Note: This version of the topic applies to Horizon 8 Security versions 2111.2 and 2306 and later.
This topic describes security-related settings in LDAP that cannot be modified using APIs, the administration console, or provided command-line tools. Security-related settings are provided in Horizon LDAP under the object path cn=common,ou=global,ou=properties,dc=vdi,dc=horizon,dc=internal. If you have full administrative privileges, you can use an LDAP editor such as the ADSI Edit utility to change the value of these settings on a connection broker instance. The change propagates automatically to all other connection broker instances in a cluster.
| Attribute | Description |
|---|---|
pae-AgentLogCollectionDisabled | This setting can be used to prevent downloading of DCT archives from Horizon Agents, using either APIs or the administration console. Log collection is still possible from Connection Servers in Horizon 8 environments. Set to 1 to deactivate agent log collection. |
pae-DisallowEnhancedSecurityMode |
Note:In versions prior to 2512, this setting is possible only in FIPS mode.
This setting can be used to prevent the use of Enhanced Message Security. Once this is set to 1, the Horizon 8 environment will begin the transition to Enabled message security mode automatically. Setting this attribute back to 0 or removing it allows Enhanced Message Security to be chosen once more, but does not trigger an automatic reinstatement. Note:This setting is a prerequisite for deactivating automatic certificate management. See pae-NoManagedCertificate.
|
pae-enableDbSSL | If you configure an Event Database, the connection is not protected by TLS by default. Set this attribute to 1 to activate TLS on the connection. |
pae-managedCertificateAdvanceRollOver | For auto-managed certificates, this attribute can be set to force certificates to be renewed before they expire. Specify the number of days in advance of the expiry date that this should be done. The maximum period is 90 days. If not specified, this setting defaults to 0 days, and so roll-over happens at expiry. |
pae-MsgSecOptions |
This is a multi-valued attribute where each value is itself a name-value pair (for example, course=fish).
Warning: When adding or modifying a name-value pair, be very careful not to remove other values. Currently the only name-value pair that can be set is keysize. This specifies the length of the DSA message signing key. If not specified, it defaults to 512 bits.
|
pae-NoManagedCertificate |
This setting can be used to deactivate automatic certificate management. When set to 0 or not set, certificates need not be CA signed.* When set to 1, all certificates must be CA signed and admin-managed; certificates are no longer renewed automatically and self-signed certificates in the certificate stores are ignored.
* In FIPS mode, the Machine Identity (“vdm”) certificate must be CA signed regardless of this setting. This setting is not compatible with Enhanced message security. Before setting to 1, you must switch message security to Enabled. In a CPA configuration, inter-pod communication will use the Cluster Identity certificate (“vdm.ec”). All Connection Servers in the federation should trust the issuer of the Cluster Identity certificate for all other pods. |
pae-SSLCertificateSignatureAlgorithm |
This specifies the certificate signature algorithm to use for auto-managed certificates. If not specified, it defaults to rsa_pkcs1_sha384.
For more examples see Default Global Policies for Security Protocols and Cipher Suites. |
pae-CertAuthMappingControl |
Specifies whether there is smart card support. A value of 0 or absent means no smart card support. Other possible values are:
|
pae-CertAuthMapping |
The default value is <not set>, and will take a String for Certificate mapping of altSecurityIdentities, for example: "x509:<I>%issuer_dn%<S>%subject_dn%<SKI>%subject_key_id%", X509:<I>%issuer_dn%<SR>%serial%
Certificate-based authentication is done based on all the strings provided. Mapping should be provided based on supported certificate properties eg: Issuer, public_key, subject_alternative_name, provided in CertAuthMappingNames. |
pae-HelpdeskAppPrivacy
(Horizon 2506 and later) | Hides the application name in the Help Desk UI so that it is not viewable to the Help Desk administrator. Possible values are:
|
pae-ClientDomainsOrdering
(Horizon 2506 and later) | Defines complete or partial ordering of the domain list sent to clients when Send domain list is enabled, to minimize scrolling and ensure a consistent user experience. When this setting is not defined, domains are lexically ordered. |
Was this page helpful?