Enabling and Configuring ProveID Embedded on IGEL Thin Clients

Imprivata ProveID Embedded is included with the IGEL firmware. You can enable ProveID Embedded on one thin client. Or you can use the IGEL Universal Management Suite (IGEL UMS) to enable it on multiple thin clients in the enterprise.

  1. Using the IGEL setup utility, go to Configuration > Sessions > Appliance Mode.

  2. Scroll to the bottom of the options and select Enable Imprivata Appliance.

    NOTE: If Enable Imprivata Appliance does not appear, then you need to update your firmware. Review Imprivata Enterprise Access Management - SSO Supported Components or Imprivata Enterprise Access Management- MFA Supported Components for supported models and firmware versions.

  3. Enter the DNS name for the Imprivata appliance.

  4. NOTE: This value must match the DNS name listed in the Imprivata SSL certificate. See Enabling and Configuring ProveID Embedded on IGEL Thin Clients.

  5. Do not change any other default settings in this section.

  6. For IGEL 10.06.170 to 11.03.x, manually add a custom command:

    1. Go to System > Firmware Customization > Custom Commands > Base.

    2. In the After session configuration box, add the following custom command:

      IMPORTANT:

      The command-line parameters must be typed in a single line.

      /usr/lib/imprivata/bin/python /usr/lib/imprivata/runtime/lib/proveid-embedded/Utils/VendorSpecificDeviceConfigurator.pyc
  7. For IGEL 11.04 to 11.06.120, configure this setting:

    In Settings > Registry > Imprivata, select the Gain Permission option to enable it.

  8. For IGEL 11.06.150 and later, the Gain Permission registry key was removed by IGEL, and is enabled by default. No further changes are required.

  9. Restart the thin client.

  1. In the IGEL UMS, create and configure a new profile for all the thin clients in your environment.

  2. Go to Configuration > Sessions > Appliance Mode.

  3. Scroll to the bottom of the options and select Enable Imprivata Appliance.

    NOTE: If Enable Imprivata Appliance does not appear, then you need to update your firmware. Review the Imprivata Enterprise Access Management - SSO Supported Components or the Imprivata Enterprise Access Management - MFASupported Components for supported models and firmware versions.

  4. Enter the DNS name for the Imprivata appliance.

  5. NOTE: This value must match the DNS name listed in the Imprivata SSL certificate. See Enabling and Configuring ProveID Embedded on IGEL Thin Clients.

  6. Do not change any other default settings in this section.

  7. For IGEL 10.06.170 to 11.03.x, manually add a custom command:

    1. Go to System > Firmware Customization > Custom Commands > Base.

    2. In the After session configuration box, add the following custom command:

      IMPORTANT:

      The command-line parameters must be typed in a single line.

      /usr/lib/imprivata/bin/python /usr/lib/imprivata/runtime/lib/proveid-embedded/Utils/VendorSpecificDeviceConfigurator.pyc
  1. For IGEL 11.04 to 11.05.x, configure this setting:

    In Settings > Registry > Imprivata, select the Gain Permission option to enable it.

  2. For IGEL 11.06.120 and later, the Gain Permission registry key was removed by IGEL, and is enabled by default. No further changes are required.

    NOTE:

    If you have many thin clients running on different IGEL firmware versions, ensure that you select the correct UMS profile version which matches the IGEL firmware version

  3. Apply the configuration to all thin clients in your environment.

  4. Restart the thin clients.

After installing ProveID Embedded, any changes made to the Citrix configuration require you to either restart ProveID Embedded or reboot the thin client. Completing either task ensures that the changes are copied to the module.ini file. This file is located at /writable/etc/imprivata/runtime/lib/VCD/.

To import the SSL certificate directly on one IGEL thin client

  1. Open a terminal window.

  2. Change to the directory /wfs

  3. Create a new subdirectory in /wfs: enter the command mkdir ca-certs

    This is also where you upload certificates for VMware View and Citrix.

  4. Insert the thumb drive into the thin client.

  5. Navigate to directory of the thumb drive.

  6. Copy the SSL certificate file with the command cp ssoCA.cer /wfs/ca-certs

  7. Restart the thin client.

To import the SSL certificate from the IGEL UMS:

  1. Right click the Files directory icon > Files > New File. The New File window opens.

  2. Select Upload Local File to UMS Server.

  3. In the field Local File, enter the location of the SSL certificate file.

  4. Set the following File Target fields:

    • Classification is set to Undefined by default.

    • Thin Client File: /wfs/ca-certs/ssoCA.cer

      NOTE: You do not have to create the directory ca-certs in advance; this process creates it automatically.

  6. Click OK. The certificate will appear in the Files directory.

  7. Click and drag the SSL certificate from the Files directory into your profile. You will see the certificate in the profile's Assigned Objects pane.

  8. Apply the profile to your thin client environment. You will see the profile in the thin client's Assigned Objects pane.

  9. Restart the thin clients.

IMPORTANT:

For IGEL 10.06.170 and later, the firmware expects the certificate to be named ssoCA.cer by default. If you rename the certificate, or place it at a different file path, you must modify the default path to the certificate using the IGEL Setup UI. For more information, see the IGEL documentation.

Single IGEL Thin Client

To completely remove Imprivata software files and directories from your thin client environment without resetting to the factory defaults, disable Appliance Mode.

To uninstall Imprivata software from one thin client:

  1. Select the specific thin client, and go to Configuration > Sessions > Appliance Mode.

  2. De-select Enable Imprivata Appliance by selecting Disabled instead.

  3. Click Apply. This will restart the Xserver.

Multiple IGEL Thin Clients

To disable Imprivata ProveID Embedded on your thin client, disable Appliance Mode:

  1. Select the profile that your thin clients are assigned to, and go to Configuration > Sessions > Appliance Mode.

  2. De-select Enable Imprivata Appliance by clicking Disabled instead.

  3. Click Save. The Update time dialog opens.

  4. Select Next Restart or Now.

  5. Click OK.

Setting an Administrator Password

Set a system password via the IGEL Universal Management Suite (IGEL UMS).

  1. In the IGEL UMS, go to Configuration > Security > Password.

  2. Select Administrator > Use Password.

  3. Enter a password.

  4. Apply the configuration. The setting takes effect immediately.

Disabling Console Switching

If a user presses Ctrl+Alt+(F9-F12), TTY Terminal opens, even when the screen is obscured by the Imprivata agent and the virtual desktop. To disable virtual terminal access from the thin client, set a registry key from the IGEL UMS:

  1. In the IGEL UMS, open the Setup window for your existing ProveID Embedded thin client profile.

  2. In the left pane, go to System > Registry.

  3. Click Search Parameter...

  4. Search the registry for the key dontswitch.

  5. Select Disable Console Switching.

  6. Save your changes.