Today we are announcing the availability of ThinApp 4.7. VMware is introducing the enablement of ThinApp packages in a cloud-based deployment and management platform, VMware Horizon Application Manager.
This blog post discusses the integration of ThinApp packages with the Horizon 1.2 platform. For more information about the other capabilities of Horizon, see the VMware Horizon Application Manager website. Horizon release 1.2 is being announced on the VMware End User Computing blog site.
Horizon Application Manager provides ThinApp administrators with:
- Dynamic entitlement of users and groups to ThinApp packages
- Secure single sign-on access to a unified application catalog of virtualized Windows applications and SaaS and federated web applications
- A management interface to deploy and entitle your users to ThinApp packages
- Monitoring and reporting options to help you respond to any authentication issues and to be aware of application launches and closures
What is Horizon Application Manager?
What is Horizon, and why would you want to manage ThinApp packages with Horizon? Horizon Application Manager includes the following components:
- Horizon Service
- Horizon Connector
- Active Directory (your own)
- ThinApp Repository (Windows Application Share)
- Horizon Agent
Figure 1: Basic Horizon Application Manager Architecture
This diagram illustrates the relationship of the Horizon Application Manager components. In the cloud is the Horizon Service, hosted by VMware. On premise are the Horizon Connector, the ThinApp Repository (Windows application share), and your own Microsoft Active Directory.
The Horizon Service provides both a user portal and an administration portal. The administrator uses the Horizon console to set up entitlement of users and groups to applications. Horizon entitlement leverages user profile information, without compromising Active Directory credentials. A single secure user ID serves for all applications. The administrator can also monitor and report on application launches and closures and other activities.
The Horizon Service offers users a menu of SaaS and federated web applications, as well as ThinApp virtualized Windows applications. The user logs in to the user portal to activate optional applications from their IT organization, as well as to launch any of the applications they are entitled to. (Users can also access their applications through desktop shortcuts.)
The Horizon Service has many functions, but its main function is to supply entitlement information so users can launch applications.
Figure 2: The Horizon Service
The on-premise Horizon Connector is the interface between the service and the other Horizon components. The connector communicates to the service:
- Information about users and groups from the local Active Directory
- Metadata about ThinApp packages from the ThinApp Repository (Windows application share)
Figure 3: The Horizon Connector and Its Communication Flow
Within your firewall, along with the connector, is the ThinApp Repository, or Windows Application Share. This file share holds the ThinApp packages: the executables and the primary data containers with the virtual file system and virtual registry for each virtualized application.
Your own Active Directory is also a key component of Horizon. Users’ authentication data resides in the Active Directory, and the connector gathers this information to provide user access to ThinApp packages.
The Horizon Agent must be present on each desktop that runs Horizon-enabled ThinApp packages. If the Agent is not already installed on a desktop, the Horizon Service automatically initiates Agent installation when the user tries to launch a Horizon-enabled ThinApp package.
The Horizon Agent has a number of important functions in the Horizon environment:
- Periodically checks with the Horizon Service for package entitlement information
- Downloads and registers entitled ThinApp packages to the user desktop
- Provides users with system-tray access to some Horizon application functions
- Populates the desktop VMware Horizon Applications folder with application shortcuts
How is Horizon entitlement to ThinApp packages different from ThinApp Active Directory or VMware View entitlements?
Entitlement to Horizon-enabled ThinApp packages can be based on Active Directory groups or on groups that you create within Horizon. With ThinApp application virtualization, you normally incorporate entitlement of Active Directory groups when you build the package. But with Horizon, you can dynamically change entitlement without rebuilding the ThinApp package. The administrator changes entitlement to applications through the administration portal. This entitlement change is passed to the Horizon Agent, and the user is automatically affected by the entitlement change when they try to launch the application.
In VMware View, you can entitle organizational units or pools of desktops to ThinApp packages. With Horizon, you entitle Active Directory or Horizon-defined groups.
What is special about Horizon deployment of ThinApp packages?
With ThinApp integration into Horizon Application Manager, VMware is providing a single-vendor solution for the creation and deployment of ThinApp virtualized Windows applications. Prior to this offering, you could deploy ThinApp packages only with your current application deployment solutions or on virtual desktop infrastructures such as VMware View. Now, VMware gives you a platform where you can manage entitlement to and deployment of ThinApp packages in an environment designed for ThinApp success.
With Horizon deployment of ThinApp packages comes participation in the reliability and depth of functionality of the VMware suite of products.
How do you enable a ThinApp package for Horizon?
Horizon enablement of ThinApp packages is very simple. ThinApp 4.7 includes a new window in Setup Capture where you select Manage with VMware Horizon Application Manager.
Figure 4: Manage with Horizon Window in ThinApp Setup Capture
Another field on the same window, Organization URL, allows you to supply your organization’s Horizon Service URL. If the Horizon Agent is not installed on the desktop when the user tries to launch the ThinApp package, this URL leads to the Horizon Service, which will initiate Agent installation.
Because Horizon handles entitlement to ThinApp packages, the Groups window is skipped when you enable an application for Horizon.
Figure 5: Skipped Groups Window in Setup Capture for Horizon-Enabled Applications
You will also notice that when you arrive at the Package Settings window in Setup Capture, the MSI packaging is pre-selected for you. This MSI package is created for possible future use in Horizon.
Figure 6: MSI Package Selection in Setup Capture for Horizon-Enabled Applications
That is all there is to enabling a ThinApp package for Horizon—one Setup Capture window! The rest of enablement is in the code.
What Package.ini changes are there with Horizon enablement?
The new choices in ThinApp Setup Capture for Horizon enablement are reflected in three new Package.ini parameters.
- AppID=genid causes the generation of a random GUID for the ThinApp package. Horizon uses this package identifier for all of its operations: entitlements, activating, downloading, reporting, and so on.
- NotificationDLLs=HorizonPlugin.dll specifies the DLL that the ThinApp runtime calls to check with the Horizon Agent for entitlement to run the application.
- HorizonOrgUrl is the Horizon Service URL for your organization, which you optionally specified in Setup Capture.
In addition, because Setup Capture specifies the creation of an MSI package for the Horizon-enabled application, you will see that most of the MSI parameters in Package.ini are enabled.
Can you update current ThinApp packages to be managed by Horizon?
ThinApp 4.7 is the first version of ThinApp to enable packages for Horizon. To enable a pre-4.7 ThinApp package for use with Horizon Application Manager, you need to recapture and then rebuild your application with ThinApp 4.7. The capture process in 4.7 includes some Horizon enablement beyond what you see, and this would be missing if you skipped recapture. If you want to ensure that the ThinApp package will work properly when managed by Horizon, recapture and rebuild.
What is the user sequence of activities with ThinApp packages in Horizon?
Users open the Horizon user portal to access ThinApp packages that the administrator has entitled them to.
Figure 7: The Home Page of the Horizon Service User Portal
From the home page of the user portal, users can launch any of the applications. Notice that applications virtualized with ThinApp have the ThinApp logo in the upper right corner of the application icon. Other applications in the above screenshot are SaaS or federated web applications, also managed by Horizon, in the same user portal.
The Application Catalog button on the home page of the Horizon user portal takes the user to a list of applications that they can add to their home page. All of the applications listed in the application catalog are ones the user is entitled to.
Figure 8: The Application Catalog in the Horizon User Portal
The administrator can set applications to be activated automatically or by the user. A user can click the Activate button next to an application in the Application Catalog to download the application to their desktop and copy the application entry to their home page for use.
Figure 9: The Activate Button for an Application in the Application Catalog
When the ThinApp package is downloaded, it is also registered to the user desktop—the package gets desktop and Start menu shortcuts, file-type associations, and an entry in Add / Remove Programs.
After the application is downloaded, the user can launch it from the desktop shortcut or from the user portal. Every time the user launches the application, the ThinApp runtime communicates with the Horizon Agent to check entitlement.
With ThinApp 4.7 and Horizon Application Manager 1.2, all virtualized applications are downloaded to the desktop. Streaming mode for ThinApp packages in Horizon is not yet available.
The downloaded ThinApp packages are also available for offline use when users are not connected to the network.
How do you set up Horizon to deploy and manage ThinApp packages?
The administration portal and user portal of the Horizon Service are in the cloud, and the Horizon Connector, Active Directory, and ThinApp Repository, or Windows application share, are on premises. The Horizon Agent is installed on each user desktop.
The Horizon Connector is a virtual appliance that you install at your own site. After a few command-line configurations, you continue with a web-based connector setup wizard. Later on, you can revisit your configurations with the connector web interface. Some of the main configurations for the connector are:
- Set up periodic transfer of information about Active Directory users and groups from the connector to the Horizon Service
- Set up Kerberos for single sign-on
- Specify the location of the ThinApp Repository and schedule synchronization between the connector and the Windows application share
Figure 10: Completed Windows Applications Window of the Connector Setup Wizard
Because the Horizon Service is a hosted cloud service, you have no server-side installation or responsibility. You configure the service through a web interface so that the connector can send information to the service about Active Directory users and groups, as well as about ThinApp packages.
Figure 11: Horizon Service Configuration for Communication with the Connector
You establish a ThinApp Repository on a Windows file share and load the repository with the executables and primary data containers for your virtualized Windows applications.
The Active Directory in your current environment is used by Horizon. You configure a couple of settings to make Active Directory work with Horizon.
Each user desktop must have the Horizon Agent installed. You can use the automatic Agent installation initiated by each user’s first launch of a ThinApp package. Horizon then checks for the Agent, and, if the Agent is not found, the user is prompted through the Agent installation.
After installation and configuration, you use the Horizon Service administration portal to entitle users and groups to applications. You may create Horizon groups, as well as use Active Directory groups.
Figure 12: Entitling Groups and Users to
What keeps your data secure when Horizon manages it in the cloud?
The Horizon Connector sends data to the Horizon Service in the cloud about users and groups in the Active Directory and about ThinApp packages in the repository. The service uses that information to manage entitlement to applications.
VMware secures your data with encryption and multiple layers of authentication. In addition, not all of your data is sent up to the cloud. The data sent from the connector to the service is only a representation of what is in your Active Directory and ThinApp Repository. Instead of sending entire ThinApp packages up to the cloud service, the connector sends only metadata about each package: the application name, icon, and GUID, as well as the path to the application in the ThinApp Repository. And the connector sends data about Active Directory users and groups, but no passwords, up to the service. For more details about Horizon security, ask your field representative for a copy of VMware Horizon Service and Horizon Connector Payload Details.
How can you try Horizon Application Manager 1.2 and ThinApp 4.7?
You can obtain an evaluation copy of Horizon through this link:
The trial copy of Horizon Application Manager allows unlimited use for 90 days, with extended trials available.
An evaluation copy of ThinApp 4.7 is available here:
The evaluation copy of ThinApp 4.7 consists of:
- ThinApp Packager 4.7
- 50 endpoint licenses for your users to run ThinApp virtualized applications
- Workstation 8.0 to set up your application capture and build environment
Remember that you must capture and build your applications in ThinApp 4.7 in order to evaluate ThinApp with Horizon.
What else is new in ThinApp 4.7?
ThinApp 4.7 fixes a number of known issues. Refer to the Resolved Issues section of the ThinApp 4.7 Release Notes.
- ThinApp 4.7 Reviewer’s Guide
- Use this link for a ThinApp 4.7 trial
- ThinApp documentation
- ThinApp Community
- ThinApp Technical Papers
- ThinApp YouTube channel
- ThinApp Blog
- Horizon product information
- Use this communications form to request a Horizon trial
- Horizon documentation
Tina de Benedictis
Technical Marketing Manager, Enterprise Desktop, VMware