ProveID Embedded Configuration Editor
The Imprivata ProveID Embedded configuration editor lets you modify select default configuration parameters. The configuration editor is the only supported way in which to modify the following settings.
Run the Configuration Editor
To run the configuration editor, open a terminal and enter the following:
/usr/lib/imprivata/runtime/bin/configuration-editor
Examples
-
The following example configures ProveID Embedded to contact the specified appliance when booting for the first time. ProveID Embedded uses this appliance to download the network topology:
/usr/lib/imprivata/runtime/bin/configuration-editor bootstrap -s 198.51.100.0
-
The following example configures the ProveID Embedded desktop to display the time in the 24 hour clock format.
/usr/lib/imprivata/runtime/bin/configuration-editor apps-clock --24
Bootstrap Configuration Reference
The following tables detail the bootstrap options that can be configured.
Bootstrap URLs
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
bootstrap.urls |
server |
When booting for the first time, connect to this appliance to obtain the enterprise topology. |
string |
Valid values limited to FQDN and IP address. Multiple values must be comma separated. |
bootstrap -s<URL> bootstrap - s <URL>,<URL> |
Bootstrap Logging
| Section |
Settings |
Description | Type | Notes | Usage |
|---|---|---|---|---|---|
| bootstrap.logging | Top level | ||||
|
console |
Print the log to the console. |
boolean |
"true" to print the log to the console; otherwise, "false". This behavior is disabled by default. |
bootstrap-logging --console <value> |
|
|
level |
Logging level. |
string |
Valid values limited to "info", "debug", "error", and "warning". Default: info |
bootstrap-logging --level <value> |
|
|
format |
Format of the message output. |
string |
Not yet supported. |
Not yet supported. |
Bootstrap
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
bootstrap |
Top level | ||||
|
retry-wait-time |
If a connection attempt has failed, the time to wait before retrying the connection. |
number |
In seconds Limit: 5 |
bootstrap --retry-wait-time <value> bootstrap --retry-wait-time <value> |
|
|
retry-limit |
Number of attempts to make before determining that the appliance cannot be reached. |
number |
Limit: 5 |
|
Imprivata Configuration Reference
The following tables detail the Imprivata ProveID Embedded options that can be configured.
Agent Server
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
| agent.server | Top level | ||||
| url | Appliance name or IP address. | string | Valid values limited to FQDN and IP address. | agent -s <value>
|
|
| single-server-only | Connect to a single appliance only. | boolean |
"true" to use one appliance only; otherwise "false". Default: false |
agent --single-server-only <value>
|
Agent VDI
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
| agent.vdi | Top level | ||||
| launch-known-active-sessions-only | Launch sessions that are both active and known to ProveID Embedded. | boolean |
"true" to enable; otherwise, "false". This behavior is disabled by default. |
vdi --launch-known-active-sessions-only <value>
|
|
| activate-session-timeout | Wait to start Citrix session sub processes. | number |
In seconds. Default: 5 |
vdi --activate-session-timeout <value>
|
|
| xenapp-try-to-launch-new-session | Launch a new session, instead of launching active session. | boolean |
"true" to launch new session; otherwise, "false" to launch active session. This behavior is disabled by default. |
vdi --launch-new-session <value>
|
|
| enable_vdi_logging | Log information from the VDI client process. | boolean |
"true" to enable logging; otherwise "false". This behavior is disabled by default. |
vdi --enable-vdi-logging <value>
|
|
| grid-theme | Display the ProveID Embedded published application chooser. | boolean |
"true" to enable; otherwise, "false". This behavior is disabled by default. |
vdi --grid-theme <value>
|
|
| citrix-fus-saml |
Enable SAML authentication to a Citrix storefront for fast user switching (FUS) for Citrix XenDesktop and XenApp. |
boolean |
"true" to enable; otherwise, "false". This behavior is disabled by default. SAML connections for fast user switching for a thin client can also be enabled when configuring the thin client connection |
vdi --citrix-fus-saml <value>
|
|
| persistent-apps | Enable persistent applications for Citrix virtual applications. | boolean |
"true" to enable; otherwise, "false". This behavior is disabled by default. Available only for Zotac thin clients using Ubuntu MCNP configuration, and for IGEL thin clients using IGEL firmware version 11.06.100 and later. NOTE:
Persistent applications should be run on a different Citrix server, under their own “wfica” process, so that on disconnect all non-persistent resources can be properly terminated. This requires an additional Citrix server, which is a significant additional cost. |
vdi --persistent-apps <value>
|
|
| auto-open-grid-menu |
Make the ProveID Embedded published application chooser mostly cover (appear atop) any persistent application after user login or fast user switch. |
boolean |
"true" to enable; otherwise, "false". This behavior is enabled by default. |
vdi --auto-open-grid-menu <value>
|
|
| fire-session-connect-wait-timeout | Specifies a duration for an internal process to wait when a virtual desktop session starts after a user logs in using ProveID Embedded. If needed, use this option to stop the ProveID Embedded login screen from reappearing after a user logs in with it. When that login screen reappears, it covers the virtual desktop and requires the user to log in again. | number |
In seconds. Default: 3 |
vdi --fire-session-connect-wait-timeout <value>
|
Applications Clock
| Element | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
applications.clock |
use-24h |
Control the desktop clock format.
|
string |
Valid values limited to "--12" and "--24" |
apps-clock <value> |
Agent Login Screen
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
agent.login_screen |
|
Top level
|
|
|
|
| resolution | Resolution of the lock screen. | string |
Specified in standard display modes. Format: Standard acceptable resolution format. Default: 1024, 768 |
login-screen
--resolution <resolution>
|
Agent Logging
| Section |
Settings |
Description | Type | Notes | Usage |
|---|---|---|---|---|---|
| agent.logging | Top level | ||||
|
console |
Print the log to the console. |
boolean |
"true" to print the log to the console; otherwise, "false". This behavior is disabled by default. |
bootstrap-logging --console <value> |
|
|
level |
Logging level. |
string |
Valid values limited to "info", "debug", "error", and "warning". Default: info |
bootstrap-logging --level <value> |
|
|
format |
Format of the message output. |
string |
Not yet supported. |
Not yet supported. |
Agent
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
agent |
|
Top level
|
|
|
|
| disable-certificate-checking | Enable access when the Imprivata appliance root certification authority (root CA) certificate is expired or removed. | boolean |
"true" to enable; otherwise "false". The root CA must be present on thin clients when upgrading and downgrading the Imprivata agent. The Imprivata agent cannot be installed if the root CA is not present on the thin client. This behavior is disabled by default. |
agent
--disable-certificate-checking <value>
|
|
| fp-reconnect-attempts-amount |
Number of connection attempts to make before determining that the fingerprint reader cannot be reached. |
number | Default: 1 | agent
--fp-reconnect-attempts <value>
|
|
| language-selection | Specify a language supported by ProveID Embedded. | string |
English is enabled by default. Valid values limited to: Arabic: “ar_SA” Danish: "da_DK" German: "de_DE" Spanish: "es_ES" Finnish: "fi_FI" French: "fr_FR" Italian: "it_IT" Dutch: "nl_NL" Norwegian: "nb_NO" Netherlands: "nl_NL" Portuguese: "pt_BR" Swedish: "sv_SE" Language does not have to be supported by vendor. |
agent --language <value>
|
Agent Timeouts
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
agent.timeout |
|
Top level
|
|
|
|
| generic-timeout-long | Time to wait before refreshing the authentication tiles, regardless of user activity. | number |
In seconds Default: 240 |
agent-timeouts --generic-long <value>
|
|
| generic-timeout-inactivity |
Time to wait before refreshing the authentication tiles due to user inactivity. |
number |
In seconds Default: 120 |
agent-timeouts --generic-inactivity <value>
|
|
| qna-timeout-long | Time to wait before closing self-service password reset dialog, regardless of user activity. | number |
In seconds Defaults to generic-timout-long |
agent-timeouts --qna-long <value>
|
|
| qna-timeout-inactivity | Time to wait before closing self-service password reset dialog due to user inactivity. | number |
In seconds Defaults to generic-timout-inactivity |
agent-timeouts --qna-inactivity <value>
|
|
| server-connect-timeout | Time to wait before determining that the appliance is unreachable. | number |
In seconds Default: 10 |
agent-timeouts --server-connect <value>
|
Agent Auto-Restart
| Element | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
agent.auto-restart |
enable |
Enable the ProveID Embedded agent to auto-restart after it was terminated. For IGEL, this setting is ignored. Agent auto-restart is enabled by IGEL firmware and cannot be disabled. |
boolean |
"true" to enable; otherwise, "false". This behavior is disabled by default. |
To disable agent auto-restart:
|
Citrix
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
citrix
|
cookie-insert
|
Name of the cookie used with a Citrix NetScaler load balancer to maintain endpoint session persistence. |
string |
The same cookie name must be specified in the Citrix NetScaler’s configuration, in the Persistence section. That section must also specify COOKIEINSERT as the persistence method. |
citrix --cookie-insert <value> |
Smartcard
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
Smartcard |
native_smartcard_redirection |
Enables/disables native smartcard redirection.
|
boolean |
"true" to enable; otherwise, "false". Used by Microsoft RDS and Remote PC session only. When enabled, Omnikey provider is not initialized. This behavior is disabled by default. |
|
VMware Horizon
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
vmwareview |
enable-menu-bar |
Enable/disable VMware Horizon client menu bar. |
boolean |
"menubar" to enable; otherwise, "nomenubar". This behavior is disabled by default. |
menubar nomenubar |
Mainloader
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
mainloader |
appliance |
Appliance name or IP address. |
string |
Valid values limited to FQDN and IP address. |
mainloader --server <value> |
Mainloader Logging
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
mainloader.logging |
|
Top level
|
|
|
|
| console | Print the log to the console. | boolean |
"true" to print the log to the console; otherwise, "false". This behavior is disabled by default. |
mainloader-logging --console <value>
|
|
| level |
Logging level. |
string |
Valid values limited to "info", "debug", "error", and "warning". Default: info |
mainloader-logging --level <value>
|
|
| format | Format of the message output. | string |
Not supported. |
Not supported. | |
| full_xml | Show response details | boolean |
"true" to show details; otherwise, "false". This behavior is disabled by default. |
mainloader-logging --full-xml <value>
|
Device
When there are multiple proximity devices attached to a ProveID Embedded workstation, you can denylist (exclude) specific devices so that Imprivata OneSign interacts properly with the desired device.
If you do not know the name of the device to denylist, use the Imprivata OneSignAgent log on the ProveID Embedded workstation to identify the device.
| Section | Settings | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
| device | denylist | List of proximity devices to exclude. | strings |
The list of proximity devices to exclude is comma delimited and enclosed in single quotation marks.
The values can be specific for a particular device or general for a particular vendor. For example: 'HID OMNIKEY 5022' or 'XIRING' |
device --denylist '<value>, <value>'
|
Examples
The following example denylists a single 5022 device:
/usr/lib/imprivata/runtime/bin/configuration-editor device --denylist 5022
The following example denylists a single device having spaces in its name:
/usr/lib/imprivata/runtime/bin/configuration-editor device --denylist 'HID Omnikey 5022'
The following example denylists two devices:
/usr/lib/imprivata/runtime/bin/configuration-editor device --denylist 'HID Omnikey 5022, XIRING'
The following example turns off the denylisting:
/usr/lib/imprivata/runtime/bin/configuration-editor device --denylist ''
Windows Monitor
| Section | Setting | Description | Type | Notes | Usage |
|---|---|---|---|---|---|
|
windows.monitor
|
log-activity
|
Enable/disable application window activity logging to the Imprivata agent log. |
boolean |
"true" to enable; "false" to disable. This behavior is disabled by default. |
windows.monitor --log-activity <value> |
Session Launch API
Thin client vendors implement device specific features using the Imprivata session launch API to allow for greater control of the user session experience with Citrix, VMware, and Microsoft workflows.
-
For IGEL 10.06.170 and later, this functionality is enabled by default.
-
For HP ThinPro 7.2 and later, this functionality is enabled by default. For HP ThinPro 7.1 SP1 until 7.2, the functionality is available but must be enabled.
If this functionality for vendors to use the Imprivata session launch API is available but is not enabled by default, then to enable it, use the ProveID Embedded configuration editor to enable the use–vendor–launch–script parameter. For more information, see that parameter in the Agent VDI reference section of the Imprivata ProveID Embedded Integration Guide for Vendors, which is available on request only to vendor partners.
