2303 Client - Smartcard login

[MathiasSorensen]

Hello all. 

I have an issue that I have been trying to solve over the last few days and now hope someone can assist with. 

Quick overview on the setup, to hopefully give you a better picture. We are using thin clients (Igel and HP) running Igel OS 11 as endpoints using smartcards for a larger healthcare organization. Idea is that users walks up to the endpoint, insert their smartcard in the reader, type in their pin and they would get access to a horizon VDI. This means the Horizon client login screen is autostarted on boot, and is restarted after the user pulled the card, or ended the session.
This is currently running perfectly with 2206, as the Horizon client login screen is waiting at the smartcard login screen, with the secondary option to manually login. 

Issue: After updating our test environment from 2206 to 2303 we noticed that the smartcard login "option" is bypassed when the Horizon client is started, unless the user has already put in their smartcard. If no smartcard is present when the client/login screen is started, it goes straight to the manual login option, and needs a restart to notice the smartcard. I also tested this with Horizon client 2209 and 2212 - same result. 

We've talked with Igel as if this was something on their end, which they said no to, I've attempted to look through all kinds of settings to see if I missed anything (I am not super experienced with Horizon yet) and nothing. 

Have I missed something, is there some setting we can tweak or is there some kind of workaround we can use? Any good ideas floating around? 

Just for good measures, since this is also what Igel suggested, we are not interested in logging in with the AD/Smartcard in the IGEL OS itself, as it's only used as a gateway/portal.

[hongshengl]

From my local testing on Ubuntu 2004, the same behavior when I use horizon Linux client 2206, 2212 and 2303. If there has no smart card attached and the broker connection server choose "Optional" as Smart card authentication for users type, the AD login page will automatically. There is no difference on user experience on Ubuntu and is there some special settings on you local IGEL machine? Another suggestion is that, if you want user always to use smart card to login, user can choose the "Required" as Smart card authentication for users type in connection server settings.

[MathiasSorensen]

This is getting interesting. Since I was running a bunch of tests anyway, I tried having 5 different devices with differet OS and FW. 3x IGEL OS11 (Linux/Ubuntu based), one with Horizon client 2206, 2212 and 2303. The 2206 is the only one doing it. Also tried with all 3 devices running the same FW with the same client, all with factory reset and reinstallation of the FW. Same result. 
I then tried with the windows client, just on 2206 and 2303. None of them did it. 

Sadly that "feature" is something we've been using quite a bit on our current machines, which is why we are bit sad it wasn't an actual feature after testing an update before going through and replacing 2000 devices. Maybe something to bring up as suggestion, to either allow that pause, or maybe just allow the page/broker to automatically register a smartcard (chip/contactless) or even biometrical input and just having the AD login as a backup. 

I do appreciate the suggestion. It is something we have been considering due to this, but we need the manual AD login, as we have about 50-60 external contractors and consultants (out of 12000 employees) that needs access aswell, but can't get a card issued (government healthcare). 

Any ideas or comments are more than welcome. I'll keep this updated with whatever we do for a solution. 

[hongshengl]

This is the common/expected behavior that If no smartcard is present when the client/login screen is started, horizon client goes straight to the manual login option. And could you please explain your detail requirement on "Horizon client login screen is waiting at the smartcard login screen, with the secondary option to manually login."? you means horizon client will stack at smart card login dialog and wait for user to insert smart card? I am confused that this scenario that if there always have no smart card, how long horizon client will move to AD login from your testing. It will be appreciated that if you list the detail steps about the user scenario that you tested.

[MathiasSorensen]

Hello again. 

I apologize, my previous message wasn't very clear. 

Yes, that is exactly what I mean. The login screen of the Horizon client would stack/hold on the Smartcard dialog and await a user to put in their smartcard. 

What worked for us previously, was exactly that:

Igel OS 11 (Ver. 11.08.230) would run the Horizon Client (ver. 2206-8.6.0-20094634) with autostart, so the Horizon Client, along with the login UI was always present when the device was not used.
The Smartcard dialog would show up as the initial option, even without a smartcard inserted when the Horizon Client was booted, as there could be hours in between the boot and the next login from a user. The smartcard dialog would remain open until it was used, or manually closed via the "Cancel" button on the UI - which would then switch to the AD login option. 
There was no set timer on when the login dialog would change from smartcard to AD, and for our use scenario - it is not needed. This is due to the low amount of users not having smartcard access and that would manually login (low amount, but sadly still needed).  

As soon as a card was inserted, it was recognized via our authentication client and the user could immediately login with their pin code and gain access to their virtual desktop - not having to start the Horizon Client manually or even choose which virtual desktop to work on as this was already done. Reason for this is to ultimately save time for the end user - fx. nurses and doctors on a hospital. 

Same scenario when a smartcard was removed. The Horizon client would be closed upon removal and the login UI would reappear with the smartcard dialog showing and remaining on the screen. 

[hongshengl]

thanks for your clarification and I know your user scenario.

I think there are something special configuration on your igel OS 11 system. Could you please double check the file under the path /usr/lib/vmware/view/pkcs11 and tell me the result? I suspect that maybe you had added some other PKCS11 modules into this path so horizon client will automatically open the smart card login dialog even no physical smart card reader plugin.

thanks,