Configure HTTP Protection Measures

Note: Horizon Web Client is available with Horizon 8 versions 2412 and later. For Horizon 8 versions 2406 and earlier, Horizon Web Client is called "HTML Access." This documentation page uses the name "Horizon Web Client" to refer to both Horizon Web Client and HTML Access.

To configure HTTP protection measures you must create or edit the locked.properties file in the gateway configuration folder on the Connection Server instance.

For example: install_directory\Omnissa\Horizon\Server\sslgateway\conf\locked.properties

• Use the following syntax to configure a property in locked.properties:

  myProperty = newValue
  

• The property name is always case-sensitive and the value might be case-sensitive. Whitespace around the = sign is optional.

• For CORS and CSP properties, it is possible to set service-specific values and a primary value. For example, the admin service is responsible for handling Horizon console requests, and a property can be set for this service without affecting other services by appending -admin after the property name.

  myProperty-admin = newValueForAdmin
  

• If both a primary value and a service-specific value are specified, then the service-specific value applies to the named service, and the primary value applies to all other services. The sole exception is the special value "OFF". If the primary value for a property is set to "OFF", then all service-specific values for this property are ignored.

  For example:

  myProperty = OFF
  myProperty-admin = newValueForAdmin	; ignored
  

• Some properties can accept a list of values.

  To set a single value, enter the following property:

  myProperty = newValue
  myProperty-admin = newValueForAdmin
  

  To set multiple values for a property that accepts list values, you can specify each value on a separate line:

  myProperty.1 = newValue1
  myProperty.2 = newValue2
  myProperty-admin.1 = newValueForAdmin1
  myProperty-admin.2 = newValueForAdmin2
  

• To determine the correct service name to use when making a service-specific configuration, look in the debug logs for lines containing the following sequence:

  (ajp:admin:Request21) Request from abc.def.com/10.20.30.40: GET /admin/
  

  In this example, the service name is admin. You can use the following typical service names:

  • admin for Horizon console
  • broker for Connection Server
  • dct for Local file serving (DCT)
  • docroot for Local file serving
  • health for Load Balancer health checking
  • misc for Other (Horizon 2312 and earlier)
  • portal for Horizon Web Client
  • rest for REST API
  • root for Horizon Web Client (root redirection) (Horizon 2406 and later)
  • saml for SAML communication
  • tunnel for Secure Tunnel
  • view-vlsi for View API
  • view-vlsi-rest for View API (REST wrapper)
  • ws1for Horizon Web Client (Workspace One redirection) (Horizon 2406 and later)

Connection Server comprises three web server instances, as described in Replace the Default HTTP Ports or NICs for Horizon Connection Server Instances

Beginning with 2412, it is possible to restrict the scope of a property entry to a single web server instance. For example, to apply an entry to the non-SSL instance only, use Insecure.property=value. In the locked.properties file, the SSL web server instance has the scope-label Secure, the non-SSL instance has the scope-label Insecure, and the management instance (if enabled) has the scope-label Admin.

Without a scope-label, a property entry will apply to all web server instances. If the same property name appears in locked.properties both with and without a scope-label, then the scoped entry applies only to the relevant web server instance, while the non-scoped entry applies to the other instances.

Examples

Certificate auth configuration for all web servers:

    trustKeyfile = truststore.key
    trustStoretype = jks
    useCertAuth = true

Start a separate management web server:

    serverPortAdmin = 9443

Use a different trust store for the management web server:

    Admin.trustKeyfile = admintruststore.key