Welcome to Vsphere Management Assistant Permission Denied Please Try Again

maio 16, 2022 Postar um comentário

Navigation

Change Log
Planning
Upgrade
Prep:
- DNS Configuration
- LDAP Accounts
- SQL Database
OVF Deployment
Setup Wizard
SSH – Enable Root Access
Identity Manager Certificate
Load Balancing
Windows Connector
Configure:
- Active Directory
- Sync Connector Back-up
- Sync Group Membership
- Logon Experience
- Administrators
- License
- SMTP
- Kerberos Authentication
- Customize Appearance
Resources:
- Horizon View Administrator – Enable SAML Authentication
- Identity Manager – Connect to Horizon
- Identity Managing director – Horizon URLs
- Identity Manager User Portal

💡 = Recently Updated

Change Log

2021 Sep 8 – updated entire article for VMware Workspace ONE Access 21.08
2019 Apr 24 – updated entire article for Identity Managing director 19.03.0.0, including:
- External Windows Connectors instead of embedded connector
- New instructions for adding Virtual Apps Collection

Planning

VMware Workspace 1 Admission (formerly known as Identity Manager) is a component of VMware Workspace I.

For Horizon, VMware Workspace ONE Access enables SAML hallmark, and integration of additional apps from Citrix and the web (e.g. SaaS).
For full functionality, VMware Workspace ONE Access should be paired with VMware Workspace One UEM (aka AirWatch; not detailed in this commodity).

Workspace 1 Access System and Network Configuration Requirements at VMware Docs.

From Workspace I Access Architecture in the VMware Workspace ONE and VMware Horizon Reference Compages:

Unmarried data centre:

Multiple data centers:

Upgrade

Version nineteen.03 and newer no longer include the embedded Connector so you must deploy i or ii Windows machines to run the external connector. The embedded Connector can be migrated to the external Windows connector.

You must upgrade to Workspace I Access twenty.10 before you can upgrade to Workspace ONE Access 21.08. See Overview of Upgrading to Workspace ONE Access 21.08 at VMware Docs.

Make sure the Identity Director SQL Service Account is a db_owner on the Identity Manager database. Y'all tin remove the permission afterward the upgrade.

For clusters, remove all nodes except ane from the load balancer and upgrade the node that is even so connected to the load balancer. Then upgrade the remaining nodes.

If you lot don't have an Windows-based Connector and need to migrate from the Embedded Connector, then do the following:

Download the VMware Identity Director Standalone Connector Installer for Windows. Yous'll install this later.
From the aforementioned page, download theCluster Migration Back up Tools.
Enable ssh admission for the root account if y'all haven't already.
WinSCP to the Identity Manager appliance and upload the cluster-support.tgz file to the/root directory. Afterwards uploading the file, don't close WinSCP yet.
SSH (e.g. Putty) to the appliance equally root.
Run/usr/local/horizon/update/updatemgr.hzn updateinstaller
You'll be prompted to enter passwords for the cluster file.
Back in WinSCP, download the.enc file that was created. You might take to refresh WinSCP to run across the file.
So back in SSH, run /usr/local/horizon/update/updatemgr.hzn update
Updating will take several minutes.
Run thecheck control once more to see if there are any other updates available.
Thenreboot the appliance.
Build a Windows 2016 or Windows 2019 server. Windows 2019 is supported with Connector 21.08 and newer. For back-up, yous can build two Windows servers.
Copy the.enc file to the C: drive of the Windows server. Information technology volition not work from a UNC path.
On the Windows server, run VMware_Identity_Manager_Connector_19.03.0.0_Installer.exe to install the Connector.
Click Next through a few obvious screens and then check the box when askedAre you migrating your Connector.
Browse to the local .enc file, enter the password specified before, and and then clickNext.
In the next page, verify the hostname, and and then clickNext.
In thedomain user account page, note that some of the authentication methods require the connector to run as a service account and then y'all might every bit well gear up that up at present. Click Next.
- The service business relationship must be a local ambassador on the Connector server.
Click Next through the end of the magician.
Click No when prompted to load the Connector's admin page because the Connector should already be configured.
If Windows Firewall is enabled, then add together a rule to permit inbound TCP 8443. This rule allows you to configure Authentication adapters from a remote automobile.
In Identity Manager Admin, at Identity & Admission Management > Setup > Connectors, y'all can delete the old embedded connector.
In Identity & Admission Direction (Manage), click theIdentity Providers tab.
So click the link for the Workspace IdP.
In theIdP Hostname field, edit the URL to bespeak to the external Windows connector. With outbound way, this URL is just used for Kerberos hallmark, if enabled.

New Deployment Grooming

DNS Configuration

If yous intend to build multiple appliances (three or more) and load residual them, specify a unique DNS name for each appliance. The Load Balancing DNS name is different from the apparatus DNS names. For example:

Appliance one = access01.corp.local
Appliance 2 = access02.corp.local
Appliance 3 = access03.corp.local
Load Balancing Proper name = access.corp.com. This name is used both internally and externally.

VMware Workspace One Admission DNS names are separate from Horizon DNS names.

You'll need SSL certificates that lucifer these names.

Each of these DNS names must take a corresponding contrary DNS pointer record.

Create DNS records for the virtual appliances.
Create contrary pointer records too. Reverse pointer records are required.

LDAP Accounts

All accounts synced with VMware Workspace Ane Access must have Outset Name, Terminal Name, and E-mail Accost configured, including the Bind business relationship.
Create a new Active Directory grouping for your VMware Workspace ONE Access users. Assign this grouping to your pools instead of assigning Domain Users.

SQL Database

If you desire to build multiple Identity Manager appliances and load balance them, configure them with an external database (e.k. Microsoft SQL).

For a script that performs all required SQL configuration, see Configure a Microsoft SQL Database at VMware Docs.

In SQL Direction Studio, create a New Query.
Re-create the SQL commands from VMware Docs and paste them into the New Query window.
1. For Windows Authentication, copy the commands from Configure the Microsoft SQL Database with Windows Authentication Mode.
2. For SQL Authentication, copy the commands from Configure Microsoft SQL Database Using Local SQL Server Authentication Mode.
3. Change the values in the brackets.
4. Co-ordinate to Rob Beekmans at Deploying VMware Workspace One iii.x – database setup, mandatory or child-bearing parameters?, in Identity Manager 3.0 and newer, y'all tin can modify any of the parameters, except that the database schema (merely not database name) must be saas.
And so click Execute.

OVF Deployment

Download the VMware Workspace One Access 21.08.0.0 Service Virtual Appliance OVA file.
In the vSphere Web Client, right-click a cluster, and click Deploy OVF Template.
In the Select source folio, browse to the identity-managing director-21.08.0.0_OVF10.ova file, and click Adjacent.
In theSelect proper name and location page, enter a name for the VM, and click Adjacent.
In theSelect a resource page, select a cluster, and clickNext.
In the Review details page, click Next.
In the Accept License Agreements folio, click Take, and then click Adjacent.
In the Configuration page, select a size and click Next.
In the Select storage folio, select Thin Provision, select a datastore, and click Adjacent.
In the Select networks page, select the network for the appliance. You can deploy it either internally, or in the DMZ. If in the DMZ, yous can later install Workspace Ane Access Connectors in the internal network in outbound merely mode. Click Next.
In the Customize template page:
1. Make a selection regarding Customer Experience Improvement Plan.
2. Select a time zone.
3. Expand Networking Properties if information technology's not already expanded.
4. The Networking Backdrop are displayed in a different order depending on which vSphere Web Customer y'all're using.
5. Host Name – Enter a hostname for the first appliance.
  - If you intend to build multiple appliances and load rest them, and so each appliance needs a unique name that does not match the load counterbalanced name. If you only want to build i appliance, and so the appliance Host Name should match any users will use to access Identity Manager.
6. DNS and Gateway – In the Networking Properties department, enter the standard DNS and Gateway information.
7. Co-ordinate to Install the Workspace One Access OVA File at VMware Docs, the Domain Proper name and Domain Search Path fields are non used.
8. IP Accost – Enter the IP address that is configured in DNS for the host name. DNS reverse lookup for this IP address must resolve to the appliance Host Name.
Click Next.
In the Set up to complete page, click Finish.

Setup Wizard

Power on the appliance.
Look for the appliance to ability on and fully boot.
Become to https://myAccessFQDN to admission the Access Setup Sorcerer.
Note: you must connect to the DNS name. Connecting to the IP address will crusade problems during the database setup procedure.
In the Prepare Passwords page, enter passwords for the three accounts, and click Continue.
In the Select Database page, alter it to External Database.
Annotation: this folio will only role properly if your address bar has a DNS name instead of an IP address.
For Windows hallmark, enter a JDBC URL like to the following, enter credentials for the Horizon Windows service account, and so click Keep. Access 21.08 and newer has an option to encrypt the database connection.
```
jdbc:jtds:sqlserver://<hostname_or_IP_address:port#>/<database_name>;integratedSecurity=true;domain=<domainname>;useNTLMv2=true;multiSubnetFailover=true
```
For SQL authentication, enter a JDBC URL similar to the following, enter the credentials for the Horizon SQL account, and so click Continue. Access 21.08 and newer has an option to encrypt the database connection.
```
jdbc:sqlserver://mysqlserver.corp.local;DatabaseName=saas;multiSubnetFailover=true
```
The database volition be configured.
In the Setup Review page, click the link to log in to the Admin Console.

SSH – Enable Root Admission

This is optional. Enabling root access lets yous use root credentials when using WinSCP to connect to the appliance. Instructions can be establish at VMware Web log Post Enabling SSH in Horizon Workspace Virtual Appliances.

Putty to the VMware Workspace I Access appliance.
Login as sshuser.
Run su – and enter the root countersign.
Run vi /etc/ssh/sshd_config .
Scroll down to line containing PermitRootLogin.
Press <i> on the keyboard to change to insert mode.
Go to the end of the line and alter no to aye.
Press <ESC> to go out insert fashion.
Type :ten to save the file and get out.
Run systemctl restart sshd.

VMware Admission Certificate

The Windows Connectors require the VMware Access certificate to be trusted. Generate a new appliance certificate using a trusted Certificate Authority and install the certificate on the appliance.

Login to the Identity Manager web page equally the admin user in the Organisation Domain.
Click Dashboard and and then click System Diagnostics Dashboard.
Click the VA Configuration button next to the appliance.
On the left, click the page namedInstall SSL Certificates.
On the right, clickChoose File next toImport Document File.
Identity Manager 19.03 and newer let you browse to a .pfx file instead of a PEM file.
In thePassword field, enter the .pfx password.
ClickSave.
It will take several minutes for the certificate to exist installed and the apparatus to restart.

Load Balancing

VMware Access tin be cloned, clustered, load balanced, and globally load balanced equally shown below. Source = Multi-site Design in the Workspace I Access Architecture.

To clone multiple VMware Admission appliances and load residue them, run across one of the post-obit:

For Citrix ADC load balancing of VMware Access, run into https://world wide web.carlstalhood.com/VMware-Identity-Manager-Load-Balancing
For F5 load balancing of Identity Manager, see EUC CST Tech Notes – IDM Steps by steps 3 node cluster – v4.pdf at VMware Communities

Windows Connector

Identity Manager 19.03 and newer no longer include an embedded connector. Instead, build ane or more than Windows connectors.

Note: Connector 21.08 and newer does back up Horizon. Connectors from VMware Access twenty.10 and twenty.01 do not support Horizon. Or stay with Connector version nineteen.03 or 19.03.01.

Annotation: 19.03.01 simply works with VMware Access 20.10 service. Exercise not deploy nineteen.03.01 on older Identity Manager or older VMware Access. Reference = VMware Communities.

Load residuum your VMware Admission appliances and so the Connector can connect to the Load Balanced FQDN instead of a unmarried VMware Access appliance.
Build one or more Windows machines on the internal network that will host the Windows connector. The Windows machines must be joined to the domain.
- Windows Server 2019 is supported in Connector 21.08 and newer.
- See System Requirements at VMware Docs for sizing information.
- For multi-information center, build separate Connectors for each data center. The Connectors connect to the VMware Access appliances in the local information middle. For details, see Deploying VMware Workspace 1 Access in a Secondary Data Center for Failover and Back-up at VMware Docs.
The VMware Access certificate must exist trusted past the Connector servers.
Login to the VMware Admission administration console through the load balanced FQDN as the admin user in the System Domain.
On the top tabs, switch toIdentity & Access Management.
On the sub-menu bar, on the far right, clickSetup.
On the sub-menu bar, on the left, clickConnectors.
Click the bluishNEW button.
In the Select the Connector page, select the Workspace One Access Connector 21.08 and click OK.
Click Proceed Anyway.
In the Download Installer page, click the button to Become to myvmware.com and download the connector installer if you oasis't already. Then click Next.
In the Download Configuration File page, enter a password and click Download Configuration File and salvage it somewhere. Then click Next.
In the Summary folio, click Close.
Run into Workspace One Access Connector 21.08 Systems Requirements at VMware Docs for sizing guidelines. For example, installing all components on a single server requires 12 GB of RAM.
On the Windows car, run Workspace-Ane-Access-Connector-Installer-21.08.0.0.exe.
Click Install to install .Internet Framework four.eight.
Click Yes to restart.
Restart the install by running Workspace-1-Access-Connector-Installer-21.08.0.0.exe.
In theWelcome to the Installation Magician for Workspace ONE Access Connector page, clickNext.
In theLicense Agreement page, click I accept the terms, and so click Next.
In the Service Selection page, click Side by side.
In the Specify configuration file page, browse to the es-config.json file downloaded earlier then click Side by side.
In the Select Default or Custom Installation page, choose Custom and then click Side by side.
In theSpecify Proxy Server Data page, click Side by side.
In the Specify Syslog Server Information folio, click Adjacent.
In the Install Trusted Root Certificates page, click Browse and upload your CA and Intermediate certificates that signed the VMware Access certificate. Java uses different root certificates than Windows so y'all'll need to upload them here so Java can use them. Click Next.
If you lot are installing the Kerberos Auth Service, then select a .pfx certificate that clients will trust and click Side by side.
In the Specify Ports page, click Next.
In the Specify Service Account page, enter service account credentials then click Next.
- The service business relationship must be added to the local Administrators grouping.
In the Ready to Install the Programme folio, click Install.
In theInstallation Wizard Completed page, click Terminate
Get back to VMware Access and see the new Connector. If y'all don't come across information technology, then check C:\Plan Files\Workspace ONE Admission\Virtual App Service\logs on the Connector server.

Configuration

Agile Directory

Login to the VMware Access web folio every bit the admin user in the System Domain.
Switch to the Identity & Access Direction tab.
On the top right, switch to the Setup view.
On the left, switch to the User Attributes sub-tab.
Scroll downward. Cheque the boxes next to distinguishedName and userPrincipalName. These are needed for Horizon.
In theAdd other attributes to utilize section, click the plus icon.
EnterobjectGUID.
Click the light-green plus and add mS-DS-ConsistencyGuid. These are needed for Function 365 integration.
And then click Save.
On the meridian right, switch to the Manage view.
On the Directories tab, click Add Directory > Agile Directory.
Enter a Directory Name.
Modify it to Active Directory over integrated Windows Authentication.
Select a Directory Sync Connector. You can select more Sync Connectors subsequently.
Scroll down.
Enter the LDAP Bind credentials. Click Salvage & Next.
Select the domains you desire to sync, and click Next.
In the Map User Attributes page, curlicue down, select whatever missing aspect, and click Next.
In the Select the Groups folio, click the plus icon to add a DN.
Enter a Base DN in LDAP format, and click Find Groups.
Search for your Access Users group, select information technology, and click Save.
Click Next.
In the Select the Users page, click Next.
In the Sync Frequency field, brand a pick and so click Sync Directory.
You lot tin click the link to view the Sync log.
Y'all tin can click the directory name, and and so click Sync log to view the log.
Sync Settings can be changed past clicking the button on the correct.

Sync Connector Redundancy

Build another Windows Connector.
In the VMware Admission console, in the Identity & Admission Management page, on the left, click theDirectories link.
Click the link for your Active Directory domain.
On the right, click theSync Settings push.
Switch to theSync Service tab.
Select the 2nd connector and click the plus icon.
You tin can order the connectors in failover guild. ClickSave.

Sync Group Membership

By default, VMware Access does not synchronize group members. Y'all can force a sync.

Go toUsers & Groups > Groups.
Notice that the groups are Not Synced. Click the link for a group.
Switch to theUsers tab. Then click theSync Users push button.

Logon Experience

Get toIdentity & Access Management > Setup > Preferences.
On the bottom, Identity Managing director ii.9.1 and newer lets yous optionally hide the Domain Drop-Down menu. Then select the unique identifier that Identity Director will utilise to find the user's domain (typically UPN). Identity Manager three.3 and newer can show a Domain Drop-Down if a unique domain cannot be identified.
The user will be prompted to enter the unique identifier.

Administrators

Go to theRoles tab.
You can add a Function. See VMware Weblog Post Introducing Role-Based Access Control (RBAC) in VMware Identity Manager iii.2.
Select an existing role (e.chiliad. Super Admin), and clickAssign.
Search for the user that yous desire to assign the role to. If the user doesn't testify upward, then make sure you are syncing the user, or sync the members of a grouping that the user is a member of.
Then click Salve.

License

Switch to the tab named Appliance Settings.
Switch to the sub-tab named License.
Enter the license primal, and click Save. A Horizon 7 Avant-garde or Horizon vii Enterprise license key volition work. Horizon 8 license doesn't seem to piece of work.

SMTP

On the top, click theApparatus Settings tab,
Click the sub-tab named SMTP.
Enter your post server information, and click Save.

Kerberos Authentication

Kerberos lets users Single Sign-on to the VMware Access web page. Some notes on Kerberos authentication:

It only works for Windows clients.
The clients connect to the Connectors so firewall must permit the entering connection to the Connectors on TCP 443. Outbound only does not work with Kerberos.
- For Loftier Availability, load balance your Connectors.
The Connector (or load balancer) must take a valid, trusted certificate.
The Connector'south FQDN (or load balancer FQDN) must be in Internet Explorer's Local Intranet zone.

Connector Certificate

To upload a certificate to the Connector:

On the Windows Connector automobile, run the Connector installer.
In the Program Maintenance page, leave information technology gear up to Add/Remove Services and click Adjacent.
Keep clicking Adjacent until you become to the Install SSL Document for Kerberos Auth Service folio. Scan to the .pfx, enter the password, and so finish the magician.

TCP 443 Inbound

TCP 443 must be opened inbound to the Connectors. Y'all might have to add TCP 443 to a Windows Firewall rule.

Enable Kerberos hallmark

Login to the VMware Access administration spider web page.
On the top, go to the Identity & Access Management tab.
Click the sub-tab named Enterprise Authentication Methods.
Click the New push button and so click Kerberos.
In the Directory and Hosts page, select the local directory. Select the Connectors. So click Next.
In the Configuration page, if you lot programme to load balance the Connectors, then change Enable Redirect to Yes. Then cease the wizard.
Go to Identity & Access Management > Identity Providers.
On the top right, click Add Identity Provider and then click Create Workspace IDP.
Give the IDP a proper name.
In the Users field, select the directory.
In the Authentication Method field, select Kerberos.
In the IdP Hostname field, enter the FQDN that is load counterbalanced to the Connectors. Click Add together.

Configure Policy to use Kerberos

Later enabling the Kerberos adapter, in Identity Manager 3.2 and newer, go to Identity & Access Management > Manage > Policies and clickNetwork Ranges.
Add a Network Range for internal networks if you lot oasis't already.
Go to Identity & Admission Management > Manage > Policies.
Click Edit Default Policy.
Click Next to go to the Configuration page.
Click Add Policy Rule. Or Click the plus icon to add a Policy Rule.
Select a Network Range for the internal network.
For and the user accessing content from, set it to Web Browser.
Optionally configure and user belongs to group(s). When enabled, VMware Access asks the user for username only, and then looks up group membership to determine which authentication methods should exist used. See Access Policy Settings at VMware Docs.
Select Kerberos as the first authentication method.
Select Password (cloud deployment) as the 2nd authentication method. ClickSave orOK.
Drag the new Policy Dominion to move it to the elevation. And then clickAdjacent andSave.
If y'all interruption your config such that you lot can't login anymore, then see Enabling Intermission-Glass URL Endpoint /SAAS/Login/0 in Workspace One Access at VMware Docs.

Customize Appearance

If you go to Identity & Access Management > Setup > Custom Branding, on the Names & Logos tab you lot can change the browser'south title and favicon.
If yous and then switch to the Sign-In Screen page, y'all tin can upload a logo, upload an epitome, and modify colors.
If you become to Identity & Access Management > Manage > Countersign Recovery Banana, you tin can configure a link to a password recovery tool, or change the Forgot password message.
If yous roll down you can optionally Show detailed message to End User when authentication fails.
Click Catalog, and so click Settings.
On the left, click User Portal Branding.
Make changes to Logos, colors, etc.

Resource

Horizon Console – Enable SAML Authentication

Login to Horizon Console.
On the left, under Settings, click Servers.
On the right, switch to the Connection Servers tab.
Select a Connection Server, and click Edit.
On the Authentication tab, modify Delegation of authentication to VMware Horizon to Allowed.
ClickManage SAML Authenticators.
ClickAdd.
In the Label field, enter a descriptive label.
In the Metadata URL field, enter the VMware Access FQDN.
In the Administration URL field, enter the VMware Admission FQDN, and click OK.
If you see a certificate fault, click View Certificate, and so click Accept.
ClickOK to close theManage SAML Authenticators window.
At that place's a Workspace Ane way, which forces all Horizon Clients to connect through VMware Access instead of directly to the Connection Servers. Delegation of hallmark must exist fix to Required earlier Workspace Ane mode tin can be enabled.

VMware Access – Virtual Apps Collection for Horizon

In the VMware Access Admin Portal, click the Itemize tab, and so clickVirtual Apps Collection.
If you encounterIntroducing Virtual Apps Collection page, clickGo Started.
Click the SELECT link in the Horizon box.
Requite the Horizon Connection a name.
Arrange the Sync Connector appliances in priority social club. Click Adjacent.
Click Add together a Pod.
Enter the FQDN of a Connection Server in the Pod.
Enter Horizon View admin credentials in UPN format. The account needs at least Read Only Ambassador admission to Horizon.
There'south a Truthful SSO choice if yous enabled a non-password authentication to VMware Access.
Click Add.
You lot can optionally add more pods and so enable theCloud Pod Compages option. Click Next when done.
Alter theSync Frequency and Safeguards as desired.
Click Adjacent when washed.
Click Relieve & Configure Network Range. The connection is tested at this time.
The URLs for accessing Horizon are divers in each Network Range. For each URL, create Network Ranges. Or click All Ranges.
Nearly the bottom, in the Client Access FQDN field, enter the FQDN that users in this Network Range employ to login to Horizon. So click Save. Note: the Horizon FQDN is different than the VMware Access FQDN.
Subsequently the Horizon Virtual Apps Collection is added, select information technology, and click Sync without safeguards.
- Annotation: whenever yous brand a modify to the pools in Horizon Administrator, you must either await for the next automatic Sync time, or yous tin return to this screen and click Sync.
You can click the warning icon to come across bug.
If you become toItemize > Virtual Apps, you lot will meet your synced Application and Desktop pools.

Horizon Pools Catalog

In the VMware Access Admin console, at Catalog > Virtual Apps, you can see the Horizon View icons. Only the pools in the root Admission Group are synced.
Click an icon and then clickView Assignments.
Brand sure entitlements are listed. Entitlements are defined in Horizon Console, and not in VMware Access. VMware Access merely syncs the entitlements from Horizon.
Only Advertizing groups synced to VMware Access will be displayed.
If y'all make changes in Horizon Console, so manually sync the Virtual Apps Collection so the changes are reflected in VMware Access.
Dorsum in the Virtual Apps list, if you check the box side by side to one of the icons, you can place the icon in a Category past clicking the Categories carte du jour.
The category is and then displayed next to the itemize detail.
There'due south also a Recommended category.
- Recommended icons tin can be constitute in the User Portal at Apps > Recommended. Users tin can click the Categories drop-downward to see other categories. Users accept to logoff and log back in to see Category changes.
Go to Catalog > Settings.
On the left, clickUser Portal Configuration.
From this screen, y'all can control tab visibility, and put recommended apps in the Bookmarks tab. Click Save when washed.

Separate Horizon View Connectedness Server groups (e.g. multi-datacenter) can be configured in failover social club. See Configure Failover Society of Horizon View and Citrix-based Resources at VMware Docs.

VMware Access – Horizon URLs

The URL used to launch a Horizon icon from VMware Access tin can be different for each Network Range. For internal users, the URL should point to the load counterbalanced VIP for the Connection Servers. For external users, the URL should point to load balanced Unified Access Gateways.

Go to Catalog > Virtual Apps Collection.
Click the link for a Virtual Apps Collection.
Click the Network Ranges tab.
Click an existing Network Range, or create a new one.
Most the lesser, in the Client Access FQDN field, enter the FQDN that users on this Network Range should utilise to admission Horizon. Then click Relieve. Note that the FQDN for Horizon is different than the FQDN for Identity Manager.

VMware Access User Portal

The User Portal is the interface that not-administrators run across after logging in. Administrators tin switch to the User Portal by clicking the username on the pinnacle right and clicking User Portal.

Administrators in the User Portal can switch to the Administration Console by clicking the username on the elevation right.

Some User Portal features:

When a user logs in to the VMware Access spider web page the pool icons will be displayed.
When the user clicks an icon, you can use either Horizon client or Browser for opening a pool. To set the default launch method:
1. On the pinnacle correct, click your name, and click Account.
2. In the Horizon Remote Apps section, click either Horizon Customer or click Browser.
3. The Horizon Client option has a link to download and Install the Horizon Client.
Back in the Apps list, when the user clicks the iii dots adjacent to an icon, there's a link to Launch from Horizon Client.
To mark an icon as aFavorite, click the iii dots next to an icon and so click Add together to Favorites.
Or click an app icon to open the app'due south Details page, so click the star icon.
And then you lot can click Favorites tab to display only icons that are marked as Favorites.
If you lot configured Categories, they are listed in the in the Apps tab in the Categories drib-downwardly.