GTO455's Posts

GTO455 · ‎05-26-2020

Thank you for this. It was driving me nuts as well!

GTO455 · ‎04-20-2020

Shreyskar This error pops up when I am adding the metadata from my 2nd UAG appliance to my second Connection Server, (after the first UAG and Connection server have been configured).

GTO455 · ‎04-17-2020

Both are set to Allowed.

GTO455 · ‎04-17-2020

Yes we have SAML enabled, not truSSO. This is only happening on 1 UAG appliance, the other authenticates just fine. I checked the time earlier, and they are all on point, and pointing to the same...

Yes we have SAML enabled, not truSSO. This is only happening on 1 UAG appliance, the other authenticates just fine. I checked the time earlier, and they are all on point, and pointing to the same NTP server. This occurred last week too, but a reboot of the Connection servers fixed the issue. I believe it is Connection server related because the UAG denotes AUTH SUCCESS when a connection attempt is made. I found the following on the Connection log server during the same login attempt. 2020-04-17T12:20:26.336-04:00 ERROR (1898-20B4) <ajp-nio-8009-exec-4> [Decrypter] (SESSION:9805_***_ab1d) Failed to decrypt EncryptedKey, valid decryption key could not be resolved 2020-04-17T12:20:26.378-04:00 ERROR (1898-20B4) <ajp-nio-8009-exec-4> [Decrypter] (SESSION:9805_***_ab1d) Error decrypting encrypted key org.opensaml.xmlsec.encryption.support.Decrypter.decryptKey(Decrypter.java:717) org.apache.xml.security.encryption.XMLEncryptionException: Unwrapping failed Original Exception was java.security.InvalidKeyException: Unwrapping failed

GTO455 · ‎04-17-2020

Hello, The client is connecting directly through the UAG.

GTO455 · ‎04-17-2020

Seeing this error pop up on one of my UAG's that is behind a load balancer in my DMZ. The other seems to work fine. A reboot of the UAG's does not resolve it. Some of the posts during a Google...

Seeing this error pop up on one of my UAG's that is behind a load balancer in my DMZ. The other seems to work fine. A reboot of the UAG's does not resolve it. Some of the posts during a Google search says a CS reboot will fix it, and it seemed to work a couple of days ago when I tried. I guess it is starting to pop up every couple of days now. Does anyone know what causes this?

GTO455 · ‎04-13-2020

I have a pair of UAG's (3.9.1) set up in my DMZ using SAML Authentication with my Connection Servers (7.10). I was able to add the first UAG without issue on the Connection Server. However, wh...

I have a pair of UAG's (3.9.1) set up in my DMZ using SAML Authentication with my Connection Servers (7.10). I was able to add the first UAG without issue on the Connection Server. However, when I attempt to add the information for the second UAG to the Connection Server, I am getting the following error; I have confirmed the hostname is correct and I cannot add it to either Connection Server in my environment. Any ideas?

GTO455 · ‎04-13-2020

Yes I could, and I could log into it. I resolved the issue by removing the HTML Access link following the Branding page above.

GTO455 · ‎04-09-2020

Thanks! i did see his other pages (Part2, Part 3) but didnt see this updated page. Anyone have any idea why if HTML Access is disabled on the UAG I can still get to it?

GTO455 · ‎04-09-2020

I found a solution to this error and hopefully responding to my own post will save someone else a lot of time resolving this issue. Working with VMware support to resolve the original issue, t...

I found a solution to this error and hopefully responding to my own post will save someone else a lot of time resolving this issue. Working with VMware support to resolve the original issue, the certificate in question was imported to our Connection Server (as a pfx) and exported (with private key). Again the file was converted to PEM using the VMware recommended process. However, this time when the file was uploaded to UAG, the upload completely successfully. I should mention, this was all completed (cert creation, PFX and PEM conversions) on my Windows 10 workstation using OpenSSL for Windows 1.1.0h. Several attempts to authenticate through the UAG after the certificate was uploaded were unsuccessful. The esmanager.log file on the UAG Appliance generated ambiguous errors related to SSL; "SSL peer unverified," "a server error occurred, "Auth method(s) failed and no more auth method. Hence sending error", etc. The clients would generate an "HTTP 500 Error" or something similar with no additional information provided in the Horizon Client logs. A review of the authbroker.log again in the log bundle gave a more detailed list of the errors that were occurring, and it indicated that the formatting of the certificate was still not correct; Caused by: java.io.IOException: -----END RSA PRIVATE KEY not found at org.bouncycastle.util.io.pem.PemReader.loadObject(Unknown Source) ~[bc-fips-1.0.1.BC-FIPS-Certified.jar:?] at org.bouncycastle.util.io.pem.PemReader.readPemObject(Unknown Source) ~[bc-fips-1.0.1.BC-FIPS-Certified.jar:?] at org.bouncycastle.openssl.PEMParser.readObject(Unknown Source) ~[bcpkix-fips-1.0.1.BC-FIPS-Certified.jar:?] at com.vmware.horizon.pki.util.CertUtilities.parsePemKeyPair(CertUtilities.java:168) ~[pki-util-1.0.3-SNAPSHOT.jar:?] at com.vmware.horizon.auth.saml.SamlUtils.parsePemKey(SamlUtils.java:142) ~[auth-0.1.jar:20.06.0.0 Build 15502557] ... 80 more 04/01 14:06:59,047[tomcat-http--10]ERROR mapper.AbstractExceptionMapper: Exception while handling jersey request. com.vmware.horizon.common.api.exception.InternalErrorException: error.spMetadataXml.readError at com.vmware.horizon.connector.restapi.identity.resource.authbroker.apiauth.APIAuthResource.prepareSamlResponse(APIAuthResource.java:268) ~[APIAuthResource.class:?] at com.vmware.horizon.connector.restapi.identity.resource.authbroker.apiauth.APIAuthResource.doAuthentication(APIAuthResource.java:215) ~[APIAuthResource.class:?] at com.vmware.horizon.connector.restapi.identity.resource.authbroker.apiauth.APIAuthResource.submitAuthentication(APIAuthResource.java:142) ~[APIAuthResource.class:?] at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) ~[?:1.8.0_241] at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62) ~[?:1.8.0_241] at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43) ~[?:1.8.0_241] at java.lang.reflect.Method.invoke(Method.java:498) ~[?:1.8.0_241] So although the UAG Admin GUI said the certificate upload was successful, it really wasn't. Further searching on the Internet for a resoultion found this seemingly unrelated VMware KB article. However, following the directions in the article, the certificate was uploaded to the UAG appliance and converted using the following command in the CLI; openssl rsa -in original_key.pem -out new_key.pem The certificate was then re-deployed, certificate re-installed, new SAML information generated, and the server began accepting smart card PIN and authenticating users. I guess the moral of the story is to do all your openssl certificate creation, conversion on the UAG appliance, or at least use a version of Openssl that is the same as the appliance you are deploying.

GTO455 · ‎04-08-2020

Hi Guys, I've recently deployed a UAG (3.9.1) on my DMZ for my users and I have a couple of questions regarding its behavior. We're using PCoIP only, and not BLAST. 1. I noticed if I disabl...

Hi Guys, I've recently deployed a UAG (3.9.1) on my DMZ for my users and I have a couple of questions regarding its behavior. We're using PCoIP only, and not BLAST. 1. I noticed if I disable HTML access in the UAG under the Horizon settings, and I enable HTML access on a random desktop pool in Horizon, I can log in through the UAG using Horizon HTML Access and see the enabled pool. Is this the expected behavior or is something configured incorrectly? Again, HTML access is disabled on the UAG. Is there a way to brand the landing page of the UAG? If possible, I would like to remove the links to the VMware downloads page and the HTML access links, and just have our company logo. Thanks!

GTO455 · ‎03-26-2020

Hey Folks, I'm trying to set up a UAG (3.9.1) for my users. In our environment we use smart cards, so I am attempting to configure X.509 and it is failing. If the UAG is configured with Userna...

Hey Folks, I'm trying to set up a UAG (3.9.1) for my users. In our environment we use smart cards, so I am attempting to configure X.509 and it is failing. If the UAG is configured with Username/Password it works fine. I have a cert from external CA in "crt" format. Following the UAG Guide and setting up SAML, I am trying to convert the cert to one line PEM format and I dont know if I am doing this correctly. The doc says: If your certificate is in PKCS#12 (.p12 or .pfx) format, or after the certificate is converted to PKCS#12 format, use openssl to convert the certificate to .pem files. For example, if the name of the certificate is mycaservercert.pfx, use the following commands to convert the certificate: openssl pkcs12 -in mycaservercert.pfx -nokeys -out mycaservercert.pem openssl pkcs12 -in mycaservercert.pfx -nodes -nocerts -out mycaservercertkey.pem openssl rsa -in mycaservercertkey.pem -check -out mycaservercertkeyrsa.pem In my case the cert I received was in "crt" format from the CA, so I converted it to "pfx" format using openssl; openssl pkcs12 -export -out certificate.pfx -inkey privateKey.key -in certificate.crt Once the file was converted to pfx, I ran the commands as described above and created the 3 files. Then I converted them to one line PEM format as the doc says to do using the awk command. However, when I went to configure the SAML settings in the UAG and uploaded the private keyfile I get the following error; Invalid PEM format. Exception message: -----END RSA PRIVATE KEY not found I checked the file in Notepad++ and it is clearly there. I even tried removing the trailing "\n" but it made no difference. I even tried uploading the normal PEM cert files (I read somewhere recently that single single conversion is no longer needed). The UAG accepts them, but authentication still fails when attempting to log in. Checking the authbroker.log file in the UAG, I found this line... Caused by: java.io.IOException: -----END RSA PRIVATE KEY not found I'm kinda stumped at this point. Can anyone offer any advice?

GTO455 · ‎03-13-2020

Hi Mike, Thanks for the quick response! I thought I was home free until I read that you were using Blast. Unfortunately we are using PCOIP for our environment. Back to the drawing board!...

Hi Mike, Thanks for the quick response! I thought I was home free until I read that you were using Blast. Unfortunately we are using PCOIP for our environment. Back to the drawing board! Thanks, Charlie

GTO455 · ‎03-13-2020

Hi Psychomike70, Did you ever find a solution to this? I'm experiencing the same issues with Windows 10 1803, SfB 2016, and the View 7.10 client. I also have an 1809 pool with the 7.10 c...

Hi Psychomike70, Did you ever find a solution to this? I'm experiencing the same issues with Windows 10 1803, SfB 2016, and the View 7.10 client. I also have an 1809 pool with the 7.10 client and SfB 2016, and video calling works without issue. Any light you can shed on this for 1803 would be appreciated! Charlie

GTO455 · ‎08-08-2019

Thank you for posting this. We just ran into this same issue on a Horizon 7.5 to 7.52 upgrade on a clustered pair of Connection servers. The upgrade wiped out a bunch of files on both servers. ...

Thank you for posting this. We just ran into this same issue on a Horizon 7.5 to 7.52 upgrade on a clustered pair of Connection servers. The upgrade wiped out a bunch of files on both servers. Luckily we had a similar environment that we just upgraded (7.3 to 7.52 that upgraded successfully last week) and were able to copy files from that Connection Server to the cluster. Good times

GTO455 · ‎04-17-2019

OK thanks. I will continue to work on this as time permits. I will post here if I find a resolution. We have the CD in the master configured as well, but removed the drive letter in Disk Manag...

OK thanks. I will continue to work on this as time permits. I will post here if I find a resolution. We have the CD in the master configured as well, but removed the drive letter in Disk Manager in hopes that it would resolve the issue. It didn't. We did find that Roxio consistently tries to access the Internet and uses IE to do so, which we block, so that might be causing some of our issues as well. It appears it defaults to using IE and its proxy engine to try to get out. I haven't been able to find another way to get around that either. cjabates FYI our environment: vSphere 6.5 View 7.5 (server & agent) App Volumes 2.14 UEM 9.4 Instant Clone Win10 Enterprise 1803 x64

GTO455 · ‎04-17-2019

Hello, Did you ever find a resolution to this? We're experiencing the "not responding yo-yo" with Roxio EasyCD, and Corel support has been of no help. Unfortunately, we need this software b...

Hello, Did you ever find a resolution to this? We're experiencing the "not responding yo-yo" with Roxio EasyCD, and Corel support has been of no help. Unfortunately, we need this software because Windows 10 won't finalize CD\DVD's, and that is a requirement for some of our users. Also, did you happen to configure your master VM with a DVD drive? cjabates Thanks!

GTO455 · ‎11-05-2018

Hello UEMdev, Sorry I havent replied sooner, I've been working on other tasks. On your suggestion, I tried approaching this issue from another path. I tried using the programs exe to stop ...

Hello UEMdev, Sorry I havent replied sooner, I've been working on other tasks. On your suggestion, I tried approaching this issue from another path. I tried using the programs exe to stop the service (there is a variable to allow that), but I can't get it to launch from the startup folder at login. I have the command from the shortcut in UEM outputting to a text file and it says: "Forwarder: Unable to stop the service: Access is denied." If I change the setting to "Ask user to Elevate" I am not prompted as a standard user (and it fails), but if I log in with an account with Administrator rights to the desktop I am prompted, allow it to run and it works. However, with the Privilege Elevation for cmd.exe and the programs exe, I can get it to run a different way. If I let the login complete, open a CMD window (unelevated) and run it from there, it works, and a an entry in the Windows Event Log is generated noting the UEM privilege elevation. So it appears to be something with the Startup folder/Startup that is preventing it from executing. I even tried going the Local Security Policy and setting all of the UAC settings to their defaults and it made no difference. I don't see any errors in the log file, and like I mentioned, it does work if I run the command manually. We're running UEM 9.4, App Volumes 2.14 and Horizon 7.5

GTO455 · ‎10-25-2018

Hi UEMdev and agalliasistju Thanks, I have tried all of the suggestions in this thread and still isn't working. I'm beginning to think someone screwed with the Local Policies on this image i...

Hi UEMdev and agalliasistju Thanks, I have tried all of the suggestions in this thread and still isn't working. I'm beginning to think someone screwed with the Local Policies on this image in a way that I can't unscrew it. There is no reason why this shouldn't be working. The script is executing fine, but the SC and NET commands within the file are not executing within the CMD window. I even tried Creating a shortcut to the file, going into Advanced Properties of the file, having it run as Administrator and then pointing UEM to launch the shortcut Converting the bat file to an exe file and using a path-based Privilege Escalation rule I did find a workaround here for the service itself, but I haven't tried it yet. Thanks to all who tried to help. If you've got something else in mind I'm up for the challenge, but I'm all out of ideas.

GTO455 · ‎10-25-2018

Hi, Yes, it runs and I have the output sent to a log file. I'm getting an Access Denied error when SC and NET try to run [SC] OpenService FAILED 5: Access is denied. The only CONDITI...

Hi, Yes, it runs and I have the output sent to a log file. I'm getting an Access Denied error when SC and NET try to run [SC] OpenService FAILED 5: Access is denied. The only CONDITIONS I have configured in UEM is that the File or Folder exists (set in both Shortcut and Privilege Escalation):

All

GTO455's Posts

Re: reverting optimization tool's background personalization settings

Re: Failed to Add SAML Authenticator

Re: This Horizon server expects to get your logon credentials from another application....

Re: This Horizon server expects to get your logon credentials from another application....

Re: This Horizon server expects to get your logon credentials from another application....

This Horizon server expects to get your logon credentials from another application....

Failed to Add SAML Authenticator

Re: A couple of questions regarding UAG deployment

Re: A couple of questions regarding UAG deployment

Re: Certificate Issues with UAG

A couple of questions regarding UAG deployment

Certificate Issues with UAG

Re: Skype for Business 2016 and Horizon View Agent

Re: Skype for Business 2016 and Horizon View Agent

Re: View Admin console issue after upgrade to 6.2

Re: Roxio Creator AppStack?

Re: Roxio Creator AppStack?

Re: Starting a Disabled Service

Re: Starting a Disabled Service

Re: Starting a Disabled Service