FortiAuthenticator + Horizon VIEW

[aveloz]

Does anyone had implemented Fortiauthenticator with VmWare Horizon View?

[tnadeau23413]

I know this has been unanswered for a long time, but me and my team just ran into the same question and managed to get Horizon View working with FortiAuthenticator. 

1. Get your User Groups set up the way you want for access into Horizon

2. Get your User Groups set up the way you want for FortiAuthenticator access

3. Add a RADIUS client in FortiAuthenticator pointing to your Horizon View security server. Under "Secret" come up with a password and remember it, you will need it for step 13. For  "Client Address" add the IP address of your Horizon View security server. Configure your groups within this RADIUS client to the User Groups you set up in Step 2. Leave all EAP types unchecked. Under "Authentication method" select "Apply two-factor authentication if available". For username input format, put however your users log into the domain, either by UPN(user@example.com) or by realm(EXAMPLE\user).

4. In Horizon View, go to View Configuration > Servers > Connection Servers.

5. Select your Connection Server and click "Edit"

6.  Under "Authentication" change "2-factor authentication" to "RADIUS" and also check "Use the same user name"

7. Click "Manage Authenticators"

8. Click "Add"

9. Put in a label(this is what your users will see when users log into Horizon View) and a description.

10. For hostname/address, put the IP address of your FortiAuthenticator.

11. For Authentication and Accounting ports, they should be 1812 and 1813 respectively but refer to the RADIUS client configuration in your FortiAuthenticator from step 3 to make sure.

12. For authentication type, select PAP.

13. For shared secret, refer to the "password" you made in step 3. 

14. For "server timeout" we've had luck with 5 seconds but adjust to your environment.

15. For "max attempts" we've had success with 1 but adjust to your environment.

16. For "realm prefix/suffix" this is really a quality of life thing. If you don't want users typing in the domain name or full UPN, add stuff here. This is unnecessary for this to work.

Click OK and you should be authenticating :)

Hope this helps!

[ergotherego]

We use Windows AD authentication on the back-side, and had to use MSCHAP1 - MSCHAP2 is not supported on View currently.

[tnadeau23413]

We also upgraded from PAP to MSCHAPv1 for the same reason. We did PAP as proof of concept to get things to work.

Glad things are working for you!