VMware Workspace ONE Access 21.08

Last Modified: Sep 9, 2021 @ 12:19 pm


💡 = Recently Updated

Change Log


VMware Workspace ONE Access (formerly known as Identity Manager) is a component of VMware Workspace ONE.

  • For Horizon, VMware Workspace ONE Access enables SAML authentication, and integration of additional apps from Citrix and the web (e.g. SaaS).
  • For full functionality, VMware Workspace ONE Access should be paired with VMware Workspace ONE UEM (aka AirWatch; not detailed in this article).

Workspace ONE Access System and Network Configuration Requirements at VMware Docs.

From Workspace ONE Access Architecture in the VMware Workspace ONE and VMware Horizon Reference Architecture:

Single data center:

Multiple data centers:


Version 19.03 and newer no longer include the embedded Connector so you must deploy one or two Windows machines to run the external connector. The embedded Connector can be migrated to the external Windows connector.

You must upgrade to Workspace ONE Access 20.10 before you can upgrade to Workspace ONE Access 21.08. See Overview of Upgrading to Workspace ONE Access 21.08 at VMware Docs.

Make sure the Identity Manager SQL Service Account is a db_owner on the Identity Manager database. You can remove the permission after the upgrade.

For clusters, remove all nodes except one from the load balancer and upgrade the node that is still connected to the load balancer. Then upgrade the remaining nodes.

If you don’t have an Windows-based Connector and need to migrate from the Embedded Connector, then do the following:

  1. Download the VMware Identity Manager Standalone Connector Installer for Windows. You’ll install this later.
  2. From the same page, download the Cluster Migration Support Tools.
  3. Enable ssh access for the root account if you haven’t already.
  4. WinSCP to the Identity Manager appliance and upload the cluster-support.tgz file to the /root directory. After uploading the file, don’t close WinSCP yet.
  5. SSH (e.g. Putty) to the appliance as root.
  6. Run /usr/local/horizon/update/updatemgr.hzn updateinstaller
  7. You’ll be prompted to enter passwords for the cluster file.

  8. Back in WinSCP, download the .enc file that was created. You might have to refresh WinSCP to see the file.
  9. Then back in SSH, run /usr/local/horizon/update/updatemgr.hzn update
  10. Updating will take several minutes.
  11. Run the check command again to see if there are any other updates available.
  12. Then reboot the appliance.
  13. Build a Windows 2016 or Windows 2019 server. Windows 2019 is supported with Connector 21.08 and newer. For redundancy, you can build two Windows servers.
  14. Copy the .enc file to the C: drive of the Windows server. It will not work from a UNC path.
  15. On the Windows server, run VMware_Identity_Manager_Connector_19.03.0.0_Installer.exe to install the Connector.
  16. Click Next through a few obvious screens and then check the box when asked Are you migrating your Connector.
  17. Browse to the local .enc file, enter the password specified earlier, and then click Next.
  18. In the next page, verify the hostname, and then click Next.
  19. In the domain user account page, note that some of the authentication methods require the connector to run as a service account so you might as well set that up now. Click Next.

    • The service account must be a local administrator on the Connector server.
  20. Click Next through the end of the wizard.
  21. Click No when prompted to load the Connector’s admin page because the Connector should already be configured.
  22. If Windows Firewall is enabled, then add a rule to permit inbound TCP 8443. This rule allows you to configure Authentication adapters from a remote machine.
  23. In Identity Manager Admin, at Identity & Access Management > Setup > Connectors, you can delete the old embedded connector.
  24. In Identity & Access Management (Manage), click the Identity Providers tab.
  25. Then click the link for the Workspace IdP.
  26. In the IdP Hostname field, edit the URL to point to the external Windows connector. With outbound mode, this URL is only used for Kerberos authentication, if enabled.

New Deployment Preparation

DNS Configuration

If you intend to build multiple appliances (3 or more) and load balance them, specify a unique DNS name for each appliance. The Load Balancing DNS name is different from the appliance DNS names. For example:

  • Appliance 1 = access01.corp.local
  • Appliance 2 = access02.corp.local
  • Appliance 3 = access03.corp.local
  • Load Balancing Name = access.corp.com. This name is used both internally and externally.

VMware Workspace ONE Access DNS names are separate from Horizon DNS names.

You’ll need SSL certificates that match these names.

Each of these DNS names must have a corresponding reverse DNS pointer record.

  1. Create DNS records for the virtual appliances.
  2. Create reverse pointer records too. Reverse pointer records are required.

LDAP Accounts

  1. All accounts synced with VMware Workspace ONE Access must have First Name, Last Name, and E-mail Address configured, including the Bind account.
  2. Create a new Active Directory group for your VMware Workspace ONE Access users. Assign this group to your pools instead of assigning Domain Users.

SQL Database

If you want to build multiple Identity Manager appliances and load balance them, configure them with an external database (e.g. Microsoft SQL).

For a script that performs all required SQL configuration, see Configure a Microsoft SQL Database at VMware Docs.

  1. In SQL Management Studio, create a New Query.
  2. Copy the SQL commands from VMware Docs and paste them into the New Query window.
    1. For Windows Authentication, copy the commands from Configure the Microsoft SQL Database with Windows Authentication Mode.
    2. For SQL Authentication, copy the commands from Configure Microsoft SQL Database Using Local SQL Server Authentication Mode.
    3. Change the values in the brackets.
    4. According to Rob Beekmans at Deploying VMware Workspace One 3.x – database setup, mandatory or changeable parameters?, in Identity Manager 3.0 and newer, you can change any of the parameters, except that the database schema (but not database name) must be saas.
  3. Then click Execute.

OVF Deployment

  1. Download the VMware Workspace ONE Access Service Virtual Appliance OVA file.
  2. In the vSphere Web Client, right-click a cluster, and click Deploy OVF Template.
  3. In the Select source page, browse to the identity-manager- file, and click Next.
  4. In the Select name and location page, enter a name for the VM, and click Next.
  5. In the Select a resource page, select a cluster, and click Next.
  6. In the Review details page, click Next.
  7. In the Accept License Agreements page, click Accept, and then click Next.
  8. In the Configuration page, select a size and click Next.
  9. In the Select storage page, select Thin Provision, select a datastore, and click Next.
  10. In the Select networks page, select the network for the appliance. You can deploy it either internally, or in the DMZ. If in the DMZ, you can later install Workspace ONE Access Connectors in the internal network in outbound only mode. Click Next.
  11. In the Customize template page:
    1. Make a choice regarding Customer Experience Improvement Program.
    2. Select a time zone.
    3. Expand Networking Properties if it’s not already expanded.
    4. The Networking Properties are displayed in a different order depending on which vSphere Web Client you’re using.
    5. Host Name – Enter a hostname for the first appliance.
      • If you intend to build multiple appliances and load balance them, then each appliance needs a unique name that does not match the load balanced name. If you only want to build one appliance, then the appliance Host Name should match whatever users will use to access Identity Manager.
    6. DNS and Gateway – In the Networking Properties section, enter the standard DNS and Gateway information.
    7. According to Install the Workspace ONE Access OVA File at VMware Docs, the Domain Name and Domain Search Path fields are not used.
    8. IP Address – Enter the IP address that is configured in DNS for the host name. DNS reverse lookup for this IP address must resolve to the appliance Host Name.
  12. Click Next.
  13. In the Ready to complete page, click Finish.

Setup Wizard

  1. Power on the appliance.
  2. Wait for the appliance to power on and fully boot.
  3. Go to https://myAccessFQDN to access the Access Setup Wizard.
    Note: you must connect to the DNS name. Connecting to the IP address will cause problems during the database setup process.
  4. In the Set Passwords page, enter passwords for the three accounts, and click Continue.

  5. In the Select Database page, change it to External Database.
    Note: this page will only function properly if your address bar has a DNS name instead of an IP address.
  6. For Windows authentication, enter a JDBC URL similar to the following, enter credentials for the Horizon Windows service account, and then click Continue. Access 21.08 and newer has an option to encrypt the database connection.
  7. For SQL authentication, enter a JDBC URL similar to the following, enter the credentials for the Horizon SQL account, and then click Continue. Access 21.08 and newer has an option to encrypt the database connection.

  8. The database will be configured.
  9. In the Setup Review page, click the link to log in to the Admin Console.

SSH – Enable Root Access

This is optional. Enabling root access lets you use root credentials when using WinSCP to connect to the appliance. Instructions can be found at VMware Blog Post Enabling SSH in Horizon Workspace Virtual Appliances.

  1. Putty to the VMware Workspace ONE Access appliance.
  2. Login as sshuser.
  3. Run su – and enter the root password.
  4. Run vi /etc/ssh/sshd_config.
  5. Scroll down to line containing PermitRootLogin.
  6. Press <i> on the keyboard to change to insert mode.
  7. Go to the end of the line and change no to yes.
  8. Press <ESC> to exit insert mode.
  9. Type :x to save the file and exit.
  10. Run systemctl restart sshd.

VMware Access Certificate

The Windows Connectors require the VMware Access certificate to be trusted. Generate a new appliance certificate using a trusted Certificate Authority and install the certificate on the appliance.

  1. Login to the Identity Manager web page as the admin user in the System Domain.
  2. Click Dashboard and then click System Diagnostics Dashboard.
  3. Click the VA Configuration button next to the appliance.
  4. On the left, click the page named Install SSL Certificates.
  5. On the right, click Choose File next to Import Certificate File.
  6. Identity Manager 19.03 and newer let you browse to a .pfx file instead of a PEM file.
  7. In the Password field, enter the .pfx password.
  8. Click Save.
  9. It will take several minutes for the certificate to be installed and the appliance to restart.

Load Balancing

VMware Access can be cloned, clustered, load balanced, and globally load balanced as shown below. Source = Multi-site Design in the Workspace ONE Access Architecture.

To clone multiple VMware Access appliances and load balance them, see one of the following:

Windows Connector

Identity Manager 19.03 and newer no longer include an embedded connector. Instead, build one or more Windows connectors.

Note: Connector 21.08 and newer does support Horizon. Connectors from VMware Access 20.10 and 20.01 do not support Horizon. Or stay with Connector version 19.03 or 19.03.01.

Note: 19.03.01 only works with VMware Access 20.10 service. Do not deploy 19.03.01 on older Identity Manager or older VMware Access. Reference = VMware Communities.

  1. Load balance your VMware Access appliances so the Connector can connect to the Load Balanced FQDN instead of a single VMware Access appliance.
  2. Build one or more Windows machines on the internal network that will host the Windows connector. The Windows machines must be joined to the domain.
  3. The VMware Access certificate must be trusted by the Connector servers.
  4. Login to the VMware Access administration console through the load balanced FQDN as the admin user in the System Domain.
  5. On the top tabs, switch to Identity & Access Management.
  6. On the sub-menu bar, on the far right, click Setup.
  7. On the sub-menu bar, on the left, click Connectors.
  8. Click the blue NEW button.
  9. In the Select the Connector page, select the Workspace ONE Access Connector 21.08 and click OK.
  10. Click Proceed Anyway.
  11. In the Download Installer page, click the button to Go to myvmware.com and download the connector installer if you haven’t already. Then click Next.
  12. In the Download Configuration File page, enter a password and click Download Configuration File and save it somewhere. Then click Next.
  13. In the Summary page, click Close.
  14. See Workspace ONE Access Connector 21.08 Systems Requirements at VMware Docs for sizing guidelines. For example, installing all components on a single server requires 12 GB of RAM.
  15. On the Windows machine, run Workspace-ONE-Access-Connector-Installer-
  16. Click Install to install .NET Framework 4.8.
  17. Click Yes to restart.
  18. Restart the install by running Workspace-ONE-Access-Connector-Installer-
  19. In the Welcome to the Installation Wizard for Workspace ONE Access Connector page, click Next.
  20. In the License Agreement page, click I accept the terms, and then click Next.
  21. In the Service Selection page, click Next.
  22. In the Specify configuration file page, browse to the es-config.json file downloaded earlier and then click Next.
  23. In the Select Default or Custom Installation page, choose Custom and then click Next.
  24. In the Specify Proxy Server Information page, click Next.
  25. In the Specify Syslog Server Information page, click Next.
  26. In the Install Trusted Root Certificates page, click Browse and upload your CA and Intermediate certificates that signed the VMware Access certificate. Java uses different root certificates than Windows so you’ll need to upload them here so Java can use them. Click Next.
  27. If you are installing the Kerberos Auth Service, then select a .pfx certificate that clients will trust and click Next.
  28. In the Specify Ports page, click Next.
  29. In the Specify Service Account page, enter service account credentials and then click Next.

    • The service account must be added to the local Administrators group.
  30. In the Ready to Install the Program page, click Install.
  31. In the Installation Wizard Completed page, click Finish
  32. Go back to VMware Access and see the new Connector. If you don’t see it, then check C:\Program Files\Workspace ONE Access\Virtual App Service\logs on the Connector server.


  1. Login to the VMware Access web page as the admin user in the System Domain.
  2. Switch to the Identity & Access Management tab.
  3. On the top right, switch to the Setup view.
  4. On the left, switch to the User Attributes sub-tab.
  5. Scroll down. Check the boxes next to distinguishedName and userPrincipalName. These are needed for Horizon.
  6. In the Add other attributes to use section, click the plus icon.
  7. Enter objectGUID.
  8. Click the green plus and add mS-DS-ConsistencyGuid. These are needed for Office 365 integration.
  9. Then click Save.
  10. On the top right, switch to the Manage view.
  11. On the Directories tab, click Add Directory > Active Directory.
  12. Enter a Directory Name.
  13. Change it to Active Directory over integrated Windows Authentication.
  14. Select a Directory Sync Connector. You can select more Sync Connectors later.
  15. Scroll down.
  16. Enter the LDAP Bind credentials. Click Save & Next.
  17. Select the domains you want to sync, and click Next.
  18. In the Map User Attributes page, scroll down, select any missing attribute, and click Next.
  19. In the Select the Groups page, click the plus icon to add a DN.
  20. Enter a Base DN in LDAP format, and click Find Groups.
  21. Search for your Access Users group, select it, and click Save.
  22. Click Next.
  23. In the Select the Users page, click Next.
  24. In the Sync Frequency field, make a selection and then click Sync Directory.
  25. You can click the link to view the Sync log.
  26. You can click the directory name, and then click Sync log to view the log.

  27. Sync Settings can be changed by clicking the button on the right.

Sync Connector Redundancy

  1. Build another Windows Connector.
  2. In the VMware Access console, in the Identity & Access Management page, on the left, click the Directories link.
  3. Click the link for your Active Directory domain.
  4. On the right, click the Sync Settings button.
  5. Switch to the Sync Service tab.
  6. Select the second connector and click the plus icon.
  7. You can order the connectors in failover order. Click Save.

Sync Group Membership

By default, VMware Access does not synchronize group members. You can force a sync.

  1. Go to Users & Groups > Groups.
  2. Notice that the groups are Not Synced. Click the link for a group.
  3. Switch to the Users tab. Then click the Sync Users button.

Logon Experience

  1. Go to Identity & Access Management > Setup > Preferences.
  2. On the bottom, Identity Manager 2.9.1 and newer lets you optionally hide the Domain Drop-Down menu. Then select the unique identifier that Identity Manager will use to find the user’s domain (typically UPN). Identity Manager 3.3 and newer can show a Domain Drop-Down if a unique domain cannot be identified.
  3. The user will be prompted to enter the unique identifier.


  1. Go to the Roles tab.
  2. You can add a Role. See VMware Blog Post Introducing Role-Based Access Control (RBAC) in VMware Identity Manager 3.2.
  3. Select an existing role (e.g. Super Admin), and click Assign.
  4. Search for the user that you want to assign the role to. If the user doesn’t show up, then make sure you are syncing the user, or sync the members of a group that the user is a member of.
  5. Then click Save.


  1. Switch to the tab named Appliance Settings.
  2. Switch to the sub-tab named License.
  3. Enter the license key, and click Save. A Horizon 7 Advanced or Horizon 7 Enterprise license key will work. Horizon 8 license doesn’t seem to work.


  1. On the top, click the Appliance Settings tab,
  2. Click the sub-tab named SMTP.
  3. Enter your mail server information, and click Save.

Kerberos Authentication

Kerberos lets users Single Sign-on to the VMware Access web page. Some notes on Kerberos authentication:

  • It only works for Windows clients.
  • The clients connect to the Connectors so firewall must permit the inbound connection to the Connectors on TCP 443. Outbound only does not work with Kerberos.
    • For High Availability, load balance your Connectors.
  • The Connector (or load balancer) must have a valid, trusted certificate.
  • The Connector’s FQDN (or load balancer FQDN) must be in Internet Explorer’s Local Intranet zone.

Connector Certificate

To upload a certificate to the Connector:

  1. On the Windows Connector machine, run the Connector installer.
  2. In the Program Maintenance page, leave it set to Add/Remove Services and click Next.
  3. Keep clicking Next until you get to the Install SSL Certificate for Kerberos Auth Service page. Browse to the .pfx, enter the password, and then finish the wizard.

TCP 443 Inbound

TCP 443 must be opened inbound to the Connectors. You might have to add TCP 443 to a Windows Firewall rule.

Enable Kerberos authentication

  1. Login to the VMware Access administration web page.
  2. On the top, go to the Identity & Access Management tab.
  3. Click the sub-tab named Enterprise Authentication Methods.
  4. Click the New button and then click Kerberos.
  5. In the Directory and Hosts page, select the local directory. Select the Connectors. Then click Next.
  6. In the Configuration page, if you plan to load balance the Connectors, then change Enable Redirect to Yes. Then finish the wizard.
  7. Go to Identity & Access Management > Identity Providers.
  8. On the top right, click Add Identity Provider and then click Create Workspace IDP.
  9. Give the IDP a name.
  10. In the Users field, select the directory.
  11. In the Authentication Method field, select Kerberos.
  12. In the IdP Hostname field, enter the FQDN that is load balanced to the Connectors. Click Add.

Configure Policy to use Kerberos

  1. After enabling the Kerberos adapter, in Identity Manager 3.2 and newer, go to Identity & Access Management > Manage > Policies and click Network Ranges.
  2. Add a Network Range for internal networks if you haven’t already.
  3. Go to Identity & Access Management > Manage > Policies.
  4. Click Edit Default Policy.
  5. Click Next to go to the Configuration page.
  6. Click Add Policy Rule. Or Click the plus icon to add a Policy Rule.
  7. Select a Network Range for the internal network.
  8. For and the user accessing content from, set it to Web Browser.
  9. Optionally configure and user belongs to group(s). When enabled, VMware Access asks the user for username only, and then looks up group membership to determine which authentication methods should be used. See Access Policy Settings at VMware Docs.
  10. Select Kerberos as the first authentication method.
  11. Select Password (cloud deployment) as the second authentication method. Click Save or OK.
  12. Drag the new Policy Rule to move it to the top. Then click Next and Save.
  13. If you break your config such that you can’t login anymore, then see Enabling Break-Glass URL Endpoint /SAAS/Login/0 in Workspace ONE Access at VMware Docs.

Customize Appearance

  1. If you go to Identity & Access Management > Setup > Custom Branding, on the Names & Logos tab you can change the browser’s title and favicon.

  2. If you then switch to the Sign-In Screen page, you can upload a logo, upload an image, and change colors.
  3. If you go to Identity & Access Management > Manage > Password Recovery Assistant, you can configure a link to a password recovery tool, or change the Forgot password message.
  4. If you scroll down you can optionally Show detailed message to End User when authentication fails.
  5. Click Catalog, and then click Settings.
  6. On the left, click User Portal Branding.
  7. Make changes to Logos, colors, etc.


Horizon Console – Enable SAML Authentication

  1. Login to Horizon Console.
  2. On the left, under Settings, click Servers.
  3. On the right, switch to the Connection Servers tab.
  4. Select a Connection Server, and click Edit.
  5. On the Authentication tab, change Delegation of authentication to VMware Horizon to Allowed.
  6. Click Manage SAML Authenticators.
  7. Click Add.
  8. In the Label field, enter a descriptive label.
  9. In the Metadata URL field, enter the VMware Access FQDN.
  10. In the Administration URL field, enter the VMware Access FQDN, and click OK.
  11. If you see a certificate error, click View Certificate, and then click Accept.
  12. Click OK to close the Manage SAML Authenticators window.
  13. There’s a Workspace ONE mode, which forces all Horizon Clients to connect through VMware Access instead of directly to the Connection Servers. Delegation of authentication must be set to Required before Workspace ONE mode can be enabled.

VMware Access – Virtual Apps Collection for Horizon

  1. In the VMware Access Admin Portal, click the Catalog tab, and then click Virtual Apps Collection.
  2. If you see Introducing Virtual Apps Collection page, click Get Started.
  3. Click the SELECT link in the Horizon box.
  4. Give the Horizon Connection a name.
  5. Arrange the Sync Connector appliances in priority order. Click Next.
  6. Click Add a Pod.
  7. Enter the FQDN of a Connection Server in the Pod.
  8. Enter Horizon View admin credentials in UPN format. The account needs at least Read Only Administrator access to Horizon.
  9. There’s a True SSO option if you enabled a non-password authentication to VMware Access.
  10. Click Add.
  11. You can optionally add more pods and then enable the Cloud Pod Architecture option. Click Next when done.
  12. Change the Sync Frequency and Safeguards as desired.
  13. Click Next when done.
  14. Click Save & Configure Network Range. The connection is tested at this time.
  15. The URLs for accessing Horizon are defined in each Network Range. For each URL, create Network Ranges. Or click All Ranges.
  16. Near the bottom, in the Client Access FQDN field, enter the FQDN that users in this Network Range use to login to Horizon. Then click Save. Note: the Horizon FQDN is different than the VMware Access FQDN.
  17. After the Horizon Virtual Apps Collection is added, select it, and click Sync without safeguards.

    • Note: whenever you make a change to the pools in Horizon Administrator, you must either wait for the next automatic Sync time, or you can return to this screen and click Sync.
  18. You can click the alert icon to see issues.
  19. If you go to Catalog > Virtual Apps, you will see your synced Application and Desktop pools.

Horizon Pools Catalog

  1. In the VMware Access Admin console, at Catalog > Virtual Apps, you can see the Horizon View icons. Only the pools in the root Access Group are synced.
  2. Click an icon and then click View Assignments.
  3. Make sure entitlements are listed. Entitlements are defined in Horizon Console, and not in VMware Access. VMware Access merely syncs the entitlements from Horizon.
  4. Only AD groups synced to VMware Access will be displayed.
  5. If you make changes in Horizon Console, then manually sync the Virtual Apps Collection so the changes are reflected in VMware Access.
  6. Back in the Virtual Apps list, if you check the box next to one of the icons, you can place the icon in a Category by clicking the Categories menu.
    • You can select or or more existing categories.
    • Or type in a new category name at the top of the list.
  7. The category is then displayed next to the catalog item.
  8. There’s also a Recommended category.

    • Recommended icons can be found in the User Portal at Apps > Recommended. Users can click the Categories drop-down to see other categories. Users have to logoff and log back in to see Category changes.
  9. Go to Catalog > Settings.
  10. On the left, click User Portal Configuration.
  11. From this screen, you can control tab visibility, and put recommended apps in the Bookmarks tab. Click Save when done.

Separate Horizon View Connection Server groups (e.g. multi-datacenter) can be configured in failover order. See Configure Failover Order of Horizon View and Citrix-based Resources at VMware Docs.

VMware Access – Horizon URLs

The URL used to launch a Horizon icon from VMware Access can be different for each Network Range. For internal users, the URL should point to the load balanced VIP for the Connection Servers. For external users, the URL should point to load balanced Unified Access Gateways.

  1. Go to Catalog > Virtual Apps Collection.
  2. Click the link for a Virtual Apps Collection.
  3. Click the Network Ranges tab.
  4. Click an existing Network Range, or create a new one.
  5. Near the bottom, in the Client Access FQDN field, enter the FQDN that users on this Network Range should use to access Horizon. Then click Save. Note that the FQDN for Horizon is different than the FQDN for Identity Manager.

VMware Access User Portal

The User Portal is the interface that non-administrators see after logging in. Administrators can switch to the User Portal by clicking the username on the top right and clicking User Portal.

Administrators in the User Portal can switch to the Administration Console by clicking the username on the top right.

Some User Portal features:

  1. When a user logs in to the VMware Access web page the pool icons will be displayed.
  2. When the user clicks an icon, you can use either Horizon client or Browser for opening a pool. To set the default launch method:
    1. On the top right, click your name, and click Account.
    2. In the Horizon Remote Apps section, click either Horizon Client or click Browser.
    3. The Horizon Client option has a link to download and Install the Horizon Client.
  3. Back in the Apps list, when the user clicks the three dots next to an icon, there’s a link to Launch from Horizon Client.

  4. To mark an icon as a Favorite, click the three dots next to an icon and then click Add to Favorites.
  5. Or click an app icon to open the app’s Details page, and then click the star icon.
  6. Then you can click Favorites tab to display only icons that are marked as Favorites.
  7. If you configured Categories, they are listed in the in the Apps tab in the Categories drop-down.

163 thoughts on “VMware Workspace ONE Access 21.08”

  1. I’m trying to setup the kerberos authentication and it works well except that when I try to start any Horizon virtual app Workspace One prompts the user for the password.
    There is something I’m missing or even using Kerberos I need to setup TrueSSO?

  2. I am using WS1 access SAAS hosted + WS1 UEM SAAS hosted + vmware horizon VDI Infra on Prem
    Horizon enabled with Workspace ONE MODE — Required

    When users are lauching VDI or any Virtual apps from client or from WS1 access portal everything works as expcted.
    When user try to launch any virtual apps from Intelligent HUB using browser works well

    When user try to launch any virtual apps from Intelligent HUB using client its fails:
    Error :
    Authentication failed horizon expect user crdential from other application or server

    Need to understand what exactly could cause this as this issue only happesn when user using Win10 10 Intelligent HUB

    1. Hi chetan,

      How you set up “Delegation of authentication to VMware Horizon (SAML 2.0 Authenticator)” on your Horizon servers?

      This settings is available under Servers -> Connection Servers -> Select the Connection Server -> Edit -> Select the Authentication tab. If you set up “Required” you can try to change to “Allowed”.

      1. really thanks for the reply on this.

        Its “Required” and we will not be bale to make it “Allowed” as per company policy so that one not a solution for us sadly

  3. I have configured workspace one access using method mentioned in article but getting error while launching session:
    this horizon server expects to get your logon credentials from application or server not directly through client login screen

  4. Hi, I have a issue on Identity & Access Management portal on menu Roles: “An unexpected Error has ocurred. Please Try again later” so didn’t show menu. I have these versions identity-manager- and Workspace-ONE-Access-Connector-Installer- any ideas or tips?
    Thans a lot, your guide is excellent.

  5. Hi Carl. There is any reason to prefer WS1 (with external DB) instead of vIDM (internal replicated db with vRSLCM)?

  6. Hi Carl – I have build new version of vIDM (20.10.1) Connector (19.03) to replace existing vIDM ( and connector (2017.8.1.0) and when I try to launch any horizon rdsh application from portal i am getting an error “couldn’t connect to server”. It’s very strange because I’m using same hostnames and IP’s from existing environment. If I power off new setup and power on the existing then everything is working fine.

    Any ideas? I’ve checked every configuration side by side and everything is exactly same as existing setup except version. My horizon version is 2103

    1. The new connectors don’t support Horizon. If you don’t need Horizon integration then you can do the new connectors. Otherwise you’ll need the older connectors.

  7. Hello Carl
    I’m doing Integration between VMware Horizon 20.12 & VMware Workspace ONE 20.10
    End user are able to authenticate and open App catalog. Below are the two scenarios for internal and external users:
    I. When internal users trying to login, vIDM redirect successfully to horizon (vdi.domain.local)
    II. When external users trying to login, vIDM unable to redirect (vdi.domain.com) and gives “Invalid security header”

    does WS1 Access must be able to resolve the internal and external URL or this is not mandatory


  8. Hey Carl,

    Any ideas what could cause the IDM appliance to throw an error during initialisation or failed to initialise when connecting to an external database? We are accessing the appliance using its FQDN. The tables are populating in the database too but the initialisation never completes.

  9. When adding a new ssl certificate (generated by my CA, which i added to trusted roots), I’m getting the error “Certificate does not chain up to root”

    Happens whether i use a pfx or pem. Have used same process to generate SSL certs for Horizon, vSphere, etc.

      1. Hi,

        Before import, you need to create a PFX or PEM file with full chain included (root and intermediate), not only web server certificate. Certificates imported to trusted root (Trusted CAs) is used to access to the other systems (UAG, Horizon, …).

  10. Do you know how to point the Windows Connector to the Load Balanced VIP for vIDM when running through the activation for the Windows Connector? It seems to always point to the vIDM that the Connector was created on.

  11. i have a on prem environment with 3 node cluster , after changing the url to LB , Apps are not able to launch, getting error like invalid security header in the request url /catlog-portal/services/app/laucnhurls________________
    Please assist.

  12. Hey Carl
    I have an error add AD via legacy connector, “Connector communication failed with response: {0} for the connector {1}.”.
    There is no solution for it in KB. Do you have any idea?

  13. Hi Carl,
    i’ve a question for the nodes deployment.
    It’s possible deploy 6 appliance in the same cluster?

    For more details: i’ve 2 cluster on the same network with minimum latency and i need to take all 6 nodes active.
    Do you foresee any issue?

  14. Got a question that I’m hoping you might be able to answer:-)

    I’ve got a IDM Cluster in the DMZ and an IDM Connector in the LAN, for IDM it’s behind a load balancer in the DMZ along with UAG that is handling Horizon.

    I would like a single access point into all services using IDM (mainly so I only have a single UI to brand) in the past IDM would be in the LAN and we’d use UAG to reverse proxy it and when both Horizon and IDM are configured on the same UAG then going to either IDM or Horizon URL takes you to IDM.

    I want to do the same thing where Horizon is sort of masked behind IDM on UAG.

    I found this passage in the vidm-install.pdf

    VMware Unified Access Gateway 2.8 and later supports reverse proxy functionality to allow users to securely access the VMware Identity Manager unified catalog remotely. Unified Access Gateway can be deployed in the DMZ behind the load balancers frontending the VMware Identity Manager appliance.

    Now this makes it sound like it’s a supported topology where IDM and UAG are in the DMZ and both using the same load balancer and that I can configure UAG to reverse proxy IDM and achieve the setup I desire but looking to make sure this is a supported configuration as right now IDM and UAG have their own public IPs and UAG is only managing access to Horizon.


    1. You can place the connection servers into Workspace one mode, this will stop users going directly to the View Connection Server URL and redirect them to the vIDM instance for them to authenticate there, then be SSO’d to a Desktop in Horizon.

      You know the bit in the Horizon Console (under each connection server) where you configure the SAML Authenticator? when on the drop down next to that section click “required” and you will be asked to put in a URL. put the vIDM VIP URL.

      1. I’ve given that a try and didn’t like it, I have a folder structure on the Desktop and Start Menu for Horizon and when in Workspace ONE mode it looks to break that and all you get is the webpage to select the needed app. I only want to force Horizon HTML Access through IDM, that way they see other web based apps and Horizon apps all a single console.

        I might be asking for to much currently.

        1. Yes, placing vIDM into the picture takes out shortcuts. That piece is documented along with the other features that’s are rendered useless or not supported while using vIDM. Pain in the ass, I know!

          There’s no way that I know of to redirect only HTML traffic to vIDM and Blast/pcoip go direct to the connection brokers. I don’t even think doing funky non standards port config will work.

Leave a Reply to Daniel Cancel reply