Note: This version of the topic applies to Horizon 8 Security versions 2111.2 and 2306 and later. Security-related global settings for client sessions and connections are accessible under Settings > Global Settings > Security Settings or under Settings > Global Settings > General Settings in the Horizon Console.
Security-Related Global Settings
| Setting | Description |
|---|---|
| Change data recovery password |
The password is required when you restore the Horizon LDAP configuration from an encrypted backup.
In Horizon 8 environments:
|
| Message security mode |
Determines the security mechanism used when JMS messages are passed between Horizon 8 components.
|
| Enhanced Security Status (Read-only) |
Read-only field that appears when Message security mode is changed from Enabled to Enhanced. Because the change is made in phases, this field shows the progress through the phases:
|
| Reauthenticate secure tunnel connections after network interruption | Determines if user credentials must be reauthenticated after a network interruption when Horizon Clients use secure tunnel connections to Horizon 8 desktops and applications. This setting offers increased security. For example, if a laptop is stolen and moved to a different network, the user cannot automatically gain access to the Horizon 8 desktops and applications because the network connection was temporarily interrupted. This setting is deactivated by default. |
| Forcibly disconnect users | Disconnects all desktops and applications after the specified number of minutes has passed since the user logged in to Horizon 8. All desktops and applications will be disconnected at the same time regardless of when the user opened them. The default is 600 minutes. |
| For clients that support applications. If the user stops using the keyboard and mouse, disconnect their applications and discard SSO credentials | Protects application sessions when there is no keyboard or mouse activity on the client device. If set to After ... minutes, Horizon 8 disconnects all applications and discards SSO credentials after the specified number of minutes without user activity. Desktop sessions are disconnected. Users must log in again to reconnect to the applications that were disconnected or launch a new desktop or application. If set to Never, Horizon 8 never disconnects applications or discards SSO credentials due to user inactivity. The default is Never. |
| Discard SSO credentials |
Use this setting to configure the discarding of SSO credentials at a fixed time after login. After SSO credentials are discarded, a user will be prompted to authenticate to the Windows Guest Operating System when connecting to a new desktop or to a new application session on a different RDS Farm. Connections to existing Desktop and Application sessions will remain open.
If set to After ... minutes, SSO credentials will be discarded after the specified number of minutes has passed since the user logged in to Horizon, regardless of any user activity on the client device. The default is After 15 minutes.
If set to Never, Horizon stores SSO credentials until the user closes Horizon Client, or the Forcibly disconnect users timeout is reached, whichever comes first.
Select one or both of these checkboxes:
|
| View Administrator session timeout | Determines how long an idle console session continues before the session times out. Important: Setting the console session timeout to a high number of minutes increases the risk of unauthorized use of the console. Use caution when you allow an idle session to persist a long time. By default, the console session timeout is 30 minutes. You can set a session timeout from 1 to 4320 minutes. |
| Certificate Authentication | Use this setting to change certificate authentication mapping to a user's Custom Alternate Security Identities attribute in active directory by specifying a Certificate Authentication Mapping Control option. Mapping types that are based on usernames and email addresses are considered weak and must be updated with one of the strong mapping types. See Configure Certificate Mappings for Certificate-Based Authentication for details. |
| CRL Pre-Fetch Settings | Use this setting to conduct a Certificate Revocation check on a certificate when CRL Distribution Point (CDP) URLs for the certificate are not directly accessible to the Connection Server. |
Note: TLS is required for all Horizon Client connections and console connections to Horizon 8. If your Horizon 8 deployment uses load balancers or other client-facing, intermediate servers, you can off-load TLS to them and then configure non-TLS connections on individual connection broker instances. See Off-loading TLS Connections to Intermediate Servers.
Was this page helpful?