Intelligent redirection of authentication devices
Authentication devices can be intelligently redirected in a VDI environment to thereby ensure that the redirected authentication devices remain available for authentication even after a remote session has been locked. This intelligent redirection of authentication devices can be accomplished in a way that only requires server-side modifications and that is agnostic to the remoting protocol used to establish the remote session.
1. A method, implemented by an agent that executes on a server in a virtual desktop infrastructure environment, for intelligently redirecting an authentication device, the method comprising:
in conjunction with redirecting an authentication device from a client device to the server to allow the authentication device to be accessed by applications executing within a remote session on the server, registering with an operating system on the server to receive notifications of state changes of the remote session;
receiving, from the operating system, a notification that the remote session has been locked;
in response to the notification that the remote session has been locked, instructing a client-side proxy to cause the authentication device to no longer be redirected to the server but to be connected locally at the client device to thereby allow the authentication device to be used on the client device to unlock the remote session; and
in response to the remote session being unlocked, causing the authentication device to again be redirected from the client device to the server.
2. The method of claim 1 , further comprising:
in conjunction with instructing the client-side proxy to cause the authentication device to no longer be redirected to the server, instructing a virtual bus driver on the server to cause the authentication device to be disconnected from the remote session.
3. The method of claim 1 , further comprising:
in conjunction with instructing the client-side proxy to cause the authentication device to no longer be redirected to the server, instructing a virtual bus driver on the server to pause I/O requests targeting the authentication device without causing the authentication device to be disconnected from the remote session.
4. The method of claim 1 , wherein the authentication device comprises a smart card.
5. The method of claim 4 , wherein instructing a virtual bus driver on the server to pause I/O requests targeting the authentication device without causing the authentication device to be disconnected from the remote session comprises instructing the virtual bus driver to retain a device object pertaining to the authentication device.
6. The method of claim 4 , further comprising:
prior to causing the authentication device to again be redirected from the client device to the server, verifying that the authentication device is again being redirected from the same client device for access within the same remote session.
7. The method of claim 1 , wherein the authentication device comprises a smart card.
8. The method of claim 1 , wherein causing the authentication device to again be redirected from the client device to the server in response to the remote session being unlocked comprises:
notifying the client-side proxy that the remote session has been unlocked.
9. A method, implemented in a virtual desktop infrastructure environment, for intelligently redirecting an authentication device, the method comprising:
in response to an authentication device being connected to a client device while the client device has established a remote session on a server, redirecting the authentication device to the server to enable the authentication device to be accessed by an application executing within the remote session;
registering, by an agent executing on the server and with an operating system on the server, to receive notifications of state changes of the remote session;
receiving, by the agent and from the operating system, a notification of a state change of the remote session, the notification being received while the authentication device is redirected to the server;
determining that the notification of the state change indicates that the remote session has been locked;
sending, by the agent, a notification that instructs a proxy executing on the client device to cease the redirection of the authentication device;
in response to the notification received from the agent, causing, by the proxy, the authentication device to be locally connected to the client device rather than being redirected to the server, thereby allowing the authentication device to be used on the client device to unlock the remote session; and
in response to the remote session being unlocked, causing the authentication device to again be redirected from the client device to the server.
10. The method of claim 9 , further comprising:
in conjunction with sending the notification to the proxy, instructing, by the agent, a virtual bus driver on the server to cause the authentication device to be disconnected from the remote session.
11. The method of claim 9 , further comprising:
in conjunction with sending the notification to the proxy, instructing, by the agent, a virtual bus driver on the server to pause I/O requests targeting the authentication device without causing the authentication device to be disconnected from the remote session.
12. The method of claim 11 , wherein the authentication device comprises a smart card.
13. The method of claim 11 , wherein instructing a virtual bus driver on the server to pause I/O requests targeting the authentication device without causing the authentication device to be disconnected from the remote session comprises instructing the virtual bus driver to retain a device object pertaining to the authentication device.
14. The method of claim 9 , further comprising:
in conjunction with sending the notification to the proxy, instructing, by the agent, a virtual bus driver on the server to pause I/O requests targeting the authentication device without causing the authentication device to be disconnected from the remote session; and
in response to the authentication device being again redirected from the client device to the server, resuming I/O requests targeting the authentication device.
15. One or more computer storage media storing computer-executable instructions which when executed by one or more processors implement a method for intelligently redirecting an authentication device, the method comprising:
in response to an authentication device being connected to a client device while the client device has established a remote session on a server, redirecting the authentication device to the server to enable the authentication device to be accessed by an application executing within the remote session;
registering, by an agent executing on the server and with an operating system on the server, to receive notifications of state changes of the remote session;
receiving, by the agent and from the operating system, a notification of a state change of the remote session, the notification being received while the authentication device is redirected to the server;
determining that the notification of the state change indicates that the remote session has been locked;
sending, by the agent, a notification that instructs a proxy executing on the client device to cease the redirection of the authentication device;
in response to the notification received from the agent, causing, by the proxy, the authentication device to be locally connected to the client device rather than being redirected to the server, thereby allowing the authentication device to be used on the client device to unlock the remote session;
while the authentication device is locally connected to the client device, employing the authentication device to provide authentication information for unlocking the remote session; and
in response to the remote session being unlocked, again redirecting the authentication device to the server.
16. The computer storage media of claim 15 , wherein the authentication device comprises a smart card.
17. The computer storage media of claim 15 , wherein redirecting the authentication device to the server comprises causing a device object to be created on the server to represent the authentication device; and
wherein again redirecting the authentication device to the server comprises using the same device object.
18. The computer storage media of claim 17 , wherein the method further comprises:
in conjunction with sending the notification that instructs the proxy executing on the client device to cease the redirection of the authentication device, instructing a virtual bus driver on the server to disconnect the authentication device from the remote session.