View 4.5 and Smart Card Setup

[mdrisser]

Hi All,

I've run into a problem that I'm hoping one of you can help me with.

I've setup a new View Connection Server, v4.5 on Windows Server 2008, and all works well. I can browse to the View Administrator, connect to a VM using View Client and also with a thin client. So all is well there.

The problem comes when I try to setup Smart Card Authentication. I created a locked.properties file following the example in the docs, placed it in install_directory\VMware\VMware View\Server\sslgateway\conf\locked.properties has the docs state, restart the service and now nothing. Cannot browse to the View Administrator, can't connect with View Client or a thin client. I've tried starting and stopping ALL of the vMware services on the machine, rebooted the machine and still nothing.

I've removed the locked.properties file, rebooted the machine, nothing. If I uninstall and reinstall View Connection Server, all is well, but as soon as I add in locked.properties, it all quits working again.

The contents of my locked.properties are:

trustKeyfile=mystore.key

trustStoretype=JKS

useCertAuth=true

The key file, mystore.key, was generated using the keytool and copied to install_directory\VMware\VMware View\Server\sslgateway\conf, just as the docs state.

I'm just out of ideas on how to fix this.

[grossag]

Do you have SSL enabled or disabled in the admin UI? And is smart card set to "Optional", "Required", or "Not Allowed" in the admin UI?

Often times you can get into the scenario you are in by setting two conflicting options. Some possible examples would be: 1) setting "useCertAuth=true" but setting smart card to "not allowed" in the admin UI, 2) Disabling SSL in the admin UI but setting smart card to "required". #2 wouldn't work because smart card requires SSL. And keep in mind that connecting to the admin UI will use the same port and http/https setting as the View Client would.

[mdrisser]

Hi grossag,

Thanks for your reply.

Here are the settings from Global Settings:

Session timeout: 1,200 minutes

Require SSL for client connections and View Administrator: Yes

Reauthenticate secure VPN connections after network interruption: Yes

Message security mode: Disabled

Disable Single Sign-On for Local Mode operations: No

Auto Update: Enabled

Pre-login message: Yes

Display warning before forced logoff: Yes

In the View Connection Server Settings, all secure tunnel and SSL options are checked, and Smart Card Authentication is set to required.

[admin · Accepted solution]

It sounds like something in your trust store is causing a problem when starting the Secure Gateway service.

When you've started your broker with the locked.properties in place, does the "VMware View Security Gateway Component" service stop shortly after startup? There may be an exception in the debug logs describing any such problem, near a line simlar to:

2010-12-01 14:38:03,199 INFO <Thread-1> Generating trust managers for client authentication

[mdrisser]

I apologize for the delay, had a few other things that needed to take priority.

I think that may have been it. I added a new certificate to the key store, which presumably regenerates the key store, and its working now.

Now I need to figure out why the SmartCard login is not being passed to the client vms......

[grossag]

You may be able to get a few hints here: http://blogs.vmware.com/view/2010/12/troubleshooting-single-sign-on.html

[mdrisser]

Adam,

I worked through that, very helpful indeed. I found that part of the problem was one of the Root CAs I need was missing from the keystore, fixed that and now I get prompted to insert a Smart Card. The problem is that my Smart Card IS inserted, have to have it to even log in. If I click on Details in the Insert Smart Card dialog box I get:

A smart card was detected but is not the one required for the current operation. The smart card you are using may be missing required driver software or a required certificate.

I get the same error from both of my card readers (Dell Smart Card Reader and SCM Microsystems), both of which work just fine for everything else. I can see both of the card readers listed in the details of the dialog, but the cards aren't showing up.

[grossag]

You need to have all of the drivers and middleware for the cards and readers installed in the remote desktop, just like you do on the client.  If you directly RDP in, you will likely see the same message.

[mdrisser]

I wish it were that simple, but RDP works just fine, again with both card readers.

[grossag]

Wait I think I was confused asking about PCoIP vs. RDP.  So you are seeing this "Insert smart card" dialog box on the View Client, right?  Can you give more of an explanation about what is and isn't working?

[mdrisser]

Here's where I'm at now:

1. Launch vMware View Client

2. Select Connection Server

3. Click Connect

4. View Client pops up a dialog box asking me to insert a smart card, which is already inserted. If I click on the Details button, I get the information presented in one of my previous posts.

I can RDP directly to the vm that View is trying to connect me to, using Remote Desktop Connection, and login successfully with the Smart Card. So I know that there is no problem with the card, the middleware or the card reader, at least outside of View.

The Readers are:

1. Dell Smart Card Reader (integrated into the keyboard)

2. SCM Microsystems SCRx31 USB Smart Card Reader

The Middleware is ActivIdentity ActivClient

[grossag]

Whenever I see this error message it means that the Windows client is being told to use a certificate that isn't available on a smart card.  The message is saying that a different certificate is available on the smart card.  The Windows client is automatically selecting the 1 relevant certificate in the certificate store and automatically using it and there is a chance that this isn't the certificate you want to use.  Make sure you have gone into ActivClient and selected Tools > Make Certificates Available to Windows.  Now make sure that the certificate you want to use shows up in Start > Control Panel > Internet Options > Content > Certificates > Personal.  You can also look at the Windows View Client's logs to see info about which certificate it selected using the directions here: http://blogs.vmware.com/view/2010/10/troubleshooting-smart-card-authentication-using-the-windows-vie... .  Once again, the key here is making sure that the certificate that the View Client is using is the same one as is on the smart card.

If you were using the 4.0 or maybe the 4.0.1 (can't remember if it has the bug too) Windows client I would say that this is a known incompatibility in the View Client with ActivIdentity cards on Vista and Windows 7.  But because you're using the 4.5 Windows client, it shouldn't be an issue as this bug is fixed in this version.

[mdrisser]

grossag,

I followed the steps in that link, and the cert is being found, and it is valid, Windows has access to it, and it is viewable in Internet Options, I use it all the time. So it seems that there is something else going on here.

Here is the excerpt from the log (NOTE: The log has been edited for security purposes)

07:32:00,611 TRACE <6616> [MessageFrameWork] sysconfig: add watch of location 'hklm\software\vmware, inc.\vmware vdm'
07:32:00,611 TRACE <6616> [MessageFrameWork] sysconfig: add watch of location 'hklm\software\policies\vmware, inc.\vmware vdm'
07:32:00,611 INFO  <6616> [MessageFrameWork] Program 'wswc - VMware View Client' started, version=4.0.1 build-233023, pid=5400, buildtype=release
07:32:00,612 TRACE <SysMessage> [MessageFrameWork] sysconfig: add watch of location 'hklm\software\vmware, inc.\vmware vdm\log'
07:32:00,612 TRACE <SysMessage> [MessageFrameWork] sysconfig: add watch of location 'hklm\software\policies\vmware, inc.\vmware vdm\log'
07:32:00,615 TRACE <6616> [MessageFrameWork] Load of language 0x409, 4 strings, load time 0 msecs
07:32:00,615 TRACE <6616> [MessageFrameWork] Resource dll loaded for langId 0x409
07:32:00,615 TRACE <6616> [MessageFrameWork] Current resource dll set to langId 0x409
07:32:00,615 TRACE <Main Thread> [wswc] wswc started
07:32:00,617 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Added, Name=System, Description=The Builtin MessageFrameWork Administration Queue, Channel=00000000
07:32:00,617 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Added, Name=wswc, Description=The program main service, Channel=00000000
07:32:00,617 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Added, Name=TraceServer, Description=Provides external trace listening support, Channel=00000000
07:32:00,618 TRACE <SharedMemListener> [MessageFrameWork] The SharedMemServer Listener is active
07:32:00,628 TRACE <Main Thread> [MessageFrameWork] Plugins_Install:C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc.exe wswc
07:32:00,628 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wswc_command.dll
07:32:00,629 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_command - VMware View Connection Server Command Handler' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,629 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wswc_http.dll
07:32:00,631 DEBUG <PluginInitThread> [MessageFrameWork] MessageFrameWork Worker Added, Name=wswc_command, Description=The View Connection Server command service, Channel=00000000
07:32:00,631 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_http - VMware View Client HTTP Handler' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,631 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wswc_rdp.dll
07:32:00,633 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_rdp - VMware View RDP Handler' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,633 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wswc_rsa.dll
07:32:00,634 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wswc_tunnel.dll
07:32:00,634 TRACE <PluginInitThread> [wswc_http] locationCookie set to MAC address: B8-AC-6F-1B-AC-BC
07:32:00,634 DEBUG <PluginInitThread> [MessageFrameWork] MessageFrameWork Worker Added, Name=wswc_http, Description=The HTTP handler, Channel=00000000
07:32:00,635 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wswc_ui.dll
07:32:00,637 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_rsa - VMware View RSA Handler' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,637 TRACE <Main Thread> [MessageFrameWork] Loading plugin: wssm_uimanager.dll
07:32:00,638 DEBUG <InitTunnel> [MessageFrameWork] MessageFrameWork Worker Added, Name=Tunnel, Description=The secure tunnel client, Channel=00000000
07:32:00,637 DEBUG <PluginInitThread> [MessageFrameWork] MessageFrameWork Worker Added, Name=wswc_ui, Description=The user interface service, Channel=00000000
07:32:00,638 DEBUG <PluginInitThread> [MessageFrameWork] MessageFrameWork Worker Added, Name=windows-password, Description=The windows password logon handler, Channel=00000000
07:32:00,638 DEBUG <InitRSA> [MessageFrameWork] MessageFrameWork Worker Added, Name=securid-passcode, Description=Implements the RSA user login interface, Channel=00000000
07:32:00,639 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_tunnel - VMware View Secure Tunnel Client' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,640 INFO  <logloaded> [MessageFrameWork] Plugin 'wswc_ui - VMware View Client UI handler' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,643 INFO  <logloaded> [MessageFrameWork] Plugin 'wssm_uimanager - VDM Framework UI Host' loaded, version=4.0.1 build-233023, buildtype=release
07:32:00,644 INFO  <Main Thread> [wswc] Windows Client started
07:32:00,652 DEBUG <InitUIManager> [MessageFrameWork] MessageFrameWork Worker Added, Name=UIManager, Description=Provides User Interface services for a session, Channel=00000000
07:32:00,658 DEBUG <connectThread> [MessageFrameWork] Unable to locate queue winauth with hint GSSAPI_Available.
07:32:00,658 DEBUG <connectThread> [wswc_ui] LoginAsCurrentUser: winauth not installed
07:32:01,428 TRACE <NodeManagerWatcher> [MessageFrameWork] SharedMemChannel connect accepted, authenticate
07:32:01,431 DEBUG <NodeManagerWatcher> [MessageFrameWork] Outgoing SharedMemory channel to machine SIER-780-W7X64.nasw.ds.army.mil connected as : NASW\Michael.Risser.OA, Authenticated through SSPI, package = NTLM, encrypting = true
07:32:01,431 TRACE <NodeManagerWatcher> [MessageFrameWork] SharedMem Connect Ok, Channel 0x022DD4A0
07:32:01,431 DEBUG <NodeManagerWatcher> [MessageFrameWork] Connection to Node Manager established.
07:32:03,017 TRACE <MessageFrameWorkDispatch> [wswc_http] HTTPCONN::CONNECT newServer, smartCardStatus=2, default=0
07:32:03,017 TRACE <MessageFrameWorkDispatch> [wswc_http] Reloaded WinInet, unloads = 1
07:32:03,018 TRACE <MessageFrameWorkDispatch> [wswc_http] useProxyPac = false
07:32:03,145 DEBUG <MessageFrameWorkDispatch> [wswc_http] HttpSendRequest returned ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED
07:32:03,145 TRACE <MessageFrameWorkDispatch> [wswc_http] SMARTCARDSTATUS none -> certificateQuery
07:32:03,227 TRACE <MessageFrameWorkDispatch> [wswc_http] brokerConnect successful
07:32:04,901 TRACE <MessageFrameWorkDispatch> [wswc_http] HTTPCONN::CONNECT newServer, smartCardStatus=1, default=0
07:32:04,902 TRACE <MessageFrameWorkDispatch> [wswc_http] Reloaded WinInet, unloads = 1
07:32:04,903 TRACE <MessageFrameWorkDispatch> [wswc_http] useProxyPac = false
07:32:04,916 TRACE <MessageFrameWorkDispatch> [wswc_http] SMARTCARDSTATUS certificateQuery -> timeForPin
07:32:04,982 DEBUG <MessageFrameWorkDispatch> [wswc_http] HttpSendRequest returned ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED
07:32:04,982 TRACE <MessageFrameWorkDispatch> [wswc_http] SMARTCARDSTATUS timeForPin -> ignoreCertQuery
07:32:04,990 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] calling WinHttpGetProxyForUrl to resolve auto proxy
07:32:07,277 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] WinHttpGetProxyForUrl FAILED, error 0 (The operation completed successfully.)
07:32:07,297 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] clientInit: InitializeSecurityContext for server 192.188.219.232
07:32:07,300 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] SSL Start Client Handshake
07:32:07,300 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] clientHandshake[1]: InitializeSecurityContext iteration 1: 1116 bytes
07:32:07,303 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] clientHandshake[2]: InitializeSecurityContext iteration 1: 6 bytes
07:32:07,303 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] clientHandshake[3]: InitializeSecurityContext iteration 1: 53 bytes
07:32:07,303 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] SSL Client Handshake Ok, req attr 0x0000001C, neg attr 0x0000819C, bufSize 16430 (header 5, message 16384, trailer 36)
07:32:07,304 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] disconnect: InitializeSecurityContext
07:32:07,304 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] SSL disconnected gracefully
07:32:07,304 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] GetCertificate: Got issuer list - US, U.S. Government, DoD, PKI, DoD Root CA 2,US, U.S. Government, DoD, PKI, DOD CA-23,US, U.S. Government, DoD, PKI, DOD CA-22,US, U.S. Government, DoD, PKI, DoD CLASS 3 Root CA
07:32:07,306 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, Risser.Michael.XXXXXXX' and user principal name 'XXXXXXX@mil'.
07:32:07,306 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert issuer is 'US, U.S. Government, DoD, PKI, DOD CA-22'.
07:32:07,306 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert matches a valid issuer. Adding cert to list.
07:32:07,306 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, XXXX.XXXX.XXXX.XXXXX' and user principal name 'XXXXXX@mil'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert issuer is 'US, U.S. Government, DoD, PKI, DOD CA-20'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert didn't match a valid issuer. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, XXXX.XXXX.XXXX.XXXXXX' and user principal name '(null)'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert does not have Smart Card Logon or Client Authentication enhanced key usage. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, XXXX.XXXX.XXXX.XXXXX' and user principal name 'XXXXXX@mil'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert issuer is 'US, U.S. Government, DoD, PKI, DOD EMAIL CA-20'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert didn't match a valid issuer. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, XXXX.XXXX.XXXX.XXXXXX' and user principal name '(null)'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert does not have Digital Signature key usage. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, XXXX.XXXX.XXXX.XXXXXX' and user principal name '(null)'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert does not have Digital Signature key usage. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, RISSER.MICHAEL.DAVID.XXXXXXXXXXXX' and user principal name 'XXXXXXXXXXXX@mil'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert issuer is 'US, U.S. Government, DoD, PKI, DOD EMAIL CA-25'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert didn't match a valid issuer. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Found cert with subject name 'US, U.S. Government, DoD, PKI, USA, XXXX.XXXX.XXXX.XXXXXX' and user principal name '(null)'.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] IsValidCertificate: Cert does not have Smart Card Logon or Client Authentication enhanced key usage. Skipping cert.
07:32:07,307 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] GetCertificate: Found 1 certificate.
07:32:07,310 TRACE <MessageFrameWorkDispatch> [MessageFrameWork] GetCryptProvFromCert: Retrieving HCRYPTPROV from provider 'ActivClient Cryptographic Service Provider'.
07:32:10,086 TRACE <MessageFrameWorkDispatch> [wswc_http] SmartCardPINDialog: CSP dialog canceled by user.
07:32:10,115 TRACE <MessageFrameWorkDispatch> [wswc_http] brokerLogon successful
07:32:10,117 TRACE <MessageFrameWorkDispatch> [wswc_ui] LogonServer got a LogonStart message
07:32:11,488 TRACE <LogonServerThread> [wswc_ui] CloseAboutDlg: Ignoring close request; not original parent.
07:32:11,489 TRACE <connectThread> [wswc_ui] ConnectDialog: Logon done, error=1
07:32:12,765 TRACE <MessageFrameWorkDispatch> [wswc_ui] Desktop count: 0
07:32:12,765 TRACE <MessageFrameWorkDispatch> [wswc_ui] Dialog count: 0
07:32:12,765 TRACE <MessageFrameWorkDispatch> [wswc] wswc start shutdown
07:32:12,765 DEBUG <MessageFrameWorkDispatch> [MessageFrameWork] System::Shutdown
07:32:12,765 INFO  <MessageFrameWorkDispatch> [wswc] VMware View Windows Client received shutdown signal
07:32:12,765 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=wswc, Channel=00000000
07:32:12,766 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=wswc_command, Channel=00000000
07:32:12,766 TRACE <Main Thread> [wswc_command] mfwPluginDll wait for threads to go
07:32:12,766 TRACE <SharedMemListener> [MessageFrameWork] The SharedMemServer Listener is shutting down.
07:32:12,766 TRACE <Main Thread> [wswc_command] mfwPluginDll: all threads gone
07:32:12,766 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc_command.dll, hMod = 0x023D0000
07:32:12,767 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=wswc_http, Channel=00000000
07:32:12,767 TRACE <Main Thread> [wswc_http] mfwPluginDll wait for threads to go
07:32:12,767 TRACE <Main Thread> [wswc_http] mfwPluginDll: all threads gone
07:32:12,767 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc_http.dll, hMod = 0x03520000
07:32:12,767 TRACE <Main Thread> [wswc_rdp] mfwPluginDll wait for threads to go
07:32:12,767 TRACE <Main Thread> [wswc_rdp] mfwPluginDll: all threads gone
07:32:12,767 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc_rdp.dll, hMod = 0x035F0000
07:32:12,767 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=securid-passcode, Channel=00000000
07:32:12,767 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc_rsa.dll, hMod = 0x02410000
07:32:12,767 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=Tunnel, Channel=00000000
07:32:12,767 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc_tunnel.dll, hMod = 0x037D0000
07:32:12,767 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=windows-password, Channel=00000000
07:32:12,767 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=wswc_ui, Channel=00000000
07:32:12,767 TRACE <Main Thread> [wswc_ui] mfwPluginDll wait for threads to go
07:32:12,767 TRACE <Main Thread> [wswc_ui] mfwPluginDll: all threads gone
07:32:12,767 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wswc_ui.dll, hMod = 0x03E00000
07:32:12,768 DEBUG <Main Thread> [MessageFrameWork] MessageFrameWork Worker Shutdown, Name=UIManager, Channel=00000000
07:32:12,768 DEBUG <Main Thread> [MessageFrameWork] Closed outgoing SharedMemory channel to machine system.domain.com, user DOAMIN\Michael.Risser
07:32:12,778 TRACE <Main Thread> [MessageFrameWork] Free Plugin C:\Program Files (x86)\VMware\VMware View\Client\bin\wssm_uimanager.dll, hMod = 0x03DA0000
07:32:12,788 INFO  <Main Thread> [wswc] VMware Windows Client stopped (exit code 0)

As you can see, the first cert, which is the one I want to use, was found and validated. But for some reason I don't get prompted for my PIN. And according to the dialog it the card with this cert isn't even inserted or has the wrong certificate, but the card with that cert is inserted. I even went back and went through the steps again to make the certificate available to Windows, but with the same result.

Message was edited by: mdrisser

[grossag]

Ok I see what was going on here.  Look at the last paragraph of my last response.  According to the log statement:

07:32:00,611 INFO  <6616> [MessageFrameWork] Program 'wswc - VMware View Client' started, version=4.0.1 build-233023, pid=5400, buildtype=release

you are using the 4.0.1 View Client.  Why are you using this when you have 4.5?  I double-checked the release history and it turns out that 4.0.1 has the bug that I mentioned in the last paragraph of my last response.  To get this to work, you will have to upgrade your View Client to 4.0.2 or 4.5.  Then everything will work correctly.

[mdrisser]

DOH!!!!!!

LOL That was left over from our View P.o.C., totally forgot to upgrade the client. All works beautifully now.

Many, many thanks for all your help.

[529122530]

Anybody have view client 4.5 for iphone?

[jcurban]

Hi all,

I am having the same type of problem but i am using 4.5...

Here is some of the log here it ask for the CA...

[wswc_mvdi] MVDI::CacheBrokerResponse succeeded.

2011-02-09 15:31:12,465 TRACE [wswc_ui] wswc_ui_operation: GetParams

2011-02-09 15:31:14,025 TRACE [wswc_http] HTTPCONN::CONNECT newServer, smartCardStatus=1, default=0

2011-02-09 15:31:14,025 TRACE [wswc_http] Reloaded WinInet, unloads = 4

2011-02-09 15:31:14,025 TRACE [wswc_http] useProxyPac = false

2011-02-09 15:31:14,055 TRACE [wswc_http] SMARTCARDSTATUS certificateQuery -> timeForPin

2011-02-09 15:31:14,058 DEBUG [wswc_http] HttpSendRequest returned ERROR_INTERNET_CLIENT_AUTH_CERT_NEEDED

2011-02-09 15:31:14,058 TRACE [wswc_http] SMARTCARDSTATUS timeForPin -> ignoreCertQuery

2011-02-09 15:31:14,058 TRACE [wswc_ui] wswc_ui_operation: GetParams

2011-02-09 15:31:14,117 TRACE [wswc_http] brokerLogon successful

2011-02-09 15:31:14,117 ERROR [wswc_command] brokerLogon response xml ERROR = Authentication failure

2011-02-09 15:31:14,117 TRACE [wswc_ui] wswc_ui_operation: MVDIInstalled

2011-02-09 15:31:14,117 TRACE [wswc_mvdi] wswc_mvdi_operation: setIsBrokerReachable

2011-02-09 15:31:14,117 TRACE [wswc_ui] connectDialog MessageBox: The View Connection Server connection failed. Smart Card or Certificate authentication is required.

Tthe like Get certificat is not here...

Can anyone see what I am missing?

could this be a problem with the certificate I put in the .key file?

Thank you!!

[arakelian]

See grossag's new video about smart card gotchas.