VMware Horizon Workspace 1.5 Reviewer s Guide WHITE PAPER

Transcription

1 VMware Horizon Workspace 1.5 Reviewer s Guide WHITE PAPER

2 Table of Contents VMware Horizon Workspace in Horizon Suite About This Guide Audience What Is VMware Horizon Workspace? Key Features New Features Architecture and Components... 8 VMware Horizon Workspace Virtual Appliances VMware Horizon Workspace Configurator VMware Horizon Workspace Manager VMware Horizon Workspace Connector VMware Horizon Workspace Files VMware Horizon Workspace Gateway VMware Horizon Workspace Data Template Minimum Requirements Hardware Configuration Minimum Requirements ESXi Host Server Minimum Hardware Requirements Horizon Workspace vapp Component Interaction Installation Prerequisites VMware vcenter IP Pool DNS Records Horizon Workspace Exercises Exercise 1: Download Horizon Workspace OVA/OVF Files Exercise 2: Complete the DNS Record Worksheet Exercise 3: Configure the IP Pool in vcenter Exercise 4: Create Forward and Reverse DNS Entries Exercise 5: Deploy Horizon Workspace vapp to vcenter VMware Horizon Workspace Initial Configuration Active Directory Domain Controller SMTP Server VMware vcenter Credentials SSL Certificate (Optional) Horizon Workspace License Key Initial Configuration Exercises Exercise 1: Complete the Configuration Data Worksheet Exercise 2: Complete the Initial Configuration Exercise 3: Complete the Web-Based UI Setup WHITE PAPER / 2

3 VMware Horizon View Integration (Optional) Integration Prerequisites Horizon View Integration Exercises (Optional) Exercise 1: Complete the Configuration Information Worksheet Exercise 2: Configure the Horizon View Module Exercise 3: Configure SAML Authentication in Horizon View Exercise 4: Complete Verification, Sync, and Entitlement Files Overview and Configuration End-User Experience of Files Administration Features of Files Files Exercises Exercise 1: Add Virtual Disks to the Data Server Exercise 2: Install LibreOffice to Enable Preview Exercise 3: Entitle Users and Groups to Use Files Exercise 4: Unentitle Users and Remote Wipe Exercise 5: Install the VMware Horizon Workspace Client on Windows Exercise 6: Share and Comment on Files and Folders, Verify Version Control Managed Mobile Workspace Overview and Configuration Mobile Application Management Managed Policies Supported Platforms and Types of Mobile Applications Policy Enforcements for Enterprise Applications Mobile Workspaces Managed Mobile Workspace Exercises Exercise 1: Enable Mobile Management Exercise 2: Use Files on an Android Device Exercise 3: Add Referred Android Apps to Catalog Exercise 4: Entitling Users and Groups to Managed Mobile Workspaces Exercise 5: Install and Configure VMware Switch for Android Devices Exercise 6: Working with Mobile Workspace Policies Apply the Policy to a User or Group View a Policy in Action Summary Additional Resources About the Authors WHITE PAPER / 3

4 VMware Horizon Workspace 1.5 Reviewer s Guide VMware Horizon Workspace in Horizon Suite VMware Horizon Workspace is part of VMware Horizon Suite, designed for today s mobile workforce. Horizon Suite enables users to access business assets from anywhere, anytime, and from any device, and it helps IT organizations to keep assets secure. With Horizon Suite, IT has control, and users have choice. Horizon Suite includes VMware Horizon Workspace, VMware Horizon View, and VMware Horizon Mirage. Horizon Workspace provides an easy way for end users to access applications and files on any device, while at the same time enabling IT to deliver, manage, and secure these assets centrally. Horizon Workspace provides secure, single sign-on to applications, data, and virtual desktops from any computer or mobile device, and meets the challenges of today s changing Bring Your Own Device (BYOD) and mobile environments. Horizon Mirage centrally manages desktop images of physical computers at the same time as it provides end users with local execution power and user personalization of the desktop. Users on Mirage-managed desktops can access their business assets through Horizon Workspace. Horizon View provides users with remote access to secure virtual desktops stored in the datacenter. End users can access their Horizon View desktops through Horizon Workspace. This Reviewer s Guide focuses on VMware Horizon Workspace. SaaS Applications Horizon Workspace Box.net Google Docs Salesforce VMware Horizon Workspace Admin Console ThinApp Repository Enterprise Storage VMware Horizon Data Core Infrastructure Microsoft Active Directory Infrastructure VMware vcenter Horizon Mirage VMware Horizon Mirage VMware vcenter Operations Horizon View VMware Horizon View Security Server VMware Horizon View Connection Server VMware Horizon View Composer Windows ndo 7 Windows W in ndow n wss X XP Physical Endpoints Windows W in ndow n wss XP X Windows W in nd dow ws XP X Windows Win ndow ws XP X VDI Desktop Pools Figure 1: VMware Horizon Suite Simplified Architecture W H I T E PA P E R / 4

5 About This Guide This document provides a guided walkthrough of VMware Horizon Workspace, including a step-by-step introduction to technical architecture, use cases, and initial installation, configuration, and integration exercises. It describes the individual components of VMware Horizon Workspace and their interoperability with each other, as well as their integration with the other products in VMware Horizon Suite: Horizon View and Horizon Mirage. This document describes how to set up a basic VMware Horizon Workspace environment, and the principles of scaling and integrating this deployment with your existing enterprise infrastructure. Audience This document is designed to help reviewers evaluate Horizon Workspace and understand how it can be useful for system and functional administrators to provide secure, managed, and controlled access to company data and applications through multiple Bring Your Own Device (BYOD) platforms. Familiarity with VMware technologies is assumed, particularly VMware vcenter and VMware ESX, networking concepts, Active Directory, and Simple Mail Transfer Protocol (SMTP). Knowledge of other technologies, such as VMware ThinApp, RSA SecurID, and mobile application distribution, is also helpful if you plan to implement those features. What Is VMware Horizon Workspace? Horizon Workspace is a self-contained vapp with multiple virtual appliances, distributed as an Open Virtualization Archive (OVA) file. Horizon Workspace provides an integrated workspace that provides end users with access to their applications, data, and desktops from any of their devices while enabling IT administrators to easily manage entitlement and policy controls at the same time. This promotes employee productivity without compromising security or IT control. As part of VMware Horizon Suite, Horizon Workspace benefits both end users and IT administrators. Horizon Workspace provides end users with a single workspace for all applications and data, as well as seamless file sharing. It enables IT administrators to manage users instead of devices and to offer advanced security and protection of corporate data. Figure 2: Horizon Workspace Manages Both Personal and Corporate Assets WHITE PAPER / 5

6 Key Features Horizon Workspace enables IT to manage only what it needs to manage instead of trying to control an employee s entire device. This promotes security and compliance for all devices, regardless of ownership. Horizon Workspace enables this vision by providing both users and IT with the following key features: Data and File Sync, and File Sharing Horizon Workspace enables users to upload, synchronize, and access files over the Internet from any device. It also - Provides easy access to data across devices - Provides a simple user interface that promotes strong demand and quick user acceptance - Enables file synchronization from the private cloud to any type of device, such as PC, Mac, tablet, or smart phone - Enables file sharing with internal and external collaborators Cloud-Identity Management Horizon Workspace federates users identity so that a single authentication ticket is trusted across multiple systems, which enables Access to SaaS applications from any device through single sign-on (SSO) Access to Web applications and cloud-based services through SSO Enables IT to leverage their existing SaaS applications Note: VMware ThinApp must be used to package Windows applications. Protection of Corporate Assets on Mobile Devices Horizon Workspace enables IT to create group-based security policies, monitor device inventory, and obtain device diagnostic information from a Web-based console. Horizon Workspace also provides - Full encryption, remote lock and wipe, jailbreak detection, and password enforcement - Dynamic policy updates - Offline policy enforcement - Visualization of policy scenarios with policy preview feature - The ability to set data containment policies to prevent data leakage, for example, from copy-and-paste operations or documents being opened in public share sites Centralized Application Management Horizon Workspace provisions, distributes, and updates applications and enterprise services to employee devices in a dedicated workspace. Horizon Workspace also - Categorizes, publishes, and distributes applications into an application catalog, including native, Web, and referred applications from public stores - Preconfigures application preferences before distributing to employees Support for Compliance Requirements Horizon Workspace logs events for auditing and document retention - By policy - On a user, group, or global basis - Provides application usage reports WHITE PAPER / 6

7 New Features Horizon Workspace 1.5 provides a single platform that allows IT organizations to manage and govern thirdparty mobile applications and internally developed, enterprise-owned mobile applications, in addition to SaaS, Web, and Windows applications and files. Horizon Workspace 1.5 also adds mobile security and policy management features. The Horizon Workspace Admin Console now fully integrates mobile workspace management and administration for Android-based devices. The enhancements available in this release of Horizon Workspace include Android Device Management Horizon Workspace enables IT to manage VMware Ready Android devices remotely by leveraging available platform APIs to apply policies to the entire device. It also - Creates a single mobile application that gives users access to files and SaaS applications on mobile devices - Provides wide availability across mobile platforms - Enables a native user experience App feels like a native Android phone Android Application Management Horizon Workspace enables IT to distribute and manage corporate applications on Android devices by modifying existing application binaries so policies can be applied. It also - Enables IT to focus on managing corporate applications only, instead of the entire device - Can isolate corporate assets Windows Application Delivery on Mobile Devices Horizon Workspace uses the Microsoft remote display protocol (RDP) to enable the delivery of Windows applications that have been virtualized with VMware ThinApp. Horizon Workspace also - Displays a user s individual applications or their Horizon View desktop on any device - Enables IT to leverage legacy applications (Windows, Web applications) - Leaves no work footprint or data behind on the user device - Reduces the requirement for management Mobile Virtualization Horizon Workspace enables IT to manage corporate applications on VMware Ready Android devices by running corporate applications within a virtual machine. Horizon Workspace also provides - The optimum level of separation for corporate assets - Support for any application without the need for modification - A native user experience Dual-Persona Horizon Workspace enables IT to manage corporate applications on mobile devices by grouping corporate applications into a separate, graphically distinct environment. Horizon Workspace also offers a distinct UI for corporate persona. Note: The product previously called Horizon Mobile (MVP) is now fully integrated into Horizon Workspace. The feature set previously named Horizon Data, also called Horizon Files in some documents, is referred to as Files in this Guide. The filename of the corresponding virtual machine data-va has not changed. WHITE PAPER / 7

8 Architecture and Components This section provides a high-level overview of the discrete components of VMware Horizon Workspace, how they are packaged, and their minimum requirements. Figure 3: Some Horizon Workspace Applications Horizon Workspace is a multiple virtual machine vapp, distributed as an Open Virtualization Archive (OVA) file. The VMware Horizon Workspace vapp can be directly deployed to VMware vcenter. The following diagram represents a basic layout of the Horizon Workspace architecture. This architecture leverages your current Active Directory, NFS datastore for Files, and CIFS shares for ThinApp functionality. The Reverse Proxy component should already exist in your environment. WHITE PAPER / 8

9 VMware Horizon Workspace 1.5 Reviewer s Guide ThinApp Share Active Directory NFS Mount Management-VA Connector-VA Data-VA Gateway-VA Reverse Proxy Internet Macintosh PC ios Android Figure 4: Horizon Workspace Architecture W H I T E PA P E R / 9

10 VMware Horizon Workspace Virtual Appliances The full VMware Horizon Workspace vapp package includes the virtual appliances identified by their filenames in Figure 5, and described in the sections that follow. External Users External Load Balancer DMZ Firewall Internal Users Internal Load Balancer Horizon Workspace vapp Virtual Appliance Virtual Appliance Virtual Appliance Virtual Appliance Virtual Appliance gateway-va service-va connector-va configurator-va data-va Figure 5: Horizon Workspace Network Configuration with Virtual Appliances WHITE PAPER / 10

11 VMware Horizon Workspace Configurator The Horizon Workspace Configurator (configurator-va) virtual appliance provides access to a console and Web-based user interface for the centralized configuration of all other appliances in the vapp. It also provides central control of the network, gateway, vcenter, and SMTP settings of all appliances in the vapp. In addition, the Configurator appliance allows an administrator to add and remove active modules in Horizon Workspace, and to manage security certificates centrally. You can start configuring Horizon Workspace using either the Configurator interface or the Configurator Web interface. The configurations you make with the Configurator are then distributed to the other virtual appliances in the vapp. VMware Horizon Workspace Configurator (configurator-va) Application TCSERVER SLES Figure 6: Configurator Dependencies and Features VMware Horizon Workspace Manager The Horizon Workspace Manager (service-va) virtual appliance provides access to the Administrator Web interface, from which you can manage users, groups, and resources. This appliance allows you to configure the application catalog, manage user entitlements, and configure groups and reporting for all the systems in the Horizon Workspace vapp. VMware Horizon Workspace Manager (service-va) API Application TCSERVER DB SLES Figure 7: Manager Dependencies and Features WHITE PAPER / 11

12 VMware Horizon Workspace Connector The Horizon Workspace Connector (connector-va) virtual appliance provides local user authentication (identity provider), directory synchronization, ThinApp catalog loading, and Horizon View pool synchronization. The Connector appliance also provides Active Directory binding and synchronization services. This allows administrators to define the directory replication schedule, and to synchronize Horizon View and ThinApp pools and repositories for provisioning end-user desktops. VMware Horizon Workspace Connector (connector-va) Application TCSERVER SLES Figure 8: Connector Dependencies and Features VMware Horizon Workspace Files The Horizon Workspace Files (data-va) virtual appliance provides the datastore for user files. This appliance controls file and folder sharing between internal and external users, provides file preview functionality, and serves the end-user Web interface for Horizon Workspace. VMware Horizon Workspace Files (data-va) API Application JETTY LDAP DB SLES Figure 9: Files Dependencies and Features WHITE PAPER / 12

13 VMware Horizon Workspace Gateway The Horizon Workspace Gateway (gateway-va) virtual appliance is the central aggregation point for all end-user communication. It enables single user facing domain access to Horizon Workspace. User requests arrive at the Gateway appliance, which proxies the requests on behalf of user connections, and then routes them to the appropriate virtual appliance. VMware Horizon Workspace Gateway (gateway-va) Application TCSERVER SLES Figure 10: Gateway Dependencies and Features VMware Horizon Workspace Data Template In addition to the virtual appliances described above, there is a complete offline clone of data-va, the VMware Horizon Workspace Data Template (datatemplate-va). This virtual appliance is generated by the Configurator the first time the Horizon Workspace vapp is installed and powered on. It is used for clustering when you create a new data-va virtual machine using the hznadmintooladdvm command. Minimum Requirements This section describes hardware, server, and installation minimum requirements for VMware Horizon Workspace. Hardware Configuration Minimum Requirements Table 1 shows the minimum supported hardware requirements of each virtual appliance in the VMware Horizon Workspace vapp. COMPONENT MINIMUM vcpu MINIMUM RAM MINIMUM DISK SPACE VMware Horizon Workspace Configurator (configurator-va) VMware Horizon Workspace Manager (service-va) VMware Horizon Workspace Connector (connector-va) VMware Horizon Workspace Data (data-va) 1 vcpu 1GB 5GB 2 vcpu 4GB 36GB 2 vcpu 4GB 12GB 2 vcpu 4GB 175GB WHITE PAPER / 13

14 COMPONENT MINIMUM vcpu MINIMUM RAM MINIMUM DISK SPACE VMware Horizon Workspace Data (datatemplate-va) N/A, no vcpu required N/A, no RAM required 175GB VMware Horizon Workspace Gateway (gateway-va) 1 vcpu 1GB 9GB Recommended Minimum Configuration 8 vcpu 14GB 412GB Table 1: Virtual Appliance Minimum Hardware Requirements ESXi Host Server Minimum Hardware Requirements Table 2 shows the minimum supported hardware requirements for the VMware vsphere ESXi host running the VMware Horizon Workspace vapp. COMPONENT CPU MINIMUM REQUIREMENT 2 x Intel Quad Core, 3.0GHz, 4MB cache RAM LAN Disk 12GB DDR2 1066MHz, ECC registered 1 x 10/100/1000BASE-TX port 500GB Table 2: vsphere ESXi Host Minimum Hardware Requirements WHITE PAPER / 14

15 Horizon Workspace vapp Component Interaction Figure 11 illustrates the interaction of virtual appliances in the vapp. Web Client Mobile Client Desktop Agent Horizon Admin UI VMware Horizon Workspace Gateway (gateway-va) VMware Horizon Workspace Manager (service-va) API Application Application TCSERVER SLES VMware Horizon Workspace Files (data-va) API Application TCSERVER DB JETTY LDAP DB SLES VMware Horizon Workspace Configurator (configurator-va) SLES Application TCSERVER vcenter SLES VMware Horizon Workspace Connector (connector-va) Application Active Directory TCSERVER SLES Figure 11: Virtual Appliance Component Interaction WHITE PAPER / 15

16 Installation Prerequisites Make sure your environment has the following prerequisites before your deploy the VMware Horizon Workspace vapp. VMware vcenter IP Pool A successful deployment requires an IP pool with the following attributes: Correct TCP/IP subnet on which the vapp communicates DNS servers required for name resolution DNS domain DNS Records Each virtual appliance in the vapp requires a DNS entry and a static IP address that uses reverse lookup. Each organization administers its IP addresses and DNS records differently. Before you begin your installation, consult your network administrator and request five DNS records and five IP addresses that use reverse lookup. Important: If reverse lookup is not properly configured, the Horizon Workspace installation fails. You must configure static Host A-records and reverse lookup records for each virtual appliance in the vapp. A-records are DNS address records that point domain and host names to static IP addresses. Table 3 lists examples of naming and addressing schemas. APPLIANCE A-RECORD HOSTNAME A-RECORD ADDRESS PTR RECORD HOSTNAME PTR RECORD ADDRESS gateway-va my-gateway-va. company.com in-addr-arpa my-gateway-va.company.com configurator-va my-configurator-va. company.com in-addr-arpa my-configurator-va.company. com service-va my-service-va. company.com in-addr-arpa my-service-va.company.com connector-va my-connector-va. company.com in-addr-arpa my-connector-va.company.com data-va my-data-va.company. com in-addr-arpa my-data-va.company.com Table 3: DNS Naming and Addressing Examples WHITE PAPER / 16

17 Horizon Workspace Exercises This section provides hands-on exercises to help you experience and evaluate the key features of Horizon Workspace. The exercises are sequential and build upon one another. Make sure to complete each exercise in this section before going to the next. Exercise 1: Download Horizon Workspace OVA/OVF Files 1. Download the Horizon Workspace (OVA) package file from the VMware Web site. Note: Approximately 6GB of disk space are required on the target machine. 2. When you have successfully downloaded the OVA/OVF file, proceed to the next exercise to complete the DNS record worksheet. Exercise 2: Complete the DNS Record Worksheet Now that you have successfully downloaded the OVA/OVF files, the next step is to gather the DNS record information required for the exercises that follow. 1. Populate the worksheet in Table 4 with the correct data for your deployment. Note: This is a critical step that must be completed before you proceed with the deployment. APPLIANCE A-RECORD HOSTNAME A-RECORD ADDRESS PTR RECORD HOSTNAME PTR RECORD ADDRESS gateway-va configurator-va service-va connector-va data-va Table 4: DNS Deployment Worksheet 2. When you have filled in the worksheet with the correct data, you can proceed to the next exercise and configure the IP pool in vcenter. WHITE PAPER / 17

18 Exercise 3: Configure the IP Pool in vcenter Now that you have successfully completed the DNS record worksheet, you can configure the IP pool in vcenter. 1. Log in to your vcenter Server and highlight the datacenter object where you plan to deploy the Horizon Workspace vapp. 2. In the right pane, select the IP Pool tab, and click Add. The New IP Pool Properties window appears. Figure 12: Configure IP Pool Properties 3. To configure the IP Pool Name and IPv4 settings, populate the Subnet and Gateway fields. Note: Leave the Enable IP Pool check box unchecked. It is not required. Figure 13: Configure IP Pool Name and Settings WHITE PAPER / 18

19 4. In the DNS tab, populate the DNS Domain and IPv4 DNS Servers fields. Note: Populate only one field for DNS servers. Figure 14: Configure DNS Domain and Servers 5. In the Associations tab of the New IP Pool Properties dialog box, select the IP pool where you plan to deploy the vapp. Figure 15: Configure vapp IP Pool WHITE PAPER / 19

20 6. When you have completed these configuration steps, review your IP pool settings in the vsphere Client, and verify that you have correctly configured the appropriate information. Figure 16: Review IP Pool Settings 7. When you have successfully configured the IP pool in the vsphere Client, you can proceed to the next exercise to create DNS entries for the Horizon Workspace vapp. Exercise 4: Create Forward and Reverse DNS Entries After successfully configuring the IP pool in vcenter, create DNS entries for the vapp. Note: The examples for this exercise were created from a Windows Server 2008 R2 DNS server. 1. Open the DNS MMC snap-in, and navigate to the forward lookup zone for your domain. Figure 17: Find Forward Lookup Zone for Your Domain Note: If required, create a reverse lookup zone for the correct subnet in your environment. WHITE PAPER / 20

21 2. Create the static Host A-records for the virtual appliances, following the worksheet you completed in Complete the DNS Record Worksheet for the forward lookup zone. Make sure to create the associated pointer records in the reverse lookup zone. Figure 18: Create Static Host A-Records for Forward Lookup Zone 3. Verify that the associated reverse lookup records have been created successfully. Figure 19: Verify Reverse Lookup Records 4. Verify that you can resolve the DNS short name, long name, and reverse lookup for each of the virtual appliances in the VMware Horizon Workspace vapp. When you have successfully created DNS entries for the vapp, proceed to the next exercise to deploy the Horizon Workspace vapp to vcenter. Exercise 5: Deploy Horizon Workspace vapp to vcenter Now that you have successfully created DNS entries for the vapp, you can deploy the Horizon Workspace vapp to your vcenter. 1. Log in to your vsphere Client, and select the cluster or host where you plan to deploy the Horizon Workspace vapp. Figure 20: Select Cluster or Host to Deploy vapp WHITE PAPER / 21

22 2. Click Browse, and select the local source files that you downloaded in Download Horizon Workspace OVA/OVF Files. Figure 21: Browse and Select Local Source Files That You Downloaded 3. Select the appropriate file, and click Open, and then click Next. Figure 22: Open the File That You Selected WHITE PAPER / 22

23 4. Verify that the information in the Deploy OVF Template is correct, and then click Next. Figure 23: Verify Information in Deployment Wizard 5. Configure the name and appropriate location for the vapp, and then click Next. Figure 24: Configure Name and Location for vapp WHITE PAPER / 23

24 6. Under Select storage, select an appropriate datastore to store the virtual appliance disk files, and then click Next. Figure 25: Select Datastore for the Virtual Appliance Disk Files 7. Select the appropriate port groups to connect the virtual appliances, and then click Next. Figure 26: Select Port Groups to Connect Virtual Appliances WHITE PAPER / 24

25 8. Fill in the correct information for your time zone and virtual appliance addresses based on the DNS data you collected in Complete the DNS Record Worksheet, and then click Next. Figure 27: Type Time Zone and Virtual Appliance Addresses 9. Review the summary information in the deployment wizard, check Power on after deployment, and then click Finish to start deploying the vapp. Figure 28: Review Information and Begin Deployment of vapp WHITE PAPER / 25

26 10. Monitor the deployment progress in your vsphere Client, and verify that the deployment completes successfully. Figure 29: Monitor Deployment in vsphere Client Now that you have successfully deployed the Horizon Workspace vapp to your vcenter, you can proceed to the next section to perform the initial configuration. WHITE PAPER / 26

27 VMware Horizon Workspace Initial Configuration With the Horizon Workspace vapp successfully deployed to your vcenter environment, you can gather the data required to proceed with your configuration. This section identifies the data required, and provides exercises to walk you through the initial configuration process. Active Directory Domain Controller VMware Horizon Workspace integrates with your existing Microsoft Active Directory infrastructure. The following data is required: Server name of an Active Directory domain controller in the environment FQDN of an Active Directory domain controller in the environment Base DN username Base DN password Active Directory username with privileges to join computers to the domain SMTP Server VMware Horizon Workspace requires an SMTP server in the environment to send messages and alerts. You can create or use an existing SMTP server to record the following information: SMTP server hostname FQDN SMTP server port number VMware vcenter Credentials The Configurator virtual appliance requires a connection to the vcenter hosting the Horizon Workspace deployment to configure the virtual appliances. The following data is required: VMware vcenter hostname FQDN VMware vcenter port number VMware vcenter administrator username VMware vcenter administrator password SSL Certificate (Optional) The SSL certificate is optional. You can add an SSL certificate after you deploy Horizon Workspace. If you choose to use an approved certificate, the following items are necessary: SSL certificate file Private key Horizon Workspace License Key Obtain the license key information for VMware Horizon Workspace in order to proceed with your configuration. Now that you are familiar with the information required for both required and optional procedures, you can begin the following exercises to gather this data and proceed with the initial configuration. WHITE PAPER / 27

28 Initial Configuration Exercises This section walks you through several hands-on configuration exercises. The exercises are sequential and build upon one another. It is best to complete the exercises in this section before proceeding to the next. Exercise 1: Complete the Configuration Data Worksheet The first step is to gather the configuration information required for the initial configuration exercises that follow. 1. Use the following worksheet to record your configuration information. ITEM CONFIGURATION INFORMATION ACTIVE DIRECTORY Server Name of an Active Directory domain controller in the environment FQDN of an Active Directory domain controller in the environment AD context for binding Base DN Username Base DN Password AD Username with privileges to join computers to the domain SMTP SERVER SMTP Server Hostname FQDN SMTP Server Port Number VMWARE VCENTER SERVER VMware vcenter Hostname FQDN VMware vcenter Port Number VMware vcenter Administrator Username VMware vcenter Administrator Password SSL CERTIFICATE SSL Certificate File WHITE PAPER / 28

29 ITEM CONFIGURATION INFORMATION Private Key VMWARE HORIZON WORKSPACE License Key Table 5: Configuration Information Worksheet 2. When you finish gathering your configuration data, proceed to the initial configuration process on the Configurator virtual appliance. Exercise 2: Complete the Initial Configuration With the configuration data that you gathered in the previous exercise, you can start the initial configuration process for the Horizon Workspace Configurator virtual appliance. 1. Log in to your vsphere Client, select the configurator-va from the Horizon Workspace vapp, and open the console to the virtual machine. Figure 30: Open Console to Virtual Machine The Configurator Virtual Appliance opens to the Horizon Workspace Installation Wizard. WHITE PAPER / 29

30 2. Make sure that you have the required configuration information on hand, and press Enter to begin the installation wizard. Note: The External gateway hostname and port use the DNS name you selected for the gateway-va virtual appliance in Complete the DNS Records Worksheet. Figure 31: Horizon Workspace Installation Wizard 3. Answer the configuration questions with the correct information. When the information is complete, review the summary, then type Y, and press Enter. Figure 32: Review Configuration Information Summary WHITE PAPER / 30

31 4. Wait for the application to complete the configuration and output a success message as in the screenshot below, and then press Enter. Figure 33: Verify Configuration Completion 5. After the configurator-va reboots successfully, close the console window, and proceed to the next exercise to complete the Web-based UI setup on the Configurator virtual appliance. Exercise 3: Complete the Web-Based UI Setup After successfully going through the initial configuration wizard, you can complete the UI setup on the Configurator virtual appliance. 1. In your Web browser, go to and on the main page, click Begin Setup Wizard. Figure 34: Horizon Workspace Setup Wizard WHITE PAPER / 31

32 2. In the Setup window, provide your Horizon Workspace license key and the administrative username and password that you collected for the Configurator administrator account during Complete the Configuration Data Worksheet. Figure 35: Log in to Set up Configurator Administrator Account 3. In the Configure window, click Continue with the Setup Wizard. Figure 36: Horizon Workspace Setup Wizard WHITE PAPER / 32

33 4. In the Database Connection Setup window, select Internal Database, and then click Next. Figure 37: Select Internal Database 5. In the Directory window, type the Active Directory information that you gathered during Exercise 1: Complete the Configuration Data Worksheet, and click Test Setting and Sync. Figure 38: Type in the Active Directory Information WHITE PAPER / 33

34 6. In the Directory window, verify that a success message appears at the top of the window, and then click Next to start the Push to Horizon wizard. Figure 39: Setup Confirmation Message 7. In the Map User Attributes window, accept the defaults, and then click Next. Figure 40: Map User Attributes Window Note: The import fails if the required attributes, such as , are not provided for all users that you import into Horizon Workspace. WHITE PAPER / 34

35 8. In the Select Users window, review the status message, and then click Next. Note: You can safely ignore errors for any built-in accounts that do not have the required attributes. Figure 41: Review Status Message 9. In the Select Groups window, select the groups you plan to add to Horizon Workspace for later entitlement, and then click Next. Figure 42: Select Groups Window WHITE PAPER / 35

36 10. In the Configure Scheduling window, select an appropriate replication frequency, and then click Next. Figure 43: Configure Scheduling Window 11. In the Push to Horizon window, select Publish the configuration, and wait for the synchronization process to complete. Figure 44: Publish the Configuration and Sync WHITE PAPER / 36

37 12. When the synchronization process is complete, verify that the Sync complete message appears, and then click Next. 13. In the Select modules window, enable the Horizon Files and Web Applications modules by clicking Enable this module for each, and then click Next. Note: See VMware Horizon View Integration (Optional) for a more detailed description of the View module configuration. Figure 45: Select Modules Window 14. In the Horizon Workspace FQDN and SSL Certificate Setup window, accept the default FQDN and default self-signed certificate. Click Save, and then click Next. Figure 46: Provide FQDN and Keep Existing Self-Signed Certificate WHITE PAPER / 37

38 15. In the X-Forwarded-For window, type any additional IP addresses that you want to associate with the resolution or redirection of the Horizon Workspace Gateway virtual appliance. These addresses are used to mask the original IP address of the Horizon Workspace Gateway virtual appliance. Figure 47: Configuring IP Addresses in X-Forwarded-For 16. In the Summary window, verify that the information is correct, and then click Go to Horizon Workspace to launch the Login window. Figure 48: Horizon Workspace Summary Window WHITE PAPER / 38

39 17. In the Login window, type the administrator username and password to log in to Horizon Workspace and verify that the system is functioning as expected. Figure 49: Horizon Workspace Login Window 18. When you have verified that the Web-based UI setup was successful and the system is functioning as expected, you can proceed to one of the following topics: VMware Horizon View Integration (Optional) to optionally configure Horizon Workspace to integrate with an existing VMware Horizon View deployment. Files Overview and Configuration to enable and configure data as a component of VMware Horizon Workspace. WHITE PAPER / 39

40 VMware Horizon View Integration (Optional) Now that you have successfully completed the Web-based UI setup, you can configure Horizon Workspace to integrate with an existing VMware Horizon View deployment, if that is required. If integration is not required, you can skip this topic and proceed to Files Overview and Configuration to enable and configure data as a component of VMware Horizon Workspace. IT administrators can integrate an existing VMware Horizon View deployment with Horizon Workspace. This gives end users the ability to launch their entitled Horizon View desktops directly from within the Horizon Workspace Web interface. Figure 50: Integrate VMware Horizon View Deployment with Horizon Workspace Integration Prerequisites To integrate Horizon Workspace with Horizon View, the environment where you are deploying the VMware Horizon Workspace vapp must meet the following criteria: VMware Horizon View version 5.2 or higher Horizon View pools and desktops with entitlements set for Active Directory users and groups VMware Horizon Workspace already deployed and configured DNS entry and an IP address that uses reverse lookup must be available for each Horizon View Connection Server in your Horizon View setup. Horizon Workspace requires reverse lookup for Horizon View Connection Servers, Horizon View Security Servers, and load balancers. Important: If reverse lookup is not properly configured, Horizon Workspace integration with Horizon View fails. Active Directory users and groups synched with Horizon View pools entitlements to Horizon Workspace WHITE PAPER / 40

41 Horizon View Integration Exercises (Optional) If you choose to integrate with an existing VMware Horizon View deployment, complete the exercises in this section before proceeding to the next. If integration is not required, you can skip these exercises and proceed to Files Overview and Configuration to enable and configure data as a component of VMware Horizon Workspace. Exercise 1: Complete the Configuration Information Worksheet The first step is to gather the configuration information required for the integration exercises that follow. 1. Complete the Configuration Worksheet to gather the information you need to configure the VMware Horizon View module. ITEM CONFIGURATION INFORMATION Active Directory FQDN Active Directory User Account with privileges to join computers to the domain Active Directory User Account with privileges to join computers to the domain password Initial Horizon View Connection Server FQDN FQDN for Client Access (load balancer address) Active Directory User Account with read privileges in Horizon View Administrator Active Directory User Account with read privileges in Horizon View Administrator password Table 6: Horizon View Module Configuration Worksheet 2. When you finish gathering the data required for configuration, proceed to the next exercise to configure the VMware Horizon View module. WHITE PAPER / 41

42 Exercise 2: Configure the Horizon View Module Now that you have the data you need for configuration, you can start configuring the VMware Horizon View module. 1. Navigate to the configurator-va Web interface at and log in as the administrative user that you specified in Complete the Web-Based UI Setup. 2. Click the Modules item on the left pane, find the View module tile, and click Enable this module. Figure 51: Enable View Module Tile 3. Click the Go to All Connectors link to configure the Horizon View module within Horizon Workspace. Figure 52: Log in to the Connector to Configure Horizon View WHITE PAPER / 42

43 4. Log in to the Horizon Workspace Connector virtual appliance, and click View Pools. Figure 53: Configuring Horizon View Pools 5. In the Join Domain window, provide the data that you gathered during Exercise 1: Complete the Configuration Information Worksheet, and click Join Domain. Figure 54: Typing Domain Information into the Join Domain Wizard WHITE PAPER / 43

44 6. In the Join Domain window, verify that a message appears saying, You are currently joined to <domain>, as in the figure below. Figure 55: Domain Successfully Joined 7. In the navigation bar to the left, click Windows Auth to configure Windows authentication with Horizon Workspace. This allows single sign-on to Horizon View desktops from within Horizon Workspace. Figure 56: Configuring Windows Authentication WHITE PAPER / 44

45 8. In the navigation bar to the left, click User Attributes, click the added userprincipalname attribute check box to enable it, and then click Save. Figure 57: Mapping User Attributes 9. In the navigation bar to the left, click View Pools, type the Horizon View Connection Server data into the Horizon Workspace Configuration wizard, and then click Save. Figure 58: Enabling and Configuring Horizon View Desktop Pools WHITE PAPER / 45

46 10. In the View Pools window, accept the Horizon View Connection Server certificate in Horizon Workspace, and then click Save. Figure 59: Accepting the Horizon View SSL Certificate and Enabling SAML In Horizon View 11. When you have successfully configured the VMware Horizon View module, you can proceed to the next exercise to enable and configure SAML authentication in VMware Horizon View. Exercise 3: Configure SAML Authentication in Horizon View Now that you have successfully configured the VMware Horizon View module, you can configure SAML authentication in VMware Horizon View. 1. Log in to your Horizon View Administration Portal with an administrative user account, then select View Configuration > Servers from the left pane. Figure 60: Log in and Select View Configuration and Servers WHITE PAPER / 46

47 2. Select the first Connection Server that you configured in the previous Configure the Horizon View Module, and then click Edit. Note: Repeat this procedure for every Connection Server instance in the replica group. Figure 61: Selecting the Connection Server 3. In the Authentication tab, select Allowed from the drop-down menu, and then click Manage Authenticators. This adds the VMware Horizon Workspace gateway-va as an SAML authenticator. Figure 62: Click Manage Authenticators 4. In the Manage Authenticators dialog box, click Add, and then click OK. Figure 63: Add Authenticators WHITE PAPER / 47

48 5. In the Edit SAML 2.0 Authenticator dialog box, configure the new authenticator with an appropriate label, description, and the URL for your VMware Horizon Workspace gateway-va. Figure 64: Configure New Authenticator 6. When using a self-signed SSL certificate, the Horizon View Administrator UI prompts you to verify the certificate on the Gateway virtual appliance. Click View Certificate. Figure 65: Verify Server Certificate WHITE PAPER / 48

49 7. Review and verify the information, and then click Accept. Figure 66: Certificate Information WHITE PAPER / 49

50 8. After accepting the certificate, return to the Horizon Workspace wizard to confirm that all certificates are valid, and click Save to complete the configuration. Note: If a Manual synchronization was selected, click Sync Now on the View Pools wizard page to manually sync Horizon View pools to Horizon Workspace. Figure 67: SSL and SAML Certificate Confirmation 9. When you have completed the setup for this Connection Server, repeat these steps for all other Horizon View Connection Servers in the replica group. You can then proceed to the next exercise to verify, sync, and entitle Horizon View pools to Horizon Workspace users and groups. Note: See also Enable a SAML 2.0 Authenticator in Integrating VMware Horizon Workspace and VMware Horizon View for more details. WHITE PAPER / 50

51 Exercise 4: Complete Verification, Sync, and Entitlement Now that you have successfully completed the setup for all Horizon View Connection Servers in the replica group, you are ready to verify, sync, and entitle Horizon View pools to Horizon Workspace users and groups. 1. Log in to the Gateway Virtual Appliance at Verify that the dashboard has updated to include the VMware Horizon View pool information, and then click the Catalog tab in the Web interface. Figure 68: Gateway Virtual Appliance Dashboard WHITE PAPER / 51

52 2. Verify that the Horizon View pools are listed in the interface. Then log out and log back in as a user entitled to use a Horizon View desktop. Figure 69: Horizon View Pool Entitlements Window 3. Verify that you can see the desktop entitlements, and then launch a connection to a desktop from the VMware Horizon Workspace Web interface. Figure 70: Horizon Workspace Web Interface 4. When you have completed the verification, sync, and entitlement of Horizon View pools to Horizon Workspace users and groups, you can proceed to the next section to enable and configure data as a component of VMware Horizon Workspace. WHITE PAPER / 52

53 Files Overview and Configuration Now that you have successfully completed the installation and initial configuration exercises, and the integration with Horizon View option if relevant to your operation, you are ready to enable and configure data in the Files component of VMware Horizon Workspace. This section describes the end-user experience and administration features of Files, followed by exercises designed to familiarize you with these features. The Files component controls the sharing of files and folders between users, and it provides consistent and seamless access to user data from any device. At the same time, this component gives IT teams control over the data so that they can ensure security and compliance. The Files Web interface allows users to preview and comment on their personal and shared documents, as well as share files and folders with internal and external users. Figure 71: Sharing the Web Interface Configuration Diagram Note: The feature set previously named Horizon Data, also called Horizon Files in some documents, is referred to as Files in this Guide. The filename of the corresponding virtual machine data-va has not changed. End-User Experience of Files The Files component includes features that improve the end-user experience. Document Preview One of the key features of the VMware Horizon Workspace Files virtual appliance (data-va) is the ability of end users to preview a document in the browser before opening it. To enable the preview feature in the Web client, LibreOffice or Microsoft Windows Preview are installed on the data-va virtual appliance. Create Folders and Subfolders When users are entitled to use Files, a folder called Horizon Files is created in their systems. Users can create folders and subfolders within the Horizon Files folder to organize their files in the cloud. Folders and subfolders are created as in any Windows environment. All folders and subfolders within the Horizon Files folder are synchronized to the Horizon Files Server and can be accessed from any device. WHITE PAPER / 53

54 Import Files from Computer When the Horizon Files folder is created in a system, users can import the existing files and folders in their computer to that folder to synchronize with the Horizon Files Server. The files can be copied and pasted, or dragged and dropped into the Horizon Files folder. Share Folders, Subfolders, and Files One of the key features of the Horizon Files folder is its ability to share files, folders, and subfolders with both internal and external users. The shares, permissions, and access records can be found in the Horizon Files logs. Preview Files in the Horizon Workspace Web Interface With LibreOffice or Microsoft Windows Preview installed, Microsoft documents can be previewed in a browser before opening the document. Download and Sync Files to Computer Files and folders stored in Files can be viewed from any HTML5- compatible browser or downloaded to the local system. When using a local system, a folder called Horizon Files is created, and any files or folders within it can be viewed and modified offline. When online, the files and folders are automatically synchronized with the Horizon Files Server. The frequency of the synchronization can be configured in the server. Version Control and Comments In addition to offline access, Files also provides users with version control and comments. Any changes to documents are saved as a new version with the ability to revert back to an older version if necessary. All changes are saved with the username of the user that modified the document. In addition to version control, Files also allows users to comment on a document. The comments feature helps users interact while editing a document and collaborate effectively. Administration Features of Files In addition to the end-user features described above, the Files component also includes features that are useful to IT administrators. Add Users and Groups You can add users during the Horizon Workspace setup process by creating filters to determine the directory users you plan to transfer to Horizon Workspace. Users and groups must be added to Horizon Workspace before they are entitled to use the Files functionality. Each user record must include a username, first name, last name, address, and any required extended attributes. If this information is not included, the user entry displays on the Errors page. The user record fails to transfer to Horizon Workspace, and thus cannot be used by the Horizon Workspace Files virtual appliance. Remote Wipe and Deprovisioning of Users One of the key features of the Horizon Workspace Files virtual appliance is the ability to deprovision users when they are no longer entitled as corporate users. You can deprovision users from the Users & Groups tab of the Horizon Workspace Web interface, which removes all the entitlements provisioned to them in the system. To ensure that data is secure, Files allows administrators to remotely wipe user data from any device. Changes made to the localconfig file are overwritten after an upgrade, so you should copy your changes before doing an upgrade. WHITE PAPER / 54

55 Files Exercises After familiarizing yourself with the Files features, you are ready to enable and configure data as a component of VMware Horizon Workspace. This section provides hands-on exercises so you can experience and evaluate the key features of Files. The exercises are sequential and build upon one another. Note: The feature set previously named Horizon Data, also called Horizon Files in some documents, is referred to as Files in this Guide. The filename of the corresponding virtual machine data-va has not changed. Exercise 1: Add Virtual Disks to the Data Server To correctly size and allocate storage to the Horizon Workspace Files virtual appliance (data-va), you must add disks and expand the volumes in the virtual appliance. 1. Launch the vsphere Client and log in to your environment. 2. Expand the VMware Horizon Workspace vapp, find and right-click the data-va virtual appliance, and then select Edit Settings. Figure 72: Edit Settings in vsphere Client 3. To accept any warnings about making modifications to the vapp, click Yes. Figure 73: vapp Modification Warnings WHITE PAPER / 55

56 4. In Edit Settings, under the Virtual Hardware tab, add as many new hard disk devices as appropriate for your deployment. Figure 74: Add Hard Disks in Virtual Machine Settings 5. Provide the appropriate data for each new hard disk device, and then click OK. Figure 75: Set up Each New Hard Disk WHITE PAPER / 56

57 6. After resizing, reboot the server immediately so that Horizon Workspace recognizes the additional storage device(s). 7. Ensure that the disks are added correctly by checking the Tasks pane, and then proceed with the exercise. Figure 76: Tasks Pane 8. Select the data-va virtual appliance from the vsphere Client. Open a console session, and then log in as root and type the administrator password that was used during setup in Complete the Web-Based UI Setup. 9. When you arrive at the console prompt, type the following command /opt/vmware-hdva-installer/bin/zca-expand-lv 10. Wait for the process of adding the new storage and resizing the volume online to finish. Figure 77: Add New Storage and Resize Volume 11. When the process of adding storage disks and expanding the volumes in the virtual appliance is finished, you can proceed to the next exercise to install LibreOffice to enable preview. WHITE PAPER / 57

58 Exercise 2: Install LibreOffice to Enable Preview Now that you have added new storage disks and resized the volumes in the Horizon Workspace Files virtual appliance, you are ready to enable the preview functionality by installing LibreOffice. 1. Select the data-va virtual appliance from the vsphere Client, open a console session, and log in as root using the administrator password from Complete the Web-Based UI Setup. Note: If a proxy is used, first type the following command export http_proxy= number] 2. From the console prompt, type the following command /opt/zimbra/libexec/libreoffice-installer.sh Figure 78: Installing LibreOffice 3. After LibreOffice has successfully installed, switch to the VMware Zimbra service account by typing the following command su - zimbra WHITE PAPER / 58

59 4. Enable the preview functionality by typing the command zmmailboxdctl restart Figure 79: Enabling Preview Function 5. After you have successfully installed LibreOffice and enabled the preview functionality, log out of the appliance, close the console, and proceed to the next exercise to entitle users and groups to use Files. Exercise 3: Entitle Users and Groups to Use Files After successfully installing LibreOffice and enabling the preview functionality, you are ready to entitle users and groups to use Files. 1. Open the Horizon Workspace administrative interface by navigating to admin and log in with the administrator account that you specified during Complete the Web-Based UI Setup. Figure 80: Log in As Horizon Workspace Administrator WHITE PAPER / 59

60 2. In the Catalog tab, click Services > Horizon Files > Add a new Group Entitlement. Figure 81: Add New Group Entitlement 3. Search for the appropriate group (such as Domain Users) to entitle, select this group, and then click Save. Figure 82: Select and Entitle a New Group WHITE PAPER / 60

61 4. Log in as an entitled user, and verify that Files functionality is now available. 5. When you have verified that your users and groups are successfully entitled to use Files, you can proceed to the next exercise to unentitle users and perform a remote wipe. Exercise 4: Unentitle Users and Remote Wipe After you have entitled users and groups to use Files, you can unentitle individual users and perform a remote wipe to delete their data. 1. In the Horizon Web interface, click Catalog > Services > Horizon Files, and find the User Group that you entitled in Entitle Users and Groups to Use Files. From the UI, click the Unentitle link. Figure 83: Select User Group to Unentitle 2. In the Users & Groups tab, click the group that you just unentitled, click Users in this Group, and then click the specific user(s) to be unentitled from the list. Figure 84: Select User to Unentitle WHITE PAPER / 61

62 3. Click Workspaces to view an individual user s Workspaces. Figure 85: User s Workspaces 4. In the cell on the right, click Delete to delete any data stored on the device by this end user. Figure 86: Unentitle the User and Delete Their Data 5. When you have verified that the user has been unentitled completely, you can proceed to the next exercise to install the VMware Horizon Workspace Client on Windows. WHITE PAPER / 62

63 Exercise 5: Install the VMware Horizon Workspace Client on Windows Now that you know how to successfully unentitle a user whenever necessary, you are ready to install the VMware Horizon Workspace Client. 1. Log in to the VMware Horizon Workspace Web interface at and then from the user control panel in the top right corner, select Download Horizon. Figure 87: Log in to Install Horizon Workspace Client on Windows 2. Select the appropriate client for your operating system: Mac Desktop Client, Android Client, iphone & ipad Client, or Windows Desktop Client. Figure 88: Select the Appropriate Client WHITE PAPER / 63

64 3. Install the VMware Horizon Workspace Client, and when the installation is complete, launch the client and authenticate with your username and password. Figure 89: Horizon Workspace Login 4. Open the new local OS Horizon folder that was automatically created by the Horizon Workspace Client, and create the folders you require. Figure 90: Open the New Horizon OS Folder > Create New Folders WHITE PAPER / 64

65 5. Launch the Horizon Workspace Web interface at and log in with the same user account that you used in the client install. Verify that you see the same folder structure in the Web client view, and then click several documents to verify that the integrated preview feature is working as expected for each document. Figure 91: Launch Horizon Workspace Web Interface and Verify Preview Feature 6. When you have verified that the VMware Horizon Workspace Client has successfully installed and is working properly, proceed to the next exercise to share and comment on files and folders, and verify version control. WHITE PAPER / 65

66 Exercise 6: Share and Comment on Files and Folders, Verify Version Control After successfully installing the VMware Horizon Workspace Client, you are ready to share files and folders, add comments to them, and verify version control. 1. Launch the Horizon Workspace Web interface at and log in. Then select a folder, click the down arrow next to the folder name, and click Share. Figure 92: Use Horizon Workspace Web Interface to Select and Share a Folder 2. Type the addresses of the people with whom you want to share the folder, and click Share to send the invitation to them. Figure 93: Invite Window WHITE PAPER / 66

67 3. Locate a document, open it, and add a few comments. When you have finished adding comments, log in as a different user, and reopen the same document to verify that you can view the added comments. Figure 94: Add Comments to a Document > Log in and Verify the Comments 4. Open a document to edit, make changes to it, and then save the document. Verify that the preview of the document in the Horizon Workspace interface shows an alert in the upper left corner of the preview pane that says, This is an old version. Figure 95: Old Version Alert Notification 5. Click Show the latest version to view the updated document. 6. View the previous versions by clicking the Version drop-down menu in the document. Figure 96: View Previous Versions of Edited Document 7. Open an older version of the document to verify that your recent changes are not present. 8. After you have verified that the share, comment, and version-control functionalities work properly, you can proceed to the next section to review and configure managed mobile workspaces. WHITE PAPER / 67

68 Managed Mobile Workspace Overview and Configuration In previous chapters, you learned about VMware Horizon Workspace by installing and configuring it, by manipulating Files, and by impacting the end-user experience and administration features. Now you are ready to delve into the management of mobile workspaces using policies and their components. This chapter provides an overview to familiarize you with policy components, and describes how to enable and configure mobile applications and their policy components in VMware Horizon Workspace. Mobile Application Management A managed mobile workspace can include managed files, managed mobile applications, and managed Web applications. VMware Horizon Workspace allows IT administrators to deploy enterprise-approved applications to Android endpoints. Figure 97: Mobile Management Module Managed Policies Managed policies enable enterprises to control how users interact with their Horizon Workspace managed applications without interfering with applications and settings on the users BYOD endpoints. Possible application policies that can be deployed include Data-containment policies Passcode policies Workspace lifetime policies Secure network access policy WHITE PAPER / 68

69 Supported Platforms and Types of Mobile Applications VMware Horizon Workspace supports both native mobile applications and Web applications on VMware Ready Android endpoint devices. You can add Apple ios AppStore apps to the catalog as a way to recommend applications to end users without policy enforcement. On Android devices, Workspace Images is an advanced feature that allows operating system images to be installed. Note: A VMware Ready device is required to run the Android managed workspace. Policy management for ios devices is not supported at this time. Policy Enforcements for Enterprise Applications VMware Horizon Workspace provides a policy-enforcement feature for internally developed enterprise applications. This feature enhances security for mobile applications. For example, a data-containment policy can be used to prevent data from being copied outside of internal enterprise applications. Mobile Workspaces A Horizon Workspace mobile workspace is secured with policies. With these policies, IT administrators can disable or wipe devices that were stolen or that belong to terminated employees. This improves corporate data security. WHITE PAPER / 69

70 Managed Mobile Workspace Exercises Now that you are familiar with Horizon Workspace mobile management policies, installation prerequisites, and components, you are ready for the hands-on exercises to help you evaluate the key mobile management features of Horizon Workspace. These exercises are sequential and build upon one another. You must have VMware Ready mobile devices available to complete the exercises, which you can find on the VMware Ready Smartphones List. Exercise 1: Enable Mobile Management After you have been introduced to the key features of mobile management in Horizon Workspace, you are ready to enable the Mobile Management module. 1. Log in to Horizon Workspace as an administrator. 2. Click Enable this module inside the Mobile Management module tile. 3. When mobile management is enabled, the Dashboard displays the enabled functionality. Figure 98: Module Tile Shows Mobile Management Enabled 4. After enabling mobile management, proceed to the next exercise to put it to use on an Android device. WHITE PAPER / 70

71 Exercise 2: Use Files on an Android Device Now that you have successfully enabled the Mobile Management module, you can use the Files feature of Horizon Workspace on an Android device. 1. On your VMware Ready Android device, go to the Google Play store, and find and install the VMware Horizon Workspace app. Important: A VMware Ready device is required for this series of exercises. To obtain VMware Ready devices, see the VMware Ready Smartphones List. 2. From the Android home screen, launch the Horizon Workspace app. Figure 99: Android Home Screen 3. Type the URL for your Horizon Workspace server into the Horizon Workspace app, and then tap Connect. Figure 100: Typing Horizon Workspace Server URL WHITE PAPER / 71

72 4. Type the demo Username and Password mentioned earlier, and tap Sign in. Figure 101: Typing Username and Password to Sign In 5. Wait while the credentials are authenticated. Figure 102: Authenticating Credentials WHITE PAPER / 72

73 6. Verify that the Horizon Workspace app screen lists the Horizon files, as shown in the following screenshot example. Note: Because this user already has access to Files, the app accesses the same set of files as those used earlier in the Files Exercises. Figure 103: List of Horizon Files 7. Tap a file to see a preview. Figure 104: Preview of VMware Horizon Workspace Reviewer s Guide 8. When you have successfully used the Files feature of Horizon Workspace on an Android device, you can proceed to the next exercise to add referred Android apps to the catalog. WHITE PAPER / 73

74 Exercise 3: Add Referred Android Apps to Catalog Now that you have used Files on an Android device, you are ready to add referred Android apps to the catalog. Referred Android apps can be added to managed mobile workspaces as a way to recommend that users install such apps. Note: Horizon Workspace policies do not apply to apps that are installed in this way. 1. Log in to the Horizon Workspace Administrative Interface. 2. In the Catalog tab, click Mobile Applications, and then click + Mobile Application >...from Google Play. Figure 105: Add a Mobile Application 3. Type the Name of the app and an optional Description and Icon. Figure 106: Add Application Details Window WHITE PAPER / 74

75 4. In the left-hand pane, click Configuration, and then type the required information. For the example used in this exercise, the following information was typed: - Application ID: com.cisco.webex.meetings - Google Play URL: market://details?id=com.cisco.webex.meetings - Minimum API Level: 7 Figure 107: Add Application Configuration Window Note: To find the same information for other Google Play apps, see the VMware Horizon Workspace Documentation. 5. To entitle this app to the Mobile Demo group, click + Add group entitlement and then in the Add Group Entitlement window, click Save. Figure 108: Add Group Entitlement WHITE PAPER / 75

76 6. Launch the Horizon Workspace app from the Android device, log in, and type a password if necessary. 7. From the menu on the upper left, select Applications. Figure 109: Applications Menu 8. From the menu on the upper right, select Add application. Figure 110: Selecting Add Application from Menu WHITE PAPER / 76

77 9. Tap the name of the application in the list to see its details. Figure 111: Tap WebEx Meetings to View App Details 10. Tap the Download button to navigate to the app in the Google Play store and see details about this app, and then tap INSTALL to install the app. Figure 112: Cisco WebEx Meetings App in Google Play Store WHITE PAPER / 77

78 11. Tap ACCEPT to accept the list of permissions that the app requires access to. Figure 113: App Permissions 12. After installing a referred app, you can now launch it on the Android device. Note: A referred app is not subject to any policy enforcement as defined by Horizon Workspace. 13. When you have successfully added referred Android apps to the catalog, you can proceed to the next exercise to entitle users and groups to managed mobile workspaces. WHITE PAPER / 78

79 Exercise 4: Entitling Users and Groups to Managed Mobile Workspaces Now that you have successfully added referred Android apps to the catalog, you are ready to entitle users and groups to managed mobile workspaces. To use a managed mobile workspace on a mobile device, your users must be entitled to the set of files and applications that make up that managed mobile workspace. When they use the client application on their mobile device to connect to Horizon Workspace for the first time, Horizon Workspace provisions their entitled managed mobile workspace to that device, and applies the relevant associated mobile policy settings. There are two available methods for entitling users and groups to managed mobile workspaces. In many cases, adding the entitlements to a group of users is the most effective way to entitle them to manage mobile applications and the workspace images for VMware Ready devices. In certain situations, however, entitling individual users to the mobile applications and workspace images is more appropriate. Follow these steps to entitle both users and groups to workspaces. 1. Log in to the Horizon Workspace Administrative Interface. 2. Click the Catalog tab, and then in the Workspace Images section, click the icon for the workspace image. Figure 114: Catalog Tab in Horizon Workspace Administrative Interface WHITE PAPER / 79

80 3. On the Workspace Image resource page, the Entitlements tab is selected by default. Group entitlements are listed in one area of the page, while individual user entitlements are listed in another. Choose one of the following options: a. + Add group entitlement b. + Add user entitlement Figure 115: Workspace Images > Entitlements 4. Type the names of the groups or users. You can search for users or groups by starting to type a search string and allowing the autocomplete feature to list the options, or you can click or browse. to view the entire list. Then click Save. Figure 116: Workspace Images > Entitlements > Add Group Entitlement WHITE PAPER / 80

81 5. On the Entitlements page, click Done. Figure 117: Click Done to Update Tables 6. Click Back to Catalog, and then in the Mobile Applications section, click the icon representing the imported Android application that you plan to entitle users and groups to, such as OfficeSuite in the following example. Figure 118: Catalog > Mobile Applications WHITE PAPER / 81

82 7. On the application resource page, the Entitlements tab is selected by default. Group entitlements are listed in one area of the page, while user entitlements are listed in another. Click + Add group entitlement or + Add user entitlement as appropriate. Figure 119: Mobile Applications > Entitlements 8. Type the names of the groups or users, and then click Save. You can search for users or groups by starting to type a search string and allowing the autocomplete feature to list the options, or you can click or browse. to view the entire list. Figure 120: Mobile Applications > Entitlements > Add Group Entitlement WHITE PAPER / 82

83 9. On the Entitlements page, click Done. Figure 121: Click Done to Update Tables 10. Repeat this procedure for each Android application that you want to entitle to users or groups. 11. When you have successfully entitled your Android application to your users or groups, you can proceed to the next exercise to install and configure VMware Switch for an Android device. WHITE PAPER / 83

84 Exercise 5: Install and Configure VMware Switch for Android Devices Now that you know how to entitle Android applications to users and groups, you are ready to set up your VMware Ready device with VMware Switch for Android. VMware Switch creates a dual-persona environment on your VMware Ready Android device. This solution enables the enterprise to create a secure, isolated workspace for enterprise applications, files, and collaboration tools on the mobile device. This BYOD enablement allows the end user to switch between the enterprise workspace and the native Android OS. VMware Switch can be installed on the VMware Ready device through the Google Play store. 1. On your VMware Ready Android device, tap the Google Play app. Figure 122: VMware Ready Android Device Home Screen 2. Search for VMware Switch in the search bar, and tap VMware Switch for Android. Figure 123: Search for VMware Switch for Android WHITE PAPER / 84

85 3. Tap INSTALL to install VMware Switch. Figure 124: Tap INSTALL to Install VMware Switch 4. Tap ACCEPT to begin installation. Figure 125: Tap ACCEPT to Begin Installation WHITE PAPER / 85

86 5. When installation is complete, tap the VMware Switch icon to open the app. Figure 126: VMware Switch Icon on Android Device Apps Menu 6. Type the hostname for the VMware Horizon Workspace Management Server. Figure 127: Typing Management Server Address WHITE PAPER / 86

87 7. Tap Next to continue. Figure 128: Tap Next to Continue 8. Type the username provided by the Horizon administrator, and then tap Next. Figure 129: Typing Username WHITE PAPER / 87

88 9. Type the password, and then tap Next. Figure 130: Typing Password 10. Tap Next to accept the usage terms and conditions. Figure 131: Accept Usage Terms WHITE PAPER / 88

89 11. Wait while VMware Switch downloads the approved workspace image. Figure 132: Downloading Approved Workspace Image 12. When the download is complete, tap the VMware Switch icon in the Apps menu. Figure 133: VMware Switch Icon in Apps Menu WHITE PAPER / 89

90 13. Tap Continue to begin setting up your workspace. Figure 134: VMware Switch Welcome Screen 14. Tap Create password now to set up your password. Figure 135: Creating Password for Workspace WHITE PAPER / 90

91 15. Type a password, and then tap OK. Figure 136: Typing Password 16. Type the password again to confirm, and then tap OK to continue. Figure 137: Confirming Password WHITE PAPER / 91

92 17. Type your corporate address and password to set up in the enterprise workspace, and then tap Next. Figure 138: Typing in Account Username and Password to Set up 18. Type your corporate account credentials, and then tap Done. Figure 139: Typing Account Details WHITE PAPER / 92

93 19. Tap OK to accept the corporate security policy and finish the account setup. Figure 140: Accept Corporate Security Policy 20. When setup is complete, tap Launch Switch to access the workspace. Figure 141: Launch Switch to Access the Enterprise Workspace WHITE PAPER / 93

94 21. Browse your new secure mobile workspace with approved enterprise applications. Figure 142: Browse Enterprise Workspace Note: To switch between the enterprise workspace and the native Android environment, tap the VMware Switch icon. 22. When you have successfully completed the setup of your VMware Ready device with VMware Switch for Android, you can proceed to the next exercise to work with workspace policies for managing mobile workspaces. WHITE PAPER / 94

95 Exercise 6: Working with Mobile Workspace Policies Now that you have set up a VMware Ready device with VMware Switch for Android, you are ready to create new mobile workspace policies to limit the access of specific users to the functionality of your choosing. Policy settings control both the actions that users can perform in their workspaces, and security settings such as password strength and expiration. The policy settings that apply to a user s workspace depend on the group that the user belongs to. Horizon Workspace administrators can control policies for data containment, workspace lifetime, passcode, and secure network access functionality within the secured workspace environment. For the purpose of these exercises, policies are applied to limit access to copy-and-paste, camera, and workspace lifetime functionalities. 1. Log in to the Horizon Workspace Administrative Interface. 2. Click the Policies tab, and in the Data Containment Policy section, click + Data Containment Policy Set to create a new policy. Figure 143: Mobile Policy Sets WHITE PAPER / 95

96 3. In the Add a Data Containment Policy Set editor, type the name of the new policy. Figure 144: Add a Data Containment Policy Set 4. To enable a policy setting, click the check box under Enable Policy, make appropriate policy modifications, and then click Save. Figure 145: Save Policy Settings In this example, the use of copy and paste and the camera are disabled by clicking No in the Allow copy & paste and Allow use of camera policy rows. WHITE PAPER / 96

97 5. Scroll down to Workspace Lifetime Policy Sets, and then click + Workspace Lifetime Policy Set to create a new workspace lifetime policy. Figure 146: Workspace Lifetime Policy Sets 6. Type the name of the new policy. Figure 147: Typing Name and Description of New Policy In this example, a policy is set for a lease interval of 12 hours, with auto disable set at 15 days, and auto wipe set at 30 days. These policy settings disable the enterprise workspace if the end user does not use the workspace for a period of 15 consecutive days, and wipe the workspace if the end user does not use the workspace for a period of 30 consecutive days. WHITE PAPER / 97

98 7. Click the check box to enable the policy, and then click Save. Figure 148: Enable Policy You have now created two new policies. The next step is to apply the policy to a user or group. Apply the Policy to a User or Group To apply the new policy: 1. Click the Users & Groups tab, and then click the group to apply this policy to. Figure 149: Apply Policy to Group In this example, the policy is applied to the HZWSUsers group. 2. Click Applied Mobile Policy Sets. Figure 150: HZWSUsers Window WHITE PAPER / 98

99 3. Click Select Mobile Policy Sets. Figure 151: HZWSUsers > Applied Mobile Policy Sets This group currently has the base (default) policies applied to their workspaces. Figure 152: Base Policy Sets Applied 4. Select the newly created polices in each drop-down menu, and then click Save. Figure 153: Selecting New Policies from Drop-Down Menu The policies are now deployed to the workspace environments assigned to the group HZWSUsers. Next, you can take a look at one of these policies in action. WHITE PAPER / 99

100 View a Policy in Action To see the new policy in action: 1. On the VMware Ready Android device, tap VMware Switch to switch to the enterprise workspace. Figure 154: Tap VMware Switch Icon to Test Policies 2. Tap the Apps icon to list all the applications available in the secured workspace. Figure 155: Apps Icon on Secured Workspace Screen WHITE PAPER / 100

101 3. Tap the Camera app. Figure 156: Camera Application in Apps Screen 4. The camera is disabled with the applied Disable Clipboard and Camera workspace policy; this policy prevents the end user from using the camera as displayed on the device. Figure 157: Camera Application Disabled With the completion of this exercise, you have completed all of the exercises in this section, concluding with the creation of several policy sets, application of those policies to end users and groups, and verification of the policies in action. WHITE PAPER / 101