Logging into Connection Server using the REST API, View API, or Horizon Console

Note: This section applies to Horizon 8 versions 2312 and later.

When Horizon administrators log into Connection Server using either the REST API, the View API or through Horizon Console, authentication and authorization steps depend on the presented credential.

If a user identity certificate is presented as a credential, Windows matches the certificate to a user account. See Configure Certificate Mappings for Certificate-Based Authentication for details. Matching will fail if the identity is unknown. Authentication will fail if the certificate is invalid or revoked, or if the handshake signature cannot be verified using the certificate. Horizon then checks with Windows that the matched account is enabled and there are no login constraints such as the wrong time of day (if the login hours feature is configured for the account in Active Directory).

If the administrator provides username-password as a credential, a temporary Type 8 login to Windows is performed. This type of login prevents a Windows user profile being created for the administrator, which would cost both time and storage for no purpose. The login process checks that the account name is known to Windows and enabled, that the password is current and not locked out, and that there are no login constraints. If successful, the administrator is logged out of Windows once more.

Following Windows authentication and authorization, further authorization is performed to ensure that the account has appropriate Horizon privileges and is allowed to log into Connection Server by the chosen means and with the correct request flags. See the Bypass smartcard for API privilege in GlobalPrivileges. If all checks are successful, up to three tokens are generated:

Note: Which of these tokens will be generated depends on the administrator's Horizon privileges and also how they logged in. We recommend that administrators present a user identity certificate, either auto-enrolled to their Windows account or installed to a smart card, in preference to username-password. When invoking lifecycle management functions such as Connection Server installation, however, it is necessary to log in with a Windows domain account using username-password.

All generated tokens will be invalidated when the administrator logs out or when the session times out. Session timeout for the REST API and View API is configured for the connection server cluster as a whole under Security Settings. See Security-Related Global Settings for Horizon Console. Horizon Console session timeout is set per user under My Preferences. See Global Settings for Client and Console Sessions.