VMware Horizon Workspace Essentials

By Peter von Oven , Peter Björk , Joel Lindberg
    What do you get with a Packt Subscription?

  • Instant access to this title and 7,500+ eBooks & Videos
  • Constantly updated with 100+ new titles each month
  • Breadth and depth in over 1,000+ technologies
  1. Getting Started with VMware Horizon Workspace

About this book

The Horizon suite is VMWare's end user solution suite. VMware Horizon Workspace allows administrators to virtualize operations systems, applications, and user data, and also delivers modern desktops to end users. VMware Horizon Workspace is a new type of solution that is commonly referred to as a "Workspace Aggregator” or “Universal Services Broker”. It delivers a solution that provides end-users with a single point of access to their corporate data, applications, and other IT-resources as well as providing IT administrators with a single point of administration and management.

This guide will show you how to deliver a complete user environment based on their entitlement, their location, and the end point device they are connecting with. It will also show you how, from an IT administrator’s perspective, everything can be managed from a single console.

This book starts by introducing the concepts behind Horizon Workspace, how they work, and how they map onto the everyday tasks faced by an IT administrator. It also covers the challenges a user faces in accessing the technology. It will then look in detail at the different features and functionality offered by Horizon Workspace in delivering against application brokering, data collaboration, and mobility. The book will take you through each one in detail, using illustrations and screenshots with the option to follow in real time to build out your own lab/pilot environment. You will also be guided through the product capabilities using step-by-step instructions and screenshots of each feature and how to implement it.

Publication date:
March 2014


Chapter 1. Getting Started with VMware Horizon Workspace

In this chapter, we will introduce you to VMware Horizon Workspace, where it is positioned in the market, and then give you an overview of all the components you need before starting to deploy the technology.

We will also cover where you can download the software from, outline the time requirements to install and configure a successful deployment, and give tips on what to think about for a full production environment. This book is primarily geared towards a test environment, as that's where most projects start. However, we will provide hints, tips, and best practices on building, delivering, and administering a full production environment as well.


Introduction to VMware Horizon Workspace

Horizon Workspace is a new type of solution that is commonly referred to as Workspace Aggregator. A solution that provides end users with a single point of access to their corporate data, applications, and other IT resources, as well as providing IT administrators with a single point of administration.

Let's first discuss the background and challenges that exist in most corporations today.

There are some ongoing technology trends that will affect us all and how we deliver IT services to our end users. A few of these are as follows:

  • BYOD

  • Software-as-a-Service

  • Mobile applications

  • Mobile/tablet devices

  • Always on network connectivity

  • Consumerization

In the last few years, the market has exploded with new devices, applications, and services that have been focused on being easy to pick up and consume with little technical knowledge.

Companies such as Google, Apple, Facebook, Twitter, and Dropbox have had enormous adoption with consumers; all of these services offer a great user experience and is easy to use.

For a long time, corporate IT companies have been able to withstand the pressure from these trends by locking environments down and mandating what users can access by way of applying policies, but we have reached a point where users are starting to circumnavigate these policies and utilize these services directly and not involving the corporate IT department and its policies. This is commonly referred to as shadow IT.

The traditional approach has been to deploy Windows on physical machines, and use some form of a distribution system for deploying applications and securing data. Users typically work between 8 a.m. and 5 p.m., usually from the office, and as the computers are physically attached to the desk, it's been considered secure.

Corporate IT risks turning into a slow moving dinosaur that does not contribute, but rather hinders innovation and users' ability to be productive. Users are starting to avoid involving IT since it takes a long time and is slow moving. There is now a real threat that corporate IT becomes irrelevant thanks to the competition from these outside trends.

Some real examples we have seen is when a business unit goes out and buys a solution somewhere from the Internet and is not even involving corporate IT since it would make the process slower and less productive.

Another common example is when users are using consumer-based file sharing applications to be able to share information or collaborate with partners, internal or external, to their organization.

When exposed to these threats, the following are the three common typical reactions:

  • Ignore it!

    Pretending that your users are not using these services and devices is a sure way of getting a false sense of security and comfort

  • Lock it down!

    Tightening the control even more usually forces people to find ways around the systems and will make the users unhappy

  • Implement a point solution

    Just solving one of the challenges might buy you some time, but in the end will actually increase the complexity since there will be many point solutions to solve all the challenges

Another approach is to embrace the advances in technology and to listen to the users' requests. This is where VMware Horizon Workspace can help.

Horizon Workspace addresses these new challenges, such as delivering web applications, mobile applications, and data collaboration to any device. The key point to highlight is that you can give the users the tools and the modern approach that they have become used to as a consumer, but still retain security and control.

Horizon Workspace 1.5 provides the following functionalities:

  • A single workspace for apps and data

  • Anywhere, anytime access

  • Data synchronization

  • Separate personal and corporate data

  • A virtualized container for Android devices

  • Native application support

  • Detailed policy management

  • Simple user and application management

  • Share files seamlessly and securely

  • Enterprise-grade security

  • Complete on-premise solutions

  • Access controls

So what is the business value for a customer when they deploy this solution? We can divide this into two aspects: one for end users and one for corporate IT.

  • For end users:

    • Easy access to applications, files, and virtual desktops

    • Single Sign-On to internal and external web-based applications

    • One place to access all services

    • A service catalog where the users can quickly get access to new services

    • Own choice of device and networks to work from

    • Use multiple devices without complex configurations or VPN

    • Sanctioned way to share files and collaborate with internal and external parties

  • For corporate IT:

    • Common model on how to entitle and disentitle users to services

    • Faster time to market for new services

    • Stop worrying about devices and start managing users

    • Extensible platform that can be integrated into existing services

    • Common reporting for all types of applications

Ease of deployment

Horizon Workspace comes packaged as a vApp, which means that it's a number of preconfigured virtual machines in a container with the extension .ova. Open Virtual Appliance (OVA) is a standard way of packaging a vApp.

It needs to be deployed using VMware vCenter Server on to a VMware vSphere virtualization platform. We will cover the prerequisites later in this chapter.

The benefits with this type of deployment is many, since the vApp is preinstalled with the operating system (Horizon Workspace is based on Suse Linux Enterprise Server) and all components that make up Horizon Workspace. The only thing you need to do is to configure the unique settings for your environment. There is no complicated operating system to install and configure, and no installer to run.

Just download and deploy.

Another benefit of being deployed within a virtual environment is that we can take advantage of all the features that the virtual infrastructure platform provides for, which are high availability, load balancing, backup, and disaster recovery.

Proving the technology

Before embarking on a Proof of Concept (POC) or Pilot of Horizon Workspace, the following are a few things that we have learned from our experience in working with the technology:

  • Do not run a POC/Pilot on production systems

    • This could possibly interfere with your running systems

  • Do not run a POC/Pilot using production applications.

    • Horizon Workspace can take over the authentication for web-based applications that it integrates with and can disable other ways of authenticating, potentially locking out other users

  • Make sure that you have clearly defined the success criteria. It's hard to know whether you have succeeded if there are no clear goals or objectives defined

Now that we have introduced you to VMware Horizon Workspace, we are going to cover what you need to get your environment up and running in the following sections.



The first thing we are going to cover are the prerequisites in more details. We will start with the test environment first.

Infrastructure requirements for an initial test setup

You will need the following hardware and virtual infrastructure components:

  • 1 vCenter Server

  • 1 ESXi host server with:

    • A minimum of 8 cores

    • 14 GB RAM

    • 412 GB of local disk or SAN attached storage

The installation and configuration of vCenter and ESXi is beyond the scope of this book and therefore we assume that you already will have this in place.


Using VMware Workstation or VMware Fusion natively does not work since the vApp requires a vCenter to be able to deploy. As an alternative, you could use something known as nested hypervisors. This means that you can use VMware Workstation or Fusion and create a virtual vCenter and virtual instance of ESXi. Be aware though that this will cause considerable overhead and require a powerful CPU, plenty of memory, and a fast disk system.

Infrastructure requirements for production deployment

For production environments, you will need the following minimum hardware and virtual infrastructure components:

  • 1 vCenter-server, redundant

  • 2 ESXi-hosts (3 ESXi hosts are recommended)

  • 500 GB of SAN storage

  • Network Load balancer

  • NFS-storage for Horizon Files

Horizon Workspace supports a number of VMware vSphere versions listed as follows:

  • vCenter: 5.0 U2, 5.1, and 5.5

  • ESXi: 5.0 U2, 5.1, and 5.5

When setting up your ESXi hosts, ensure that you configure them to use the Network Time Protocol (NTP). Correct time synchronization is critical for a successful installation since the SAML-based authentication is based on short-lived assertions of 60 seconds. If there is a time difference, logins will fail.

Network, DNS, and Active Directory requirements

The initial deployment of Horizon Workspace will require 5 IP addresses. If you need redundancy and external access, you will need additional IP addresses. Each of the IP's need a static DNS host record as well as reverse pointer-records (PTR record).

DNS name resolution needs to be fully implemented for both forward and reverse lookups. Horizon Workspace will not function without reverse lookups configured.

For this book, we have used Windows Server 2008 R2 Active Directory and DNS; however, Horizon Workspace supports Windows 2003 Active Directory or later. Using Bind DNS will work just as well as using Microsoft DNS.

As we go through the setup of the Active Directory (AD) infrastructure to support our installation, it's worth making a note of some of the key information that you will be prompted for during the actual configuration process. Make a note of the following information:

  • Name of the Active Directory controller

  • Fully qualified domain name (FQDN) of the Active Directory controller

  • Base DN— the container from where to start searching for users; in our example, this would be something like ou=horizon, dc=domain_name, or dc=local

  • The Bind DN username and password

  • Administrator account or an account with rights to add computers to the domain


The Bind DN username is an account that will be used to communicate with Active Directory to read user information and their attributes. The Bind DN will become the first administrator in your Horizon Workspace installation. In our examples, we have set up a Horizon Administrator account to do this. You need to enter the details in the following format:


vCenter Server requirements

Before installing the vApp, you need to configure an IP pool for the Horizon Workspace vApp that contains the correct IP address range along with details of your DNS server (you can only specify one DNS server). You also need the name of the domain into which you will deploy your VMs.


IP pools are used by vCenter to provide a network identity to vApps. The IP pool itself is a network configuration that you assign to a network used by the vApp. Once set up, the vApp can use vCenter to provide the IP configuration to the virtual machines it contains.

External access

For users to log on to their Workspace, you will need to make sure certain network ports are open. For external access, you will need to ensure that the TCP port 443 is open for the connector-va appliance to communicate. For a production environment with a demilitarized zone (DMZ)—a term for a network between internal and external networks—and connection to external services such as Active Directory and RSA SecureID, additional ports may need to be opened. If you are also integrating with Horizon View, you will need to make sure that those ports are also open.


For a production environment, you will need publicly signed certificates from a trusted certificate provider. For a test environment, you can use a self-signed certificate. The certificate must have the FQDN of your Horizon Workspace installation as the Subject Alternative Name (SAN) of the certificate or you can use a Wildcard certificate.


Horizon Workspace vApp

Horizon Workspace comes packaged as a vApp, which means that it's a number of preconfigured virtual machines in a single file with the extension OVA. (The OVA extension is a standard way of packaging a vApp).

There are many benefits with this type of deployment. The vApp is preinstalled with the operating system (Horizon Workspace is based on SUSE Enterprise Linux (SLES)) along with all the components that make up Horizon Workspace. The only thing you need to do is to configure the unique settings in your environment. There is no operating system to install and no installer to run.

Use a naming convention that makes sense to you and is consistent throughout your environment. For a test environment you can keep the default appliance names, but for production, it would make sense to name them, so that they are meaningful to your environment and also as one of the appliances will be the address that your users will use to connect.

Choose your hostnames and enter them into your DNS server along with the associated IP addresses. During the installation process, the appliances will perform a reverse lookup in DNS to determine (resolve) what their hostname is.

An overview of vApp

As we previously discussed, Horizon Workspace is comprised of five virtual appliances as shown in the following diagram:

The five virtual appliances (va) are described in the following list:

  • gateway-va

    The Horizon Workspace Gateway is the single entity for all end user communication. All user requests hit the gateway-va virtual machine, which then routes the request to the appropriate virtual appliance. The Gateway appliance offers a single namespace for accessing the Horizon Workspace implementation.

  • configurator-va

    Horizon Workspace is configured using this virtual appliance, so this appliance configures all the other appliances. It has both a console and a web interface. Any configuration changes you make with the configurator are then distributed to the other virtual appliances within the vApp automatically, for example, SSL-certificates and root passwords.

  • service-va

    Horizon Workspace uses a standard named SAML for authentication of users and to extend the identities, which is explained in more detail in Chapter 4, Integrating SaaS Applications. The service-va controls this function and also provides the frontend for the Administrator Web interface.

  • connector-va

    The Horizon Workspace Connector provides the following services: user authentication (identity provider), directory synchronization, ThinApp synchronization, and View pool synchronization.

  • data-va

    This virtual appliance controls file storage and sharing service, stores users' files and folders, and synchronizes them across multiple devices. The data-va also hosts the end user web portal. We will cover the functionality of this appliance in Chapter 3, Horizon Files.



For a test environment, select a mixed group of users and provide them with the necessary equipment such as a tablet or an extra phone during the test phase. To get a good understanding of the solution and how users will consume the services, it is important to expose a few users from different departments to the solution. Try to restrict the user groups to something that is manageable; we recommend at least five, but no more than 10 in the first phase. Once you move into production, Horizon Workspace will affect all of your users as it becomes the central place they log on to in order to access the tools, data, and applications to get their job done. This is likely to be a major change from how they work today.

Allow time and resources for user training and use your Pilot users as Horizon Workspace Champions. They can then manage the initial user issues.


Downloading the software

An easy way of finding the software is to browse the VMware's official portal at https://my.vmware.com.

Now, navigate to Downloads | All Products. From there, scroll down to Desktop & End-User Computing and find the VMware Horizon Workspace entry.

Simply click on View Download Components | Product Downloads | VMware Horizon Workspace | Go to Downloads. From there, find the VMware Horizon Workspace and click on Download Now.

Unless you are already logged in, you will be asked to provide your username and password for your My VMware account. If you do not have one, register a new account.

If you receive a message saying that you are not entitled to this download, it means that no licenses are registered to your account. If you have not purchased any licenses, you can request an evaluation license instead. To do this, perform the following steps:

  1. Click on Download Trial.

  2. Click on Register and complete the required information and then click on Continue.

Take a note of your license information and then proceed to the download.


Since it's a big download, about 5.2 GB, please verify the MD5SUM or SHA1SUM once the download is complete with the one published on the download page. An incomplete/corrupt download could cause unpredictable problems later.



In this chapter, we have introduced you to Horizon Workspace and the major trends for end-user computing and the challenges associated with them.

We have also learned about the major components of VMware Horizon Workspace and the prerequisites and pieces you need to deploy the solution.

In the next chapter, we will cover the installation of the Horizon Workspace vApp and the configuration steps.

About the Authors

  • Peter von Oven

    Peter von Oven is an experienced technical consultant and has spent the past 25 years working with customers and partners designing technology solutions. During his career, Peter has presented at key IT events, such as VMworld, IP EXPO, and various VMUGs and CCUG events. He has also worked in senior presales roles and presales management roles for Fujitsu, HP, Citrix, and VMware, and has been awarded VMware vExpert four years running. In 2016, Peter founded his own company, Droplet Computing, where he works today as the Founder and Chief Technology Officer.Peter got his first taste for writing when assisting with some of the chapters in Building End-User Computing Solutions with VMware View, which then lead to five other Packt titles.

    Browse publications by this author
  • Peter Björk

    Peter Björk has many years' experience in VMware Horizon Workspace and ThinApp. He started out working with Thinstall, and continued after VMware acquired the product in 2008, renaming it ThinApp. Peter supports Horizon Workspace and ThinApp in the Europe, Middle East, and Africa region. As a teacher, Peter has educated many ThinApp packagers around the world. Peter lives in Sweden with his wife and two kids, a boy and a girl. Peter Björk is very active on the VMware community pages and the official VMware Workspace and ThinApp blogs. You can follow Peter on Twitter (@thepeb) to get the latest ThinApp and Workspace news.

    Peter Björk published his first book, VMware ThinApp 4.7 Essentials, Packt Publishing, in 2012.

    Browse publications by this author
  • Joel Lindberg

    Joel Lindberg has 20 years' experience in the IT industry in various positions and is currently working at VMware as a Senior Systems Engineer specializing in end-user computing solutions. He has spoken at VMworld several times and is an active member and moderator on the VMware user communities. Joel interacts with customers, partners, and vendors, and has been involved in many successful customer projects. You can follow him on Twitter (@viewgeek).

    Joel lives in Stockholm, Sweden with his family.

    Browse publications by this author
VMware Horizon Workspace Essentials
Unlock this book and the full library FREE for 7 days
Start now