VMware Workspace ONE Community
ITTech2002
Contributor
Contributor
Jump to solution

VMware View Horizon Workspace (Invalid SAML credentials)

I am getting this error accessing a desktop using Horizon Workspace...

Unable to launch the View desktop. Please contact your Administrator for help (Invalid SAML credentials).

Do you know the fix to this issue?  Thank you

Tags (3)
Reply
0 Kudos
1 Solution

Accepted Solutions
neenarazdan
VMware Employee
VMware Employee
Jump to solution

Login to VC and check if  all vAPP vms and View Broker Vms show that they are syncing guest time with host.

VM>Settings>Options>VMware Tools> synchronize guest time with host.

This should take care oftime drifts.

View solution in original post

Reply
0 Kudos
12 Replies
sravuri
VMware Employee
VMware Employee
Jump to solution

@ITTech2002

Did you enable SAML authentication on View connection server?

If so, you may need to do sync the pools again from connector.

https://<connector hostname>/hc/admin/

dhenderson00
Contributor
Contributor
Jump to solution

I'm having the same problem.  Unable to launch the View desktop. Please contact your Administrator for help (Invalid SAML credentials).

I removed the SAML authentication settings from Horizon View.  Added it back in.  I sync'd the pools up and still receive the same error.

Reply
0 Kudos
neenarazdan
VMware Employee
VMware Employee
Jump to solution

Check following :

1. If View Dashboard is showing "Green" for SAML authenticator you added

2. In Horizon Connector, FQDN for client access is pointing correctly to View server where SAL auth is set. If FQDN is load balancer for all View Servers, ensure all View servers are cofigured to this SAML authenticator

Reply
0 Kudos
dhenderson00
Contributor
Contributor
Jump to solution

It's showing green on the dashboard.  I don't have a load balancer and the URL is set using the FQDN to the view servers.

Reply
0 Kudos
neenarazdan
VMware Employee
VMware Employee
Jump to solution

Can you check View Log to see what it's complaining about?

Also ensure that there is no time lag between View and Horizon.

You can check Horizon vApp current time and relative drift information from :

https://Configurator FQDN/cfg/system

Reply
0 Kudos
dhenderson00
Contributor
Contributor
Jump to solution

The time is within 30 seconds from the vApp and the connection brokers.  The error that was logged on the connection broker is: SAML access denied because of invalid assertion/artifact.

Reply
0 Kudos
neenarazdan
VMware Employee
VMware Employee
Jump to solution

Is there any other error informarion in View log. Look for pattern "Assertion XXX is not valid before …”  OR   “Assertion XXX is no longer valid. …”

OR “… Too late by x milliseconds ...

If you find above pattern, it means 30 seconds drift is cause of the issue.

if you dont find this patterm, check connector.log and provide error information

Reply
0 Kudos
dhenderson00
Contributor
Contributor
Jump to solution

Unbelievable...  it was due to time issues:

DEBUG (0B14-0CD4) <TP-Processor1> [SamlAuthFilter] (SESSION:a35e_***_dadd) Problem determining UPN from SAML Auth: com.vmware.vdi.broker.filters.SamlAuthFilter.a(SourceFile:269)
com.vmware.vdi.common.saml.SamlException: Assertion _0b03ef16869b9cf709346dcb358b856b is not valid before 2013-04-04T00:56:48.737Z. Too early by 12401 milliseconds (including 15000 ms leeway)

It works now.  I just want to point out that the time was off by 12.4 seconds.  I see this happening again. 

Reply
0 Kudos
neenarazdan
VMware Employee
VMware Employee
Jump to solution

Is Horizon and View syncing time from same NTP server? Difference in time can lead to rejection of SAML

Reply
0 Kudos
dhenderson00
Contributor
Contributor
Jump to solution

The DC's and ESX hosts all use the same ntp server. 

Reply
0 Kudos
neenarazdan
VMware Employee
VMware Employee
Jump to solution

Login to VC and check if  all vAPP vms and View Broker Vms show that they are syncing guest time with host.

VM>Settings>Options>VMware Tools> synchronize guest time with host.

This should take care oftime drifts.

Reply
0 Kudos
ITTech2002
Contributor
Contributor
Jump to solution

The time was slightly off on all ESX hosts, a simple synch with the NTP server fixed the issue.

This applicaiton is very sensitive to having the correct time on all the servers.

Reply
0 Kudos