From Client to Horizon, there is a chain of authentication options, and its up to you to choose what you need.
The first scenario I described (using Workspace ONE Access + VMware Verify) goes like this:
| Client -> | Workspace ONE Access -> | VMware Verify -> | Workspace ONE Access -> | Horizon True SSO -> | Horizon |
| Initiate Authentication | Access Policy demands VMware Verify | Verify performs authentication | Translate Verify to SAML Token | Translate SAML Token to Smart Card | Logon with Smart Card |
If you already have Okta or Ping your route can be different:
| Client -> | UAG -> | Okta -> | UAG -> | Horizon True SSO -> | Horizon |
| Initiate Authentication | Requires SAML; redirect to Identity Provider | Performs Auth according your needs and returns a SAML Token | Accept SAML token and allow access to Horizon | Translate SAML Token to Smart Card | Logon with Smart Card |
Unfortunately the answer as always is "it depends" on your requirements and available services. If you answer this questions, I maybe can you help find a proper solution:
Do you already have an Identity Provider (IdP)? If no, get one.
If yes, which one (Workspace ONE Access, ADFS, Ping, Okta, AzureAD, ...)?
Does your IdP already offer a passwordless authentication method?
To your last question: in essence a Passwordless authentication approaches the auth model as
- something that you have (mobile device or security key) with
- something that you are (Biometrics, PIN) in a unified auth flow,
thereby replacing the requirement of something you know (password) and there by getting its name – Password-less!
Hope this helps a little to better understand, that there is no simple answer to your question 😉.
- Alex
