Skip to main content

​
Before you start

  • Neo uses the Horizon Server REST API, which every Connection Server of Horizon 7.10 and later serves at /rest/. Horizon 8 (2006) and later serves the machine, session and entitlement calls Neo’s agents use; audit events need 2106 and later, and creating a desktop pool 2111 and later.
  • Neo reaches the Connection Server over the internet. Its REST API must answer on HTTPS with a certificate from a public certificate authority, at a public address. If a firewall or reverse proxy limits who can reach it, allow Neo’s addresses to reach /rest/.

​
If the Connection Server is only on your internal network

Most are. This guide publishes only the REST API, never the Horizon Console, through a reverse proxy at your network edge that:
  • answers on a public name over HTTPS, with a certificate from a public certificate authority;
  • forwards only paths under /rest/ to a Connection Server, and refuses every other path;
  • accepts connections only from Neo’s addresses;
  • passes the Authorization header through.
Save the proxy’s public address in Neo.

​
1. Make a Horizon administrator for Neo

1

Create the Active Directory user

Create a user for Neo in Active Directory, such as neo-svc, with a strong password that does not expire without notice.
2

Give it a Horizon role

In the Horizon Console, open the Administrators page under Settings and add Neo’s user with a role and access group: Administrators (Read only) for an agent that only reads; Inventory Administrators to manage desktops, pools, sessions and entitlements, together with Global Configuration and Policy Administrators (Read only) on the root access group, which pool and entitlement changes need, and the Manage vCenter Configuration (Read only) privilege, which pushing a new image needs; Administrators only when Neo should also change servers and settings. A role on one access group limits Neo to that group’s pools.
Neo can do only what this administrator may do, whatever the agent’s access profile says.
If the password expires or you lock the user, Neo loses access until you save the new password here.

​
2. Add the user in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → Omnissa Horizon, under Servers & Virtualization.
2

Save the address, domain, user name and password

Enter the address of your Connection Server (for example https://horizon.example.com), the NetBIOS name of Neo’s domain (such as ACME), Neo’s user name without the domain, and its password, then click Save settings. Neo signs in before saving, so a wrong address or a refused password is rejected straight away. Horizon does not accept the user@domain form.

​
3. Turn Horizon on per agent

Open the agent, go to the Integrations section, and configure the Omnissa Horizon block. Agents see only what Neo’s Horizon administrator can see.

​
Pick an access profile

Read Only

Read desktops, pools, sessions, entitlements, health and events. Nothing is changed.

Helpdesk

Machine, session and entitlement changes (restart a desktop, log off a session, assign a user) wait on a technician. Everything else is read only.

IT Admin

Machines, pools, sessions and entitlements change without approval, except the changes that always ask. Server, gateway, settings and administrator changes wait on a technician.

Full Automation

Every change runs without approval, except the changes that always ask a technician.

​
Or set each area by hand

Each area can be Disabled, Read Only or Read/Write (Monitoring & Events is Read Only at most), and has its own technician approval setting.

​
Changes that always ask a technician

These wait on a technician under every profile, whatever the area’s own approval setting:
  • Deleting a desktop pool or a farm, which deletes every machine or RDS host in it, and deleting a persistent disk, which holds a user’s data.
  • Any change to administrators, roles, permissions, access groups, authenticators (SAML, RADIUS, JWT, True SSO), instant clone domain accounts and other domain accounts, and changing a user’s password.
  • Creating, joining, leaving or dissolving a Cloud Pod federation, rotating its keys, and deleting a site.
  • Removing a vCenter server, clearing the event database, deleting the Connection Server certificates, and installing or upgrading a Connection Server.
  • Starting a Workspace ONE Assist remote-control session on a user’s desktop.
  • Any change to Horizon’s security settings, and any update to a record that holds a stored password or key: a capacity provider, a vCenter server, the App Volumes Manager, a customization specification, the event database, an external deployment, a UEM server and the syslog file share.
  • Any change that stores a credential: a password, a shared secret, a licence key, a private key, or the user name and password in a URL.

​
Troubleshooting