Epic Delivered via Roaming VDI to ProveID Embedded Thin Clients

To enable the thin clients:

1. In the Imprivata Admin Console. open the gear icon menu, and click ProveID.

2. Select Allow full API access via ProveID Web API and ProveID Embedded.

3. Select your thin client model, and then click Save.

In this workflow:

• Users are enabled to authenticate with a proximity card + a password.

• Virtual desktop access is enabled.

Although users will typically authenticate to Imprivata Enterprise Access Management with a proximity card, enabling password as the second factor is required for Citrix/Omnissa Horizon pass–through authentication.

Defining Authentication Methods and Enabling Virtual Desktop Access

To create the user policy:

1. In the Imprivata Admin Console, click Users > User policies.

2. Click Add, and enter a policy name.

3. On the Authentication tab, go to the Desktop Access Authentication section.

4. Under Primary Factors, select Password, and then Proximity Card.

   A secondary factor is not required.

5. On the Virtual Desktops tab, select Enable virtual desktop access automation.

6. Select Automate access to full VDI desktops, and then select either Citrix or VMware.

7. Save the user policy.

The following screen captures detail the above settings.

Click to enlarge .

Assigning the User Policy

To apply users to the policy:

1. In the Imprivata Admin Console, click Users > Users.

2. Do one of the following:

   • Manually select users, and then click Apply Policy.

   • Click Bulk Actions > Assign User Policies to download a sample CSV file.

3. Modify this file to map multiple users to the policy, and then import port it.

Configuring a connection to the VDI connection brokers makes your virtual desktops available to computer policies.

Configuring the Connection to Brokers

To configure the connection:

1. In the Imprivata Admin Console, click Computers > Virtual desktops.

2. Do one of the following:

   • Citrix — In the Citrix XenDesktop section, enter one or more URLs to the Citrix stores.

   • VMware — In the VMWare Horizon section, enter one or more URLs to the Horizon Connection Servers.

3. Click Save.

Configuring Citrix for Native Connections to Stores

Additional Citrix configuration is required to support native connections to Citrix StoreFront stores. The Citrix store must be configured with the following authentication methods to support Imprivata Enterprise Access Management SSO:

• User name and password

• Domain pass-through

• HTTP basic — Even if the store is configured for HTTPS, this authentication method is required.

To configure the required authentication methods:

1. Open Citrix Studio.

2. Go to Citrix StoreFront > Receiver for Web.

3. Select the store you want to manage.

4. In the Store Web Receiver pane, click Choose Authentication Methods.

5. Click Add/Remove Methods and enable the required methods.

In this workflow, the thin clients are enabled for Windows authentication and automated virtual desktop access.

Enabling Windows Authentication and Virtual Desktop Access

To create the computer policy:

1. In the Imprivata Admin Console, click Computers > Computer policies.

2. On the Computer policies page, click Add, and then enter a name for the computer policy.

3. On the Shared Workstation tab, go to the Windows Authentication section, and select Authenticate using Windows.

4. On the Virtual Desktops tab, enable virtual desktop access based on your vendor:

   Citrix settings

   1. Go to the Citrix XenDesktop section, and select Automate access to Citrix XenDesktop.

   2. Under When a XenDesktop endpoint is locked, specify the required behavior when the thin client becomes locked:

      • Keep the XenDesktop client and user session active

        This option preserves the user session; when a user logs back into this endpoint computer (or another endpoint computer with XenDesktop enabled) their desktop and applications are preserved just as they were when this endpoint computer was locked.

      • Shutdown the XenDesktop client and disconnect the user session

        This option helps optimize resource consumption and minimizes the total number of active sessions in use in the enterprise. When a user logs back into this endpoint computer (or another endpoint computer with XenDesktop enabled) their desktop will relaunch.

   3. Under Available Citrix servers, select one or more Citrix stores.
   VMware settings

   1. Go to the VMware Horizon – Desktop section, and select Automate access to VMware Horizon.

   2. Under When a VMware Horizon endpoint is locked, specify the required behavior when the thin client becomes locked:

      • Keep the VMware Horizon client and user session active

        This option preserves the user session; when a user logs back into this endpoint computer (or another endpoint computer with XenDesktop enabled) their desktop and applications are preserved just as they were when this endpoint computer was locked.

      • Shutdown the VMware Horizon client and disconnect the user session

        This option helps optimize resource consumption and minimizes the total number of active sessions in use in the enterprise. When a user logs back into this endpoint computer (or another endpoint computer with XenDesktop enabled) their desktop will relaunch.

   3. Available VMware Horizon Connection Managers, select one or more Horizon Connection Servers.

5. Save the computer policy.

The following screen captures detail the above settings:

Click to enlarge.

While there are no required computer policy settings for the virtual desktop, it is best practice to keep policies associated with your virtual desktops and thin clients separate.

For any settings you require, create a new computer policy and explicitly assign it to your virtual desktops.

Session persistence (roaming) is managed by your virtual environment, not Imprivata Enterprise Access Management. If your virtual environment is configured correctly for session persistence, Enterprise Access Management seamlessly roams user sessions, on authentication, to the endpoint computers in your environment.

The Imprivata agent is client–side software that is responsible for securing desktop login, authenticating users, providing SSO functions, securely storing application credentials, keeping an audit trail, and exchanging data with the appliance.

Using the Installation Wizard

To install the Imprivata agent:

1. In the Admin Console, click Computers > Deploy agents.

2. Download the agent installer from the Deployment Procedure section.

3. Run the installation wizard.

Completing the installation requires you to:

• Enter the FQDN or IP address of the Imprivata appliance to which it should connect to obtain the enterprise topology.

• Select the Single User Computer agent.

Using a Software Distribution Tool

To deploy the Imprivata agent using third–party software distribution tool:

1. In the Imprivata Admin Console, click Computers > Deploy agents.

2. Download the agent installer from the Deployment Procedure section.

3. Deploy and run the Imprivata agent installation using the following syntax:

   msiexec.exe /i "<path_to_installer>\ImprivataAgent.msi

   IPTXPRIMSERVER="https://<appliance_FQDN>/sso/servlet/messagerouter"

   AGENTTYPE=1

The IPTXPRIMSEVER value specifies the appliance to which the Imprivata agent should connect to obtain the enterprise topology.

Consider the following:

• This syntax represents the required installation parameters. For a complete list of supported parameters, see the Imprivata Enterprise Access Management Help.

• The Imprivata agent installer supports standard msiexec options. For more information on these commands, run msiexec /?.

Install the Imprivata Connector for Epic Hyperdrive on all of the virtual desktop images that are delivering Epic. Consider the following:

• The same Imprivata Connector for Epic Hyperdrive installer supports both 32-bit and 64-bit operating systems.

• The Imprivata Connector for Epic Hyperdrive can only be used with one version of Epic on a given workstation.

Using the Installation Wizard

To install:

1. Run the installer (ImprivataConnectorforEpicHyperspace.msi).

   The installer automatically detects the version of Hyperspace installed and installs the appropriate Imprivata Connector for Epic Hyperdrive files for that version. If multiple versions of Hyperspace are detected or if Hyperspace is not installed, the Imprivata Connector for Epic Hyperdrive installer prompts you to select one version of Epic.

2. Restart the server.

The Imprivata Connector for Epic Hyperdrive is automatically installed in the same directory in which the Imprivata agent is installed. The default directory is:

C:\Program Files (x86)\Imprivata\OneSign Agent\EpicConnector

Using the Command Line

To install:

1. Standard msiexec commands can be used to run the installer (ImprivataConnectorforEpicHyperspace.msi).

   The Epic version of the Imprivata Connector for Epic Hyperdrive can be specified in the msiexec command line as follows:

   • EPICVERSION = 2014

   • EPICVERSION = 2015

   • EPICVERSION = 2017

   • EPICVERSION = "2018 August"

   • EPICVERSION = "2018 November"

   • EPICVERSION = "2019 February"

   NOTE: If you are using the Imprivata Connector for Epic Hyperdrive version 6.3 or later, including an Epic version is not required.

2. Restart the server.

The Imprivata Connector for Epic Hyperdrive is automatically installed in the same directory in which the Imprivata agent is installed. The default directory is:

C:\Program Files (x86)\Imprivata\OneSign Agent\EpicConnector

Thin clients typically ship with a compatible version of Citrix Workspace app or the Omnissa Horizon client, which use the explicit user credentials to connect to and deliver the desktop.

Imprivata supports a number of thin client devices, all of which support native connections to Citrix DaaS and Omnissa Horizon Desktops.

While the exact steps to configure the connection vary by device, you will need the following:

• The virtual desktop connection settings:

  • The hostname or URL of the Omnissa Horizon server (desktop).

  • The Storefront Web Site or XenApp Services URL of the Citrix server (desktop).

• The name of the desktop.

Import the Citrix or Omnissa Horizon SSL certificate into your thin clients to establish trust between both environments.

Before you begin, save a copy of the SSL certificate to a USB storage device (thumb drive).

HP Thin Clients

The following material is included as a reference for tasks in the HP Device Manager (HPDM) console. For more information, see your HP documentation.

Importing the SSL Certificate to One Thin Client

To import the SSL certificate to one thin client:

1. Insert the thumb drive into the thin client.

2. Click the wrench icon > Advanced > Certificate to open the Certificate Manager.

3. Go to the Local Root Certificate Authorities tab.

4. Click Import from File, locate the SSL certificate on the thumb drive, and click Open.

   Restarting the thin client is not required.

Distributing the SSL Certificate using the HP Management Console

Creating the Task

To create the task:

1. In the HP Device Manager console, click Templates and Rules.

   The Templates section lists all of the available base templates.

2. Double-click _File and Registry to open the Template Editor.

3. On the Content tab, click Add, select Deploy Files, and then click OK.

4. Click Add from local, and import the SSL certificate.

5. In the Path on Device field, enter /usr/local/share/ca-certificates, and then click OK.

6. On the Content tab, click Add, select Command, and then click OK.

7. In the Command field, enter the following:

   cd /usr/lib/hptc-cert-mgr

8. Click Add, and in the Command field, enter the following:

   /usr/lib/hptc-cert-mgr/certmgr-apply

   Do not change the default settings for Execute After Reboot (No) and Wait (Yes) for either command.

9. Click Save as to save the task, name the task, and then click OK
   The Package Description Editor appears.

Editing the Package Description

To edit the package description:

1. Complete the following fields:

   • Title

   • Installation Space

   • Architecture

   • OS Type

   • Device Models

2. Click Generate.

The template is created and appears in the Templates section.

Sending the Task

To send the task:

1. In the HP Device Manager Console, click Manage Devices.

2. Go to the Devices section, and right-click the required group of thin clients to open the Template Chooser.

3. From the Category List, select File and Registry, and then select the template that will deploy the SSL certificate.

4. Click Next.

5. Use the Task Editor to manage how and when the certificates will be sent to the device, and click OK.

IGEL Thin Clients

The following material is included as a reference for tasks in the IGEL UMS. For more information, see your IGEL documentation.

Importing the SSL Certificate to One Thin Client

To import the SSL certificate to one thin client:

1. Open a terminal window.

2. Change to the /wfs directory

3. Enter the following command to create a new subdirectory.

   mkdir ca-certs

4. Insert the thumb drive into the thin client, and navigate to the location of the SSL certificate.

5. Copy the SSL certificate file with the following command:

   cp <cert_name>.cer /wfs/ca-certs

6. Restart the thin client.

Distributing the SSL Certificate using the IGEL UMS

To distribute the SSL certificate using the IGEL UMS:

1. From the UMS console, right-click Files, and then click New File.

2. Select Upload Local File to UMS server, and then use Local file to browse to the SSL certificate.

3. In the field Local File, enter the location of the SSL certificate file.

4. Under File Target:

   • Set Classification to Undefined.

   • In the Device files location field, enter the following path:

     /wfs/ca-certs/<cert_name>.cer

5. Click OK.

6. Assign the SSL certificate to your thin clients directly or through the profile that is managing them.

7. Restart the thin clients.

NOTE: For more information on assigning objects, see the IGEL Knowledge Base.

Imprivata has worked with Epic Systems to develop the Imprivata Connector for Epic Hyperdrive. The Connector leverages Epic's authentication API to provide single sign-on, single sign-off, and fast user switching for Epic Hyperdrive.

Imprivata Enterprise Access Management offers two different configuration options for Epic that can be enabled on a per-workstation basis:

• SSO for Epic only workflow

  With this workflow, the Windows desktop is always unlocked. Users authenticate to Epic using their fingerprint or proximity card. This workflow is optimized for workstations on which Epic is the most frequently accessed application.

• SSO for multiple applications including Epic

  With this workflow, the Windows desktop is secured by the Imprivata agent. Users authenticate to EAM using their fingerprint or proximity card. This workflow is optimized for workstations on which Imprivata Single Sign-On is required for multiple applications, including Epic.

EAM can be configured to secure Epic and maintain the patient context or log the user out of Epic with either of these workflows.

When configuring support for Epic, consider the following:

• Use the endpoint computer policy to manage the settings on the Connector for Epic tab.

  These settings are only honored from the workstation on which users access Epic. The settings are not honored where Epic is installed.

• The Imprivata Connector for Epic Hyperdrive for Epic supports a number of reference architectures.

  While you can use the Imprivata Connector for Epic Hyperdrive Configuration Guide to complete the steps required of this reference architecture, the guide does include information that is optional.

As such, the table below provides an overview of what must be configured for this specific reference architecture.