Skip to content

Organization Configurations

The organization configuration defines how:

  • Users are authenticated and authorized in HyWorks.

  • Workspace settings are applied when granting users access.

Navigate to the given path to create or modify an existing organization from Settings > Configure > Organizations.

Organization Details

The basic configuration of an organization is as follows:

  1. Name: Provide a logical short name for a new organization. The following special characters are supported: _(Underscore) SPACE () {} # @ : -(Hyphen) .(dot).

  2. Code: A short code for an organization. The organization code is used for communication between the Controller and the HyWorks endpoints/HyLite. The following special characters are supported: _(Underscore), - (Hyphen),. (dot) and space (not trailing or leading spaces).

  3. Description: A logical description of the new organization.

  4. Parent Organization: Not modifiable; displays the parent organization details.

  5. Inherit Resources: Select the checkbox to share the parent organization's resources with this child organization. Keep it unchecked if the child organization is to be configured with independent resources.

  6. Select Active to activate the organization. Inactive organizations are not listed on the client end upon logon.

  7. Select Create Realm to define realm settings specific to this organization. Leave it unchecked to use the parent organization's realm settings; if unchecked, all realm settings (i.e., UI Settings, Portal Settings, and Desktop Client Settings) will be hidden.

  8. Select Create Auth Domain to specify Auth Domain settings for this organization (if the Create Auth Domain option is unchecked, the tab for the authentication domain will not be displayed, and the authentication domain of the parent or default organization will be used).

If the Create Auth Domain option is checked, the Authentication Domain tab will be enabled and will require appropriate configurations for the child organization. If the Inherit Resources option is checked, then the Administrator will also be able to view the authentication servers added for the default organization.

Authentication Domain

The Authentication Domain defines authentication and authorization configurations of an organization.

  1. Authentication Server: The server to be used for authentication. All authentication servers added to this organization or inherited from the parent organization can be used.

  2. Authorization Server: The server to be used to authorize application and desktop access. It can be the same as the authentication server, or a different server to authorize HyWorks queries or manage the user's membership. A consolidated list of applications and desktops can be assigned to the user based on assignments to the user, their groups, or the OU.

  3. User Validation Method: Integrated in the v4.1 Hotfix1 release, the option enables HyWorks to define the user validation flow with the following options:

    1. Via Authentication Server: HyWorks re-authenticates users using the configured authentication server.

    2. Using HySecure Token: HyWorks validates users using the token presented during login. This requires the HySecure Token Key to be configured.

    3. Fallback Mode (Both options selected): If a token is unavailable, HyWorks falls back to authentication via the configured authentication server.

  4. Group Fetch Mode: Added in the v4.1 Hotfix1 release, this configuration defines whether HyWorks fetches nested groups from the configured authorization server or uses direct group membership only.

    1. Fetch Direct Groups Only: Retrieves direct group memberships only.

    2. Fetch Nested Groups: Retrieves both direct and nested group memberships.

  5. Domain Name for Remote Desktop Session: When accessing assigned applications or desktops, HyWorks provides a domain name prefix to connect to the corresponding remote desktop server. This can be auto-fetched from the authentication or authorization server configuration, or custom-defined. For deployments using remote desktop servers in a workgroup, the domain name can be set to a dot ".".

  6. Use Credentials for Remote Desktop Server: When the authorization server is set to Built-in, which is typically used in workgroup configurations, the Administrator can configure which credentials are used when connecting to the remote desktop server.

    1. User-provided credentials: Credentials provided by the user for authentication will be used when connecting to virtual apps or virtual desktops.

    2. Built-in directory credentials: Credentials of users from the built-in directory will be used to connect to virtual apps or virtual desktops.

  7. User Creation on RDS(s): If the remote desktop servers are in a workgroup, the user creation method can be defined, as:

    1. Manual Synchronization: The Administrator will initiate user synchronization between the remote desktop servers and the built-in directory.

    2. Automatically on logon: No manual synchronization, but the users will be created at the next logon event.

    3. Do not create: Users will not be created, and the Administrator must manage the users’ availability on the remote desktop servers.

    If the remote desktop servers are in Active Directory or LDAP, the user creation method can be defined, as:

    1. Manual Synchronization: Disabled and does not get used.

  8. Populate Users into built-in directory: This option adds users to the built-in directory.

    1. Create users in the built-in directory: Users can be created by importing CSVs or specifying the details in the user creation wizard.

    2. Import users from the authentication server: Users can be fetched into the built-in directory from the authentication server.

Realm Settings

Realm settings in an organization define the client and user workspace portal behavior and the user interface. In the Organization wizard, no such controls or sections with the name Realm Settings are displayed, but the combination of the following sections is termed as Realm settings:

  1. UI Settings: UI Settings for the Client and User Workspace portal have the following settings:

    1. System Tray Pop-up Text: This option specifies the text displayed for the HyWorks Client in the system tray.

    2. Language Configurations: This option specifies the language used by HyWorks Clients.

  2. Portal Settings: For defining the User Workspace Portal settings.

    1. Enable Portal: For activating the logon through the User Workspace Portal.

    2. Exit Application Session on Close: This section specifies whether remote sessions are closed when exiting the portal.

    3. Use Custom Logo: This option helps to change the logo displayed in the Client and User Workspace Portal.

      1. This provides the option to select, crop, and upload custom logos for the organization.

    4. Hide System Tray Icon: This option hides the client’s system tray entry when accessed through the user workspace portal.

    5. Use Custom Portal Title: This option specifies the custom portal title.

    6. Tile Color: This option defines the tile color of the application's user workspace portal.

    7. Font Color: This section defines the font color used by applications on the user workspace portal.

    8. Default Client Type: This option specifies the client type used by default in the User Workspace portal. If the client is not installed, at the logon event, a dialog to install the client will be displayed and the specific type of client will be downloaded. The same settings also govern the type of client displayed on the logon screen with the Client Download Link.

  3. Desktop Client Settings: Configurations for HyWorks clients:

    1. Enable desktop client: This option allows you to activate the logon through HyWorks Clients.

    2. Allow Save Username: This section helps enable the user to save their username. The username used at the last successful logon will be cached and will be displayed at the next logon event.

    3. Allow Save Password: This option enables caching of the password used at the last successful logon event for the user on the client.

    4. Hide App Launcher: This option hides the application tray after logon.

    5. Use Custom Title for Client: This option helps to configure a custom title for the client.

    6. Tile Color: This option helps to define the tile color for the applications on the client application tray.

    7. Font Color: This option defines the font color used for applications in the client application tray.

    8. Application Shortcuts Settings

      1. Do Not Create Shortcuts: This option disables shortcut creation for applications on the user's desktops.

  4. Delete Shortcuts on Exit: This option removes the shortcuts when the client exits.

Detailed Information on Some Features

Nested Group Support

Nested Group Support enables HyWorks to resolve both direct and nested Active Directory group memberships during user authentication.

By default, HyWorks retrieves only direct group memberships. In environments where desktops or applications are assigned through nested groups, users may not receive the expected entitlements unless parent groups are also resolved.

Supported HyWorks Versions

  • HyWorks Controller v4.1-HF1 or later

Example:

User Membership Structure Groups Resolved by HyWorks
User1 → Dev → Engineers → AllEmployees Without Nested Group: Dev
User1 → Dev → Engineers → AllEmployees With Nested Group: Dev, Engineers, AllEmployees

This allows administrators to assign desktops and applications using nested Active Directory groups without requiring duplicate group assignments.

Feature Highlights:

  • Supports nested Active Directory group memberships during authentication.

  • Enables desktop and application assignments through nested groups.

  • Reduces the need for duplicate group assignments in Active Directory.

  • Preserves existing direct group resolution behavior.

  • Provides administrator-controlled configuration through Authentication Domain settings.

Configuration

  1. Log in to the HyWorks Controller Management Console.

  2. Navigate to HyWorks Controller Management Console > Settings > Configurations > Organization (Add/Edit) > Authentication Domain

  3. Edit the required Active Directory authentication domain.

  4. Select one of the following options:

    1. Fetch Direct Groups Only – Retrieves direct group memberships only.

    2. Fetch Nested Groups – Retrieves both direct and nested group memberships.

  5. Save the configuration.

HySecure Token-Based Authentication

HyWorks now supports HySecure token-based authentication, eliminating the need for reauthentication with Active Directory when a valid HySecure token is already presented at login.

This feature verifies that login requests originate from authenticated HySecure sessions by validating HS256-signed JWT tokens with a secret key, without requiring changes to the core authorization flow.

Configuration

  1. Log in to the HyWorks Controller Management Console.

  2. Navigate to HyWorks Controller Management Console > Settings > Configurations > Organization (Add/Edit) > Authentication Domain > User Validation Method

Supported HyWorks and HySecure Versions

  • HyWorks: v4.1-HF1 or later

  • HySecure: v7.0 or later.

  • Endpoints:

    • HyLite: Same as HySecure.

    • Windows Workspace Client: v7.2.0.1063 or later.

    • macOS Workspace Client: v7.0.1.1018 or later.

    • Workspace Ubuntu Client (64-bit Version): v7.1.1.1019 or later.

Solution Summary and Configurations

Implemented HS-HW JWT Token Validation using a shared secret key between HySecure and HyWorks.

Change Area Description
Settings Location Authentication validation options from Organization > Authentication Domain Configuration.
Validation Methods Three configurable user validation methods have been introduced; see details below.
Token Key HySecure User Token Key support (configuration) was added.
Provider Support AD, LDAP, and Built-in providers supported; HyId/HySecure not supported

Important

The key must be retrieved from the HySecure server with appropriate SAML/SSO configurations. Any misconfiguration may result in authentication failure and prevent users from logging in.

Available options:

  • Via Authentication Server: HyWorks re-authenticates users using the configured authentication server.

  • Using HySecure Token: HyWorks validates users using the token presented during login. This requires the HySecure Token Key to be configured. This does not fall back to directory authentication mode if a token is not presented or is incorrect.

    • Selecting this option will require mandatory HySecure User Token Configurations. See the steps in this section.

  • Fallback Mode (Both options selected): If a token is unavailable, HyWorks falls back to authentication via the configured authentication server.

HS-HW JWT Token Validation is a secure authentication mechanism introduced to protect HyWorks deployments operating in SAML-based HySecure VDI SSO environments where User Authentication Control is disabled for seamless passwordless login.

Configuring User Token Key

  • Step# 1: Obtaining HySecure User Token Key

    1. Currently, the HySecure User Token Key must be retrieved from the HySecure server. The option to retrieve it directly from the HySecure admin portal will be available soon.

      1. The method to retrieve the HySecure token is not publicly available. Contact the Accops support team for assistance with this configuration.

    2. The value retrieved from HySecure must be configured as the HySecure User Token Key in HyWorks.

  • Step# 2: HyWorks Configurations:

    1. Enable User Authentication Control from Advanced Settings.

    2. Navigate to Organization > Authentication Domain Configuration.

    3. Under User Validation Method, select Using HySecure Token.

    4. In the HySecure User Token Key field, enter the key retrieved from the HySecure server (see above for steps to obtain the HySecure User Token).

    5. Click Save. The key will be stored in encrypted format.

Important

  • Failure to complete all steps will result in authentication behavior governed by the global User Authentication Control setting.

  • The same attributes must be used in both HySecure and HyWorks.