Configuration of the IGEL Agent for Imprivata on IGEL OS

For appliance failover with multiple appliances, separate the URL’s using a semicolon “ ; “ and no spaces.

Example: https://imprivata01.demolab.org;https://imprivata02.demolab.org;https://imprivata03.demolab.org

Related IAFI Configuration settings:

• Path to Certificate

• Skip Certificate Verification

• Connection timeout

Related IAFI Profile Configuration Lockscreen settings:

• Choose the Background Image

• Show Computername on Lockscreen (upper right corner of the screen)

• Lockscreen Shortcut

• Show the username at the Lockscreen (Registry Only)

  • This is related to an Imprivata Computer Policy setting: General - Display name format

  • You can change the format based on the policy options.

  • If you don’t want to show the logged in user on the lock screen, disable this in the registry.

This feature is an option primarily for the Follow Imprivata Policies and Workflows configuration that will use the IAFI Resource Chooser. However, if you want the IAFI login to be in a Windows mode (not Fullscreen), you could also use this with the Auth Only configuration.

When disabled, the agent switches to Auth Only mode and the Imprivata appliance is only used as an identity provider. No further VDA policy automation will be evaluated or executed. Instead, the credentials that are passed on from the Imprivata appliance will be securely stuffed into the session that is defined under Auth Only preconfigured session. Auth Only mode can be used for connecting to AVD, Windows 365, Citrix or Horizon sessions. 

IAFI will look at certificates in that directory when they are deployed from the UMS server. Follow these guidelines for deploying the Imprivata appliance certificate(s) from UMS to the devices. How to Deploy the Imprivata Appliance Certificate(s) to IGEL Devices

The default is 20 seconds but can be adjusted to a lower or higher number. IGEL does not recommend lowering this below 3 seconds.

Related setting: Set the URL to the server

If multiple appliances are listed, after the timeout setting is reached, the agent will contact the next appliance listed.

See this KB article for more information on customizing the background image.

How to enable IAFI logon screen customizations

You can type a keyboard shortcut of your choosing. IGEL only supports two key combinations. Example shortcut keys are:

• Esc

• Esc, q

• Alt, x

This is not a required setting but an option that can be used for IAFI Auth Only mode for Microsoft AVD or Windows 365 Cloud PCs. You would specify the name of the IGEL AVD app profile that is configured in the appliance “application mapping” section.

Related IAFI settings

• Follow Policies and Workflows > Default on how to leave a follow policies session

• Auth Only > default on how to leave a AuthOnly session

• Auth Only > When an endpoint is locked

This is only needed when an embedded smartcard (PCSC) reader is built into the IGEL device (ex: thin client, laptop) or an external keyboard. The agent recognizes the PCSC reader and displays it as a proximity reader on the IAFI login screen even though you can’t tap a badge.

To ignore the PCSC reader:

• Enable the Ignore readers setting in the IAFI profile

• on the device, open a terminal, log in as user or root.

• At the command prompt, type:  pcsclistreaders

• The output should display the name of the PCSC reader(s) and the slot numbers

  • For example, the output may look like this:  HID Global OMNIKEY 3x21 Smart Card Reader 00 00

  • Copy the output and paste it into the “Ignore readers” field

NOTE: if there are multiple PCSC readers, they will be displayed as a list. You can add both readers separated by a semicolon ( ; )

• In this example, you see both a keyboard device and USB smartcard reader.

• To add both of these devices to the Ignore readers field, it would look like this:

  • Cherry KC 1000 SC 00 00;SCR331 USB Smart Card Reader 00 00

See this IAFI Article for more information on enabling debug logging.

How to Enable and Export IAFI Debug Logging for Troubleshooting

Starting with IAFI 1.3.0 and higher, there is a new feature that supports the Imprivata VDA Computer Policy setting to keep a session active when the endpoint is locked as shown in this example.

IMPORTANT: In Follow Policies Mode, IAFI 1.3.0 and higher will honor this setting if it is enabled.

This setting filters out Citrix Apps in the IAFI Resource Chooser. Only Citrix desktops will be shown.

When disabled, the IAFI Resource Chooser will display Desktops and Apps that a user is entitled to.

NOTE: This setting is similar to how the Imprivata PIE agent Chooser works with XenDesktop VDA. Only Citrix desktop icons will appear if the user has multiple resources.

This setting filters out Horizon Apps in the IAFI Resource Chooser. Only Horizon desktops will be shown.

When disabled, the IAFI Resource Chooser will display Horizon Desktops and Apps that a user is entitled to.

NOTE: This setting is similar to how the Imprivata PIE agent Chooser works with Omnissa Horizon VDA. Only Horizon desktop icons will appear if the user has multiple resources.

For users that only have a single Horizon desktop entitlement, IAFI will launch that resource automatically when they log in. No IAFI resource chooser will appear.

NOTE: This setting is similar to how the Imprivata PIE agent works with Horizon VDA for users with just a single desktop.

This is setting that can “bypass” the VDA Policy settings and automatically start a specific resource if required. A good use case is for a “Location Based Override” where in that specific area, you want to always launch a specific resource regardless of the VDA policy settings.

This is setting that can “bypass” the VDA Policy settings and automatically start a specific resource if required. A good use case is for a “Location Based Override” where in that specific area, you want to always launch a specific resource regardless of the VDA policy settings.

Starting with IAFI 1.3.0 and higher, there is a new feature for Auth Only mode to keep a session active (vs. disconnected or logged off) when the endpoint is locked. When enabled, this keeps the user session active if the endpoint is locked via Badge Tap, Hotkey or Walkaway Security.

IMPORTANT: The IAFI Full Lockscreen should be enabled when using this setting in order to protect what is in use on the remote session (ex: virtual desktop with financial information or a patient record that requires privacy protection).

To make the credential stuffing possible, the credentials must not be predefined for the preconfigured session. Therefore set the relevant session credential parameters to inactive so that they are not controlled by the UMS profile.

Microsoft AVD or Windows 365

For an AVD or Windows 365 session, the settings should look like this:

• Apps > AVD > AVD Sessions > [session name] > Logon:

• Apps > IGEL Windows 365 > Windows 365 Sessions > [session name] > Logon:

  • Disable the “Enable Single Sign-On” setting

  • Set the Username@domain or @domain and Password parameters to inactive

Omnissa Horizon

For a Horizon Client Auth Only session, the settings should look like this:

• Apps > Horizon Client > Horizon Client Sessions > [session name] > Connection Settings:

  • Server URL: Enter the FQDN of the Horizon server

    • ex: https://horizon.igeldemolab.org

  • Lock user name: Disable or set inactive

  • Kiosk mode: Enable and set to ‘on’

    • this setting uses a noninteractive mode for the Horizon Client so the user doesn’t see a login prompt

  • Session type (you can only choose one session type)

    • Select Desktop (if connecting to a Horizon Desktop session)

      • OPTIONAL: Desktop name

        • If you want to auto launch a specific Horizon desktop, enter the name of the desktop

          • ex: Windows11

    • Select Application (if connecting to Horizon Applications)

      • OPTIONAL: Application

        • If you want to auto launch a specific Horizon application, enter the name of the app

          • ex: Outlook

• Use passthrough authentication for this session: Disable or set inactive

• Save last user name: Disable or set inactive

• Set inactive:

  • User name

  • User password

  • Domain

• Autoconnect: Enable

  • this will automatically launch the desktop or application resource specified in the Desktop or Application name setting

Citrix Workspace App

For a Citrix Workspace App Auth Only session, the settings under Apps > Citrix > Citrix Sessions > [session name] > Server should look like this:

• Type of the session: Select Storefront

• Citrix Store: Enter the FQDN URL for the Citrix Store

  • ex: https://controller.igeldemolab.org/citrix/cvad

For a Citrix Client Auth Only session, the settings under Apps > Citrix > Citrix Sessions > [session name] > Authentication should look like this:

• Authentication Method: Set to IGEL Login

• Remember user name and domain: Disable or set to inactive

• Synchronize Citrix password with screenlock: Disable or set to inactive

• Set inactive:

  • Username

  • Domain

  • Password

IMPORTANT: For Citrix Auth Only, you have to disable the Password field in the application registry.

Starting with the IAFI 1.0.0 version, we changed the FUS configuration to support standalone IGEL sessions (ex: Citrix, Horizon, AVD).

The FUS configuration is primarily for Imprivata Epic workflows with an IAFI lock screen used to obscure the session.

The preconfigured session would be for launching Epic or a Published Desktop. This session would be configured using generic credentials (ex: HOSTNAME).

With this setting enabled, when IAFI starts, it will automatically launch the preconfigured session. Once the virtual channel is established between IAFI and the Imprivata agent on the remote session, IAFI will show an authentication dialog indicating the user can log in.

Once the user logs into IAFI, their identity will be passed over the virtual channel to log the user into Epic