VMware Horizon View Client for Android User Guide

Using VMware Horizon View Client for

Android

January 2014 Horizon View

This document supports the version of each product listed and supports all subsequent versions until the document is replaced by a new edition. To check for more recent editions of this document, see http://www.vmware.com/support/pubs.

EN-001160-00

Using VMware Horizon View Client for Android

You can find the most up-to-date technical documentation on the VMware Web site at:

http://www.vmware.com/support/

The VMware Web site also provides the latest product updates.

If you have comments about this documentation, submit your feedback to:

docfeedback@vmware.com

VMware, Inc.

3401 Hillview Ave. Palo Alto, CA 94304 www.vmware.com

2 VMware, Inc.

Using VMware Horizon View Client for Android 5

Setup and Installation 7

System Requirements 7

Preparing View Connection Server for Horizon View Client 8

Smart Card Authentication Requirements 9

Configure Smart Card Authentication for Mobile Clients 10

Using Embedded RSA SecurID Software Tokens 11

Configure Advanced SSL Options 12

Supported Desktop Operating Systems 12

Configure the View Client Download Links Displayed in View Portal 13

Install or Upgrade Horizon View Client for Android 14

Horizon View Client Data Collected by VMware 15

Using URIs to Configure Horizon View Client 17

Syntax for Creating vmware-view URIs 17

Examples of vmware-view URIs 19

Managing Server Connections and Desktops 21

Certificate Checking Modes for Horizon View Client 23

Create a Desktop Shortcut for the Android Home Screen 24

Manage the View Connection Servers List 24

Disconnecting from a Desktop 25

Log Off from a Desktop 25

Roll Back a Desktop 26

Manage Desktop Shortcuts 27

VMware, Inc.

Using a Microsoft Windows Desktop on a Mobile Device 29

Feature Support Matrix 29

Input Devices, Keyboards, and Keyboard Settings 30

Enable the Japanese 106/109 Keyboard Layout 31

Starting, Minimizing, and Closing Applications with Unity Touch 31

Horizon View Client Tools 33

Gestures 36

Multitasking 37

Screen Resolutions and Using External Displays 37

PCoIP Client-Side Image Cache 38

Internationalization and International Keyboards 38

Using VMware Horizon View Client for Android

Troubleshooting Horizon View Client 39

Collecting and Sending Logging Information 39

Enable View Client Log Collection 39

Manually Retrieve and Send Horizon View Client Log Files 40

Disable View Client Log Collection 40

Reset a Desktop 41

Uninstall the VMware View App 42

Horizon View Client Stops Responding or the Remote Desktop Freezes 42

Problem Establishing a Connection When Using a Proxy 43

Index 45

4 VMware, Inc.

Using VMware Horizon View Client for Android

This guide, Using VMware Horizon View Client for Android, provides information about installing and using VMware® Horizon View™ software on an Android device to connect to a remote desktop in the datacenter.

The information in this document includes system requirements and instructions for installing Horizon View Client for Android. This document also provides tips for improving the user experience of navigating and using Windows desktop elements on an Android device.

This information is intended for administrators who must set up a Horizon View deployment that includes Android client devices. The information is written for experienced system administrators who are familiar with virtual machine technology and datacenter operations.

VMware, Inc. 5

Using VMware Horizon View Client for Android

6 VMware, Inc.

Setup and Installation 1

Setting up an Horizon View deployment for Android clients involves using certain View Connection Server configuration settings, meeting the system requirements for Horizon View servers and Android device clients, and installing the VMware View app.

This chapter includes the following topics:

“System Requirements,” on page 7

“Preparing View Connection Server for Horizon View Client,” on page 8

“Smart Card Authentication Requirements,” on page 9

“Configure Smart Card Authentication for Mobile Clients,” on page 10

“Using Embedded RSA SecurID Software Tokens,” on page 11

“Configure Advanced SSL Options,” on page 12

“Supported Desktop Operating Systems,” on page 12

“Configure the View Client Download Links Displayed in View Portal,” on page 13

“Install or Upgrade Horizon View Client for Android,” on page 14

“Horizon View Client Data Collected by VMware,” on page 15

System Requirements

You can install Horizon View Client on many Android devices.

The Android device on which you install Horizon View Client, and the peripherals it uses, must meet certain system requirements.

Operating systems

VMware, Inc. 7

Horizon View Client 2.3: Android 3 (Honeycomb), Android 4 (Ice Cream

Sandwich), and Android 4.1, 4.2, 4.3 (Jelly Bean), and 4.4 (KitKat).

Horizon View Client 2.0, 2.1, and 2.2: Android 3 (Honeycomb), Android

4 (Ice Cream Sandwich), and Android 4.1, 4.2, and 4.3 (Jelly Bean).

View Client 1.7: Android 3 (Honeycomb), Android 4 (Ice Cream

Sandwich), and Android 4.1, 4.2, and 4.3 (Jelly Bean).

View Client 1.6: Android 3 (Honeycomb), Android 4 (Ice Cream

Sandwich), and Android 4.1 (Jelly Bean).

View Client 1.5: Android 3 (Honeycomb) and Android 4 (Ice Cream

Sandwich). On Cisco Cius devices, Android 2.2 is supported.

Using VMware Horizon View Client for Android

View Client 1.2, 1.3, and 1.4: Android 3 (Honeycomb). On Cisco Cius

devices, Android 2.2 is supported.

CPU architecture

External keyboards

Smart cards

View Connection Server, Security Server, and View Agent

Display protocol for Horizon View

Horizon View Client 2.1 and later: ARM and x86

Horizon View Client 2.0 and earlier: ARM

(Optional) Bluetooth and docked keyboard devices. For information about the devices that your specific device supports, see the documentation from the device manufacturer.

See “Smart Card Authentication Requirements,” on page 9.

Latest maintenance release of VMware View 4.6.x and later VMware View and VMware Horizon View releases

VMware recommends that you use a security server so that your device will not require a VPN connection.

IMPORTANT The Unity Touch feature requires Horizon View 5.2 and later servers and desktops. The Remote Experience Agent must also be installed on the desktop. For more information, see the VMware Horizon View Feature Pack Installation and Administration document and see “Starting, Minimizing, and Closing Applications with Unity Touch,” on page 31.

PCoIP

Preparing View Connection Server for Horizon View Client

Administrators must perform specific tasks to enable end users to connect to remote desktops.

Before end users can connect to View Connection Server or a security server and access a remote desktop, you must configure certain pool settings and security settings:

If you are using a security server, as VMware recommends, verify that you are using the latest

maintenance releases of View Connection Server 4.6.x and View Security Server 4.6.x or later releases. See the VMware Horizon View Installation documentation.

If you plan to use a secure tunnel connection for client devices and if the secure connection is

configured with a DNS host name for View Connection Server or a security server, verify that the client device can resolve this DNS name.

To enable or disable the secure tunnel, in View Administrator, go to the Edit View Connection Server Settings dialog box and use the check box called Use secure tunnel connection to desktop.

Verify that a desktop pool has been created and that the user account that you plan to use is entitled to

access the remote desktop. See the topics about creating desktop pools in the VMware Horizon View Administration documentation.

To use two-factor authentication with Horizon View Client, such as RSA SecurID or RADIUS

authentication, you must enable this feature on View Connection Server. RADIUS authentication is available with View 5.1 or later View Connection Server. For more information, see the topics about two-factor authentication in the VMware Horizon View Administration documentation.

To allow end users to save their passwords with Horizon View Client, so that users do not always need

to supply credentials when logging in to a remote desktop, configure the policy for this feature on View Connection Server.

8 VMware, Inc.

This feature is available for View Client 1.5 and later connecting to remote desktops through View Connection Server 5.1 or later . Users can save their passwords if the policy is configured to allow it and if Horizon View Client can fully verify the server certificate that View Connection Server presents. For instructions about configuring this policy, see the topic called "Allow Users to Save Credentials" in the chapter called "Setting Up User Authentication," in the VMware Horizon View Administration documentation.

Verify that the desktop pool is set to use the PCoIP display protocol. See the VMware Horizon View

Administration documentation.

Smart Card Authentication Requirements

Client systems that use a smart card for user authentication must meet certain requirements.

NOTE Horizon View Client for Android 2.1 and later supports using smart cards with desktops that have Windows XP, Windows Vista, or Windows 7 guest operating systems. VMware recommends using an Android 4.0 or later operating system. The CPU architecture must be ARM. The following cards and reader were tested: baiMobile Bluetooth Smart Card Reader and the following smart cards: CAC (Common Access Card) Smart Card, ActivIdentity 64K V2C Java Card, Gemalto ID Prime .NET (formerly .NET V2+ Orange) .

Each client system that uses a smart card for user authentication must have the following software and hardware:

Chapter 1 Setup and Installation

Horizon View Client

A Windows-compatible smart card reader

Smart card middleware

For example, the app on the Android device must support the baiMobile 3000MP reader. One such app is Android PC/SC-Lite Service, whose tile name on Android devices is baiMobile PC/SC. Otherwise, although you will be able to pair the Bluetooth card reader with the Android device, you will not be able to connect them. To make a connection, the app sends a connection request to the reader, and you must tap the OK button on the reader to establish the Bluetooth connection.

Product-specific application drivers

You must also install product-specific application drivers on the remote desktops. For example, the following drivers were tested: ActiveClient6.2.0.50, ActivClient_7.0.1, and Gemalto.MiniDriver.NET.inf.

Horizon View supports smart cards and smart card readers that use a PKCS#11 or Microsoft CryptoAPI provider. You can optionally install the ActivIdentity ActivClient software suite, which provides tools for interacting with smart cards.

Users that authenticate with smart cards must have a smart card, and each smart card must contain a user certificate.

To install certificates on a smart card, you must set up a computer to act as an enrollment station. This computer must have the authority to issue smart card certificates for users, and it must be a member of the domain you are issuing certificates for.

IMPORTANT When you enroll a smart card, you can choose the key size of the resulting certificate. To use smart cards with local desktops, you must select a 1024-bit or 2048-bit key size during smart card enrollment. Certificates with 512-bit keys are not supported.

The Microsoft TechNet Web site includes detailed information on planning and implementing smart card authentication for Windows systems.

VMware, Inc. 9

Using VMware Horizon View Client for Android

In addition to meeting these requirements for Horizon View Client systems, other Horizon View components must meet certain configuration requirements to support smart cards:

For information about configuring View servers to support smart card use, see the topic "Configure

Smart Card Authentication," in the VMware Horizon View Administration document.

IMPORTANT Smart cards are supported only with Horizon View 5.1.3 and 5.2 or later servers and desktops.

For information on tasks you might need to perform in Active Directory to implement smart card

authentication, see the topics about preparing Active Directory for smart card authentication, in the VMware Horizon View Installation document .

Configure Smart Card Authentication for Mobile Clients

Configuration tasks include connecting and pairing the Bluetooth card reader with the mobile device and setting the smart card removal policy.

Prerequisites

Verify that you are using the correct version of the client, desktop agent, server, mobile device

operating system, smart card reader, and smart card. See “Smart Card Authentication Requirements,” on page 9. The smart card middleware on the Android device must support the baiMobile 3000MP reader. One such app is Android PC/SC-Lite Service, whose tile name on Android devices is baiMobile PC/SC.

If you have not already done so, perform the tasks described in "Prepare Active Directory for Smart

Card Authentication," in the VMware Horizon View Installation document.

Configure View servers to support smart card use. See the topic "Configure Smart Card

Authentication," in the VMware Horizon View Administration document.

Procedure

1 Install the smart card middleware app on the mobile device.

The app must support the baiMobile 3000MP reader.

2 Pair the mobile device with the card reader, according to the documentation provided by the

manufacturer of smart card reader.

During this process, a randomly generated number is displayed on both devices. When you confirm that the numbers match, you establish secure Bluetooth communication.

3 Configure the smart card removal policy.

Option Description

Set the policy on the server

Set the policy on the desktop

If you use View Administrator to set a policy, the choices are to either disconnect users from View Connection Server when they remove their smart cards or to keep users connected to View Connection Server when they remove their smart cards and let them start new desktop sessions without reauthenticating.

In View Administrator, go to View Configuration > Servers > View

Connection Server (Edit) > Authentication > Smart card authentication > Smart card removal policy.

If you use the Group Policy Editor (gpedit.msc) you have four possible settings: no action, lock workstation, force log off, or disconnect.

After you open gpedit.msc in the desktop operating system, go to

Windows settings > Security settings > Local policies > Security options > Interactive logon: smart card removal behavior.

10 VMware, Inc.

Using Embedded RSA SecurID Software Tokens

If you create and distribute RSA SecurID software tokens to end users, they need enter only their PIN, rather than PIN and token code, to authenticate.

Setup Requirements

NOTE This feature is available only if you are using View Client 1.6 or later.

You can use Compressed Token Format (CTF) or dynamic seed provisioning, which is also called CT-KIP (Cryptographic Token Key Initialization Protocol), to set up an easy-to-use RSA authentication system. With this system, you generate a URL to send to end users. To install the token, end users paste this URL directly into Horizon View Client on their client devices. The dialog box for pasting this URL appears when end users connect to View Connection Server with Horizon View Client.

Horizon View Client for Android also supports file-based provisioning. When a file-based software token is issued to a user, the authentication server generates an XML-format token file, which is called an SDTID file for its .sdtid extension. Horizon View Client can import the SDTID file directly. With View Client 1.7 and later versions, users can also launch Horizon View Client by tapping the SDTID file in a file browser.

After the software token is installed, end users enter a PIN to authenticate. With external RSA tokens, end users must enter a PIN and the token code generated by a hardware or software authentication token.

Chapter 1 Setup and Installation

The following URL prefixes are supported if end users will be copying and pasting the URL into Horizon View Client when Horizon View Client is connected to an RSA-enabled View Connection Server:

viewclient-securid://

http://127.0.0.1/securid/

With View Client 1.7 or later, end users can install the token by tapping the URL. Both prefixes viewclient-

securid:// and http://127.0.0.1/securid/ are supported. Note that not all browsers support hyperlinks

that begin with http://127.0.0.1. Also some file browsers, such as the File Manager app on the ASUS Transformer Pad, cannot link the SDTID file with Horizon View Client.

For information about using dynamic seed provisioning or file-based (CTF) provisioning, see the Web page

RSA SecurID Software Token for iPhone Devices at http://www.rsa.com/node.aspx?id=3652 or RSA SecurID Software Token for Android at http://www.rsa.com/node.aspx?id=3832.

Instructions to End Users

When you create a CTFString URL or CT-KIP URL to send to end users, you can generate a URL with or without a password or activation code. You send this URL to end users in an email that must include the following information:

Instructions for navigating to the Install Software Token dialog box.

Tell end users to tap External Token in the Horizon View Client dialog box that prompts them for RSA SecurID credentials when they connect to View Connection Server.

CTFString URL or CT-KIP URL in plain text.

If the URL has formatting on it, end users will get an error message when they try to use it in View Client.

Activation code, if the CT-KIP URL that you create does not already include the activation code.

End users must enter this activation code in a text field of the dialog box.

If the CT-KIP URL includes an activation code, tell end users that they need not enter anything in the

Password or Activation Code text box in the Install Software Token dialog box.

VMware, Inc. 11

Using VMware Horizon View Client for Android

Configure Advanced SSL Options

In Horizon View Client 2.3 and later, you can select the security protocols that Horizon View Client can use to connect to a View server. You can also specify the cipher control string.

IMPORTANT Horizon View Client and View Connection Server support TLS v1.0 and TLS v1.1 by default. You should change the security protocols in Horizon View Client only if your View administrator instructs you to do so, or if your View server does not support the latest protocols.

Prerequisites

Verify that you have Horizon View Client 2.3 or later.

Verify the security protocol that your View server can use. If you configure a security protocol for

Horizon View Client that is not enabled on your View server, the connection fails with an SSL error.

For information about configuring security protocols for View Connection Server, see the VMware Horizon View Security document.

Procedure

1 Use the Horizon View Client interface tools to display General Settings.

If you are using full-screen mode, tap the Horizon View Client Tools icon and tap the settings icon. If you are not using full-screen mode, the Settings button is in the upper-right corner of the screen.

2 Tap Advanced SSL Options.

3 Make sure that Use Default Settings is unchecked.

4 To enable or disable a security protocol, tap the check box next to the security protocol name.

TLS v1.0 and TLS v1.1 are enabled by default.

5 To change the cipher control string, tap inside the text box and replace the default string.

The default cipher control string (AES:!aNULL:@STRENGTH) includes cipher suites that use either 128bit or 256-bit AES encryption, except for anonymous DH algorithms, and sorts them by strength.

6 (Optional) If you need to revert to the default settings, tap to select the Use Default Settings option.

7 Tap OK to save your changes.

Your changes take effect the next time you connect to a View server.

Supported Desktop Operating Systems

Administrators create virtual machines with a guest operating system and install View Agent in the guest operating system. End users can log in to these virtual machines from a client device.

For a list of the supported guest operating systems, see the "Supported Operating Systems for View Agent" topic in the Horizon View 4.6.x or 5.x installation documentation.

12 VMware, Inc.

Chapter 1 Setup and Installation

Configure the View Client Download Links Displayed in View Portal

By default, when you open a browser and enter the URL of a View Connection Server instance, the portal page that appears contains links to the VMware Download site for downloading Horizon View Client. You can change the default .

The default Horizon View Client links on portal page ensure that you are directed to the latest compatible Horizon View Client installers. In some cases, however, you might want to have the links point to an internal Web server, or you might want to make specific client versions available on your own View Connection Server. You can reconfigure the page to point to a different URL.

When you make links for Mac OS X, Linux, and Windows client systems, the correct operating system specific link is shown on the portal page. For example, if you browse to the portal page from a Windows system, only the link or links for Windows installers appear. You can make separate links for 32-bit and 64bit installers. You can also make links for iOS and Android systems, but these operating systems are not automatically detected, so that if you browse to the portal page from an iPad, for example, you see the links for both iOS and Android, if you created links for both.

IMPORTANT If you customize the portal page links, as described in this topic, and later install VMware Horizon View HTML Access on the server, your customized portal page is replaced by an HTML Access page. For information about customizing that page, see Using VMware Horizon View HTML Access.

Prerequisites

Download the installer files for the Horizon View Client types that you want to use in your

environment. The URL to the client download page is https://www.vmware.com/go/viewclients.

Determine which HTTP server will host the installer files. The files can reside on a View Connection

Server instance or on another HTTP server.

Procedure

1 On the HTTP server where the installer files will reside, create a folder for the installer files.

For example, to place the files in a downloads folder on the View Connection Server host, in the default installation directory, use the following path:

C:\Program Files\VMware\VMware View\Server\broker\webapps\downloads

The links to the files would then use URLs with the format https://server-name/downloads/client-

installer-file-name. For example, a server with the name view.mycompany.com might use the following

URL for View Client for Windows: https://view.mycompany.com/downloads/VMware-Horizon-View-

Client.exe. In this example, the folder named downloads is located in the webapps root folder.

2 Copy the installer files into the folder.

If the folder resides on View Connection Server, you can replace any files in this folder without having to restart the VMware View Connection Server service.

3 On the View Connection Server machine, copy the portal-links.properties file and the

portal.properties file located in install-path\Server\Extras\PortalExamples.

4 Create a portal folder the directory C:\ProgramData\VMware\VDM, and copy the portal-

links.properties and portal.properties files into the portal folder.

VMware, Inc. 13

Using VMware Horizon View Client for Android

5 Edit C:\ProgramData\VMware\VDM\portal\portal-links.properties file to point to the new location of

the installer files.

You can edit the lines in this file and add to them if you need to create more links. You can also delete lines.

The following examples show properties for creating two links for View Client for Windows and two links for View Client for Linux:

link.win=https://server-name/downloads/VMware-Horizon-View-Client-x86_64-y.y.y-XXXX.exe#win link.win.1=https://server-name/downloads/VMware-Horizon-View-Client-y.y.y-XXXX.exe#win link.linux=https://server-name/downloads/VMware-Horizon-View-Client-x86_64-y.y.y- XXXX.rpm#linux link.linux.1=https://server-name/downloads/VMware-Horizon-View-Client-y.y.y-XXXX.tar.gz#linux

In this example, y.y.y-XXXX indicates the version and build number. The win text at the end of the line indicates that this link should appear in the browser if the client has a Windows operating system. Use

win for Windows, linux for Linux, and mac for Mac OS X. For other operating systems, use unknown.

6 Edit C:\ProgramData\VMware\VDM\portal\portal.properties file to specify the text to display for the

links.

These lines appear in the section of the file called # keys based on key names in portal-

links.properties.

The following example shows the text that corresponds to the links specified for link.win and

link.win.1:

text.win=View Client for Windows 32 bit Client users text.win.1=View Client for Windows 64 bit Client users

7 Restart the VMware View Connection Server service.

When end users enter the URL for View Connection Server, they see links with the text you specified. The links point to the locations you specified.

Install or Upgrade Horizon View Client for Android

Horizon View Client for Android is an Android app, and you install it just as you do other Android apps.

Prerequisites

If you have not already set up the device, do so. See the manufacturer's user's guide for your device.

Verify that you have the URL for a download page that contains the VMware Horizon View Client

installer. This URL might be the VMware Downloads page at http://www.vmware.com/go/viewclients, or it might be the URL for a View Connection Server instance.

When you browse to a View Connection Server URL, by default the links on that portal page point to the VMware Downloads page. You can configure the links to point to a different location. For more information, see “Configure the View Client Download Links Displayed in View Portal,” on page 13. Depending on how the page is configured, you might also see a link for VMware Horizon View HTML Access. HTML Access allows you to connect to a virtual desktop using the browser, without installing any client software. Because VMware Horizon View Client offers more features and better performance than the HTML Access client, VMware generally recommends that you install the client software.

Familiarize yourself with your device's procedure for installing apps.

14 VMware, Inc.

+ 32 hidden pages

VMware Horizon View Client for Android User Guide

Contents

Using VMware Horizon View Client for Android

Setup and Installation 1

System Requirements

Preparing View Connection Server for Horizon View Client

Smart Card Authentication Requirements

Configure Smart Card Authentication for Mobile Clients

Using Embedded RSA SecurID Software Tokens

Configure Advanced SSL Options

Supported Desktop Operating Systems

Configure the View Client Download Links Displayed in View Portal

Install or Upgrade Horizon View Client for Android