamed authenticated Ok, set state = running
10:24:58,567 INFO  <DesktopWindow> [wswc_rdp] RDP control version = 6.1.7601
10:25:00,595 INFO  <DesktopWindow> [wswc_ui] Connecting client to agent via socket channel

[grossag]

At which point in the logs did you run into the issue that you are reporting?

[jwiseman]

This might a little more specific. These are my last two login attemps. Right now it the view client doesn't seem to recognize the card reader or at least the cert on the card. The error that I'm getting is when I attemp to logon is "The View Connection Server connection failed. Samrt Card or Certiifcate authentication is required." What is the prelogin message that it is asking for?

11:43:18,886 INFO  <NodeManagerWatcher> [MessageFrameWork] Unable to connect to 127.0.0.1 as user CAEGLOBAL\JWeissmann, authentication failed
11:43:24,721 INFO  <MessageFrameWorkDispatch> [wswc] VMware View Windows Client received shutdown signal
11:43:25,392 INFO  <TunnelRead> [wswc_tunnel] Tunnel Unnamed: STOPPED by peer, properties:
reason = Logout request by system
11:43:27,092 INFO  <Main Thread> [wswc] VMware Windows Client stopped (exit code 0)
11:43:27,576 INFO  <2660> [MessageFrameWork] Program 'wswc - VMware View Client' started, version=4.6.0 build-366101, pid=3900, buildtype=release, usethread=1, closeafterwrite=0
11:43:27,607 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_command - VMware View Connection Server Command Handler' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,607 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_http - VMware View Client HTTP Handler' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,607 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_rsa - VMware View RSA Handler' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <logloaded> [MessageFrameWork] Plugin 'ws_winauth - VMware View Framework Windows Authentication Support' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_rdp - VMware View RDP Handler' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_tunnel - VMware View Secure Tunnel Client' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_ui - VMware View Client UI handler' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <logloaded> [MessageFrameWork] Plugin 'wssm_uimanager - VMware View Framework UI Host' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_usb - VMware View Virtual USB Device Service' loaded, version=4.6.0 build-366101, buildtype=release
11:43:27,622 INFO  <Main Thread> [wswc] Windows Client started
11:43:58,011 WARN  <MessageFrameWorkDispatch> [wswc_http] Resending server get-configuration when GPO SmartCardWaitForPrelogin is set but no prelogin message
11:43:59,010 ERROR <MessageFrameWorkDispatch> [wswc_command] brokerGetConfiguration (configuration) response xml ERROR = Authentication failure
11:48:36,628 WARN  <MessageFrameWorkDispatch> [wswc_http] Resending server get-configuration when GPO SmartCardWaitForPrelogin is set but no prelogin message
11:48:37,626 ERROR <MessageFrameWorkDispatch> [wswc_command] brokerGetConfiguration (configuration) response xml ERROR = Authentication failure
11:49:29,839 WARN  <MessageFrameWorkDispatch> [wswc_http] Resending server get-configuration when GPO SmartCardWaitForPrelogin is set but no prelogin message
11:49:30,822 ERROR <MessageFrameWorkDispatch> [wswc_command] brokerGetConfiguration (configuration) response xml ERROR = Authentication failure
11:52:02,127 WARN  <MessageFrameWorkDispatch> [wswc_http] Resending server get-configuration when GPO SmartCardWaitForPrelogin is set but no prelogin message
11:52:03,110 ERROR <MessageFrameWorkDispatch> [wswc_command] brokerGetConfiguration (configuration) response xml ERROR = Authentication failure

[grossag]

The warning about the prelogin message doesn't mean anything.  Please review the wiki page that I posted in an earlier comment.  It walks you through the process of troubleshooting this issue.

[jwiseman]

Ahh, sorry I sent the wrong log over.

I am getting this:

2011-10-05 11:43:57,169 DEBUG <MessageFrameWorkDispatch> [wswc_http] HttpSendRequest returned ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED

However, the certificate is not being loaded into the personal store when the card is inserted so it looks like I have a middleware issue.

[jwiseman]

I still working this out.

can anyone tell me if the error message "The View client Connection Server connection Failed. Smart Card or Certificte authentication is required. " is different when there is no cert on the card or when the card has a cert  that is inconpatible (for example a cert from a different domain)?

[VMWARESECURESYS]

I would recomend using a different security method.  Something like RSA, or one I like is GoldKey (goldkey.com).

[VMSE]

Sorry if I am totally off base here - but at the top of the log it looks like there is some fundamental connectivity issues with getting to view.blah.blah. It states it can resolve the name and it is valid but cannot connect to it.

Unable to resolve name 'view.caeglobal.com', Error 11004 (The requested  name is valid, but no data of the requested type was found.)

That is the entry from your log and it looks like just after that the View Client is shutting down.