Authentication failures with my eToken/smartcard device and VMware Horizon

Rate this Article
Average: 1 (1 vote)

July 31, 2018

Last modified: 09/14/2023, 4:34 am

Knowledge Base Article Troubleshooting Authentication Security Third Party Enhancements Zero Clients

Prerequisites

eToken devices work based on the scenario in which they are intended to be used and the proper installation of the PCoIP Smartcard feature. Three scenario's are described below after the PCoIP Smartcard installation:

PCoIP Smartcard Installation:

  1. Check that the PCoIP Smartcard component is installed.
    • Search for the following registry key:
      HKEY_LOCAL_MACHINE\SOFTWARE\VMware,Inc.\VMware VDM\Plugins\wsnm\scredir.
      If it exists then the component is installed.
    • Search for the following file:
      C:\Program Files\VMware\VMware View\Agent\bin\wsnm_scredir.dll
      If the file is installed, it appears in your search.
       
  2. If the registry key is not there, reinstall your VMware View (Horizon) Agent and make sure you check the PCoIP Smart Card component during the install. 
    SCIS
  3. Ensure after the install you hard power off, then power on the workstation.

 

Scenario 1

You cannot use your eToken/smartcard device in pre-session

Cause

The smart card is not supported.

Resolution

Confirm your device is supported in the following knowledge base article.
PCoIP Zero Client requirements to support pre-session smart card authentication when connecting to VMware Horizon plus supported card readers and smart cards

Note: Your eToken device may be not be on the supported list at this time but still may work. Carry through Scenario 2 steps 2-4.

 

Scenario 2

If the device is not on the supported device list and does not work in pre-session, you might still achieve in-session use of the device.

Cause

If the PCoIP Smartcard feature is installed on a computer and an unsupported eToken device is being used, the PCoIP Smartcard feature may intercept the eToken commands and cause it to fail.

Resolution

Remove the PCoIP Smartcard feature and bridge the eToken device.

These steps will allow you to confirm installation of the PCoIP Smartcard feature, remove it and check whether your eToken device is bridged.

  1. Confirm your device is NOT supported. See the following knowledge base article. PCoIP Zero Client requirements to support pre-session smart card authentication when connecting to VMware Horizon plus supported card readers and smart cards

  2. Confirm the PCoIP smart card component is installed on the VM by searching for the following registry key:
    HKEY_LOCAL_MACHINE\SOFTWARE\VMware,Inc.\VMware VDM\Plugins\wsnm\scredir.

    1. If it exists, then the component is installed; go to step 3.
    2. If not installed go to step 5.

  3. If installed, remove it by reinstalling the View Agent, ensuring the option to install the PCoIP Smart Card component is NOT SELECTED. This will remove the component. 
    SCINS

  4. Hard power off, then power on the workstation.

  5. Add the eToken device to the list of bridged USB devices. How do I bridge a USB device on a PCoIP Zero Client?

  6. Test the eToken device in both pre-session and in-session. (In some cases in-session authentication will work when the device is bridged, while pre-session will not) If the eToken device still does not work when in-session, contact HP Anyware support to inquire if enhancements can be made regarding your eToken model.


Scenario 3

You would like to use your device in-session only.
This is required so the smart card reader is visible to the host OS allowing the management software to identify the smart card reader.

Cause

By default most smart card readers are considered a HID device which are locally terminated on the zero client and therefore cannot be seen by the host OS.

Resolution

Bridge the device.
Do this by following steps 2-6 in Scenario 2.

See also:

PCoIP TROUBLESHOOTING STEPS: Smart cards and Proximity cards