AWS workspaces-thin-client documentation change
Summary
Added new known issue 'Disconnected from your AppStream 2.0 session' with workaround instructions and updated FIDO2 authentication documentation with clarifications on supported hardware, PIN requirements, and usage limitations
Security assessment
The FIDO2 documentation updates clarify security-related authentication mechanisms (e.g., explicit support for YubiKey 5 series, cross-origin restrictions), which helps users avoid misconfiguration. However, these are documentation refinements rather than fixes for vulnerabilities. The new AppStream disconnection issue describes a UI flaw without security implications.
Diff
diff --git a/workspaces-thin-client/latest/ug/known-issues.md b/workspaces-thin-client/latest/ug/known-issues.md index 5a60dae0f..d6a25e29a 100644 --- a//workspaces-thin-client/latest/ug/known-issues.md +++ b//workspaces-thin-client/latest/ug/known-issues.md @@ -5 +5 @@ -If you select any link on the VDI login screen, you must return to the login screen.Using keyboard shortcuts may cause unexpected behavior.Some peripherals may not be recognized when the device is running.You cannot view the IP address of the Ethernet network from settings.Some menu options in the VDI toolbar are displayed but not working.You cannot find a supported keyboard layout in the OOBE or settings.You can select a supported keyboard layout in device settings, but you cannot enter the specific keys within the virtual session.Toolbar does not expand or collapse when you select it for the first time.On waking up from sleep, WorkSpaces Thin Client device shows the keyboard and mouse setup screen for a few seconds before launching the session.On the restart of a WorkSpaces Thin Client device, end users will see repeated Getting Ready and Checking for updates transition screens before launching the session.Updates for the WorkSpaces Thin Client device are not taking effect.The webcam is not enabled in WorkSpaces and its icon in the top toolbar remains gray.4K monitor not at full resolutionWorkSpaces Thin Client Packet Loss notification.Keyboard power operation is not correct in device settingsHeadset volume change not reflected in device settingsScreen shows multiple updating screen fragments after resetNetwork icon opening Accessibility settingsServer error code 1001 during setupFIDO2 pre-session details +If you select any link on the VDI login screen, you must return to the login screen.Using keyboard shortcuts may cause unexpected behavior.Some peripherals may not be recognized when the device is running.You cannot view the IP address of the Ethernet network from settings.Some menu options in the VDI toolbar are displayed but not working.You cannot find a supported keyboard layout in the OOBE or settings.You can select a supported keyboard layout in device settings, but you cannot enter the specific keys within the virtual session.Toolbar does not expand or collapse when you select it for the first time.On waking up from sleep, WorkSpaces Thin Client device shows the keyboard and mouse setup screen for a few seconds before launching the session.On the restart of a WorkSpaces Thin Client device, end users will see repeated Getting Ready and Checking for updates transition screens before launching the session.Updates for the WorkSpaces Thin Client device are not taking effect.The webcam is not enabled in WorkSpaces and its icon in the top toolbar remains gray.4K monitor not at full resolutionWorkSpaces Thin Client Packet Loss notification.Keyboard power operation is not correct in device settingsHeadset volume change not reflected in device settingsScreen shows multiple updating screen fragments after resetNetwork icon opening Accessibility settingsServer error code 1001 during setupFIDO2 pre-session detailsDisconnected from your AppStream 2.0 session @@ -141 +141 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Only Yubi 5 series with USB security key is supported with FIDO2/WebAuthn supported. + * Only Yubico YubiKey 5 series USB security keys are supported with FIDO2/WebAuthn supported. @@ -143 +143 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Yubi bio-metric keys are not supported. + * Yubico YubiKey bio-metric keys are not supported. @@ -145 +145 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Registration flow with UserVerification=Required that requires PIN creation is not supported. However if a PIN is already set on the USB security key then it is supported. + * Registration flow requiring new PIN creation (i.e. `userVerification` set to `required`) is not supported. However if a PIN was previously set on the USB security key then it is supported. @@ -147 +147 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Cross-Origin webauthn credential creation is not supported. + * Cross-origin WebAuthn credential creation is not supported. @@ -151 +151 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Origin must use https scheme. Origin with ports are not supported (E.g: https//example.com:8443). + * Origin must use https scheme. Origin with ports are not supported (e.g: `https//example.com:8443`). @@ -153 +153 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Recommend using only one USB security key connected to WorkSpaces Thin Client. Multiple USB security connected simultaneously is not supported. + * Only one USB security key can be connected at a time to the Amazon WorkSpaces Thin Client. Multiple USB security keys connected simultaneously is not supported. @@ -155 +155,20 @@ The FIDO2 feature is in a prerelease state and has some limitations to its use. - * Translations for non-english languages on the UI dialogs is not present in this initial release. + + + +## Disconnected from your AppStream 2.0 session + +When **Disconnect** on the toolbar is selected, you'll see a sign out page. This could be the regular AppStream 2.0 sign out page or a custom page your administrator set up. After signing out, the **Sign In** button is missing from both the toolbar and the sign out page. + +**Workaround:** + +Do one of the following: + + * Restart the WorkSpaces Thin Client device. + + * Unlock the AppStream 2.0 session by doing the following: + + 1. Select the **Lock** button on the AppStream 2.0 toolbar. The **Lock** page appears. + + 2. Select **Unlock**. The sign on page appears. + + 3. Sign in to start the session again.