VMware has announced Hori­zon Appli­ca­tion Man­ager 1.2, and together with the new Thi­nApp 4.7 release it promises “end users access to Win­dows, SaaS and enter­prise web appli­ca­tions across dif­fer­ent devices while retain­ing con­trol and vis­i­bil­ity via policy-driven man­age­ment”.

VMware Hori­zon Appli­ca­tion Man­ager now man­ages your Thi­nApp appli­ca­tions mak­ing it eas­ier and faster to pro­vide vir­tu­al­ized Win­dows appli­ca­tions to end users. From Hori­zon Admin­is­tra­tion, you can deploy Thi­nApp pack­ages, enti­tle users and groups, track user licenses, and man­age appli­ca­tion updates.

The cou­pling of the Hori­zon Appli­ca­tion Man­ager with Thi­nApp is a great idea, and when I saw today’s announce­ment I got pretty excited. The pos­si­bil­ity to have your own inter­nal appli­ca­tion por­tal pro­vid­ing your end users with self-service installs of vir­tu­al­ized appli­ca­tions is great news and could poten­tially be really use­ful in a great num­ber of organizations.

Sadly my ini­tial excite­ment quickly faded when I real­ized that for now Hori­zon Appli­ca­tion Man­ager is a hosted ser­vice, that requires an on premise con­nec­tor in your infra­struc­ture that sends over a lim­ited set of Active Direc­tory data to enable it to check user account or group access to the appli­ca­tions it offers. The con­nec­tor pro­vides sin­gle sign-on (Ker­beros) func­tion­al­ity for users already authen­ti­cated in your Active Direc­tory and authen­ti­cates the user to the Hori­zon ser­vice using SAML, so the hosted ser­vice never has the AD pass­word. The hosted ser­vice does still needs some infor­ma­tion like samac­count­name, first name, last name, email and a Glob­alUID.

For more details, have a look at Under­stand­ing VMware Hori­zon Appli­ca­tion Man­ager by Eric Sloof.

This also means that users who run a vir­tu­al­ized appli­ca­tion pro­vi­sioned by Hori­zon Appli­ca­tion Man­ager an active inter­net con­nec­tion is required, even if the vir­tu­al­ized appli­ca­tion pack­ages are stored on a local (to the user) file share. Sub­se­quent appli­ca­tion launches does not require an active con­nec­tion, as the appli­ca­tions are copied to the local sys­tem on the ini­tial run. The Hori­zon agents retrieves a lease for the appli­ca­tion, from the Hori­zon ser­vice, for an admin­is­tra­tor con­fig­urable num­ber of days (30 days default) and the end-user can run the appli­ca­tion, with­out con­nect­ing to the Hori­zon ser­vice, until the lease expires or is renewed.

For many orga­ni­za­tions, includ­ing mine, this poses a real prob­lem. “Hand­ing over” Active Direc­tory data to a hosted ser­vice is not some­thing I would want in my envi­ron­ment, espe­cially when our use case would be to pro­vide end users with a self-service appli­ca­tion por­tal for local appli­ca­tions. Other orga­ni­za­tions might look at that dif­fer­ently though, and this might not be a con­cern for all customers.

I under­stand that Hori­zon Appli­ca­tion Man­ager was ini­tially cre­ated for SaaS sce­nar­ios where a hosted authen­ti­ca­tion por­tal makes sense. I also under­stand that this is the first ver­sion that pro­vides inte­gra­tion with Thi­nApp, and this is very much a prod­uct still in devel­op­ment and refinement.

For now, Hori­zon Appli­ca­tion Man­ager does not pro­vide the use case that I was look­ing for but thank­fully Ben Good­man, Lead Evan­ge­list for VMware Hori­zon, has taken the time to address my call for an on-premise ver­sion of Hori­zon Appli­ca­tion Manager:

I under­stand your appre­hen­sion. Hori­zon was built on top of tech­nol­ogy orig­i­nally designed exclu­sively to be a Single-Sign on ser­vice to SaaS appli­ca­tions. We are in the process of expand­ing that tech­nol­ogy to become a true enter­prise ser­vice. This is hap­pen­ing in two ways, the first is by adding appli­ca­tion sup­port beyond SaaS. The first step was Win­dows sup­port via Thi­nApp and we are look­ing at other appli­ca­tion plat­forms to fol­low. The sec­ond is eval­u­at­ing options for mov­ing some or all of prod­uct on-prem. Both of these steps are the pri­mary focus of the devel­op­ment team over the next 12–18 months and we are really excited about where we are tak­ing Horizon.

This is great news, an on-premise ver­sion that pro­vides exactly what I’m look­ing for seems to be in the pipeline and on VMware’s roadmap for Hori­zon Appli­ca­tion Man­ager. I just wish I had it now, it would have been per­fect for a project I’m work­ing on at the moment that I hope to wrap up by the end of the year.

Oh well, there is always next year and the next project!

Chris­t­ian Mohn