IDmelon Agent

IDmelon Agent
IDmelon Agent delivers simple, fast, and secure sign-ins to virtual desktops and cloud apps using employee badges, smartphones, biometrics, or security keys. It automates sign-in, session launch, and user switching for Microsoft, Citrix, and VMware environments.

The agent supports two modes:

• VDI Mode: For virtual desktop environments such as Citrix and Horizon.
• Kiosk Mode: For Microsoft Entra ID sign-in to cloud apps, followed by opening the configured URL after successful authentication. Ideal for shared, multi-user environments such as retail, healthcare, manufacturing, and education, where Tap-to-Login and Tap-to-Logout keep sessions secure and prevent them from being left open.

Supported Platforms #

• Windows 10 and 11
• Linux Ubuntu 22.04 and later
• IGEL OS 12
• Dell ThinOS 2508

App Configuration #

On Windows and Linux, open the app menu and select Configuration.

Agent Mode #

Use Agent Mode to choose how the device will be used.

Changing the mode is possible from agent settings and the drop-down menu in configuration. This restarts the app so the new flow can load.

Badge Reader Mode #

The agent can read badges directly from PC/SC NFC and rfIDEAS readers. If your reader sends badge IDs as keyboard input, enable Keystroking Mode from the app menu.

On Windows, if IDmelon Accesskey is installed and running, the agent also receives badge taps from Accesskey. No configuration is needed.

If the badge ID is read in the wrong order, enable Reverse Byte Order.

Shared Configuration Fields #

• Workspace ID: Optional. Use this when requests should be scoped to a specific IDmelon workspace.
• API Key: Optional. Required only when your workspace enforces authenticated clients (Admin Panel > Authentication > API Key Management (API Key Type: Clients)).
• Base URL: Optional. Use this for on-premise environments.
• Self-Service URL: Optional. The self-service enrollment portal opened in-app when a tapped badge is not enrolled yet. See Self-Service Badge Enrollment.

Self-Service Badge Enrollment #

When a user taps a badge that is not enrolled yet, the agent can open your self-service enrollment portal in an in-app window. The user enrolls the badge on the spot and then taps again to sign in.

This works the same way in VDI Mode and Kiosk Mode.

For background on the enrollment flow itself, see Self-Service Enrollment Flow.

The Self-Service URL in the agent must be configured for this to work.

Agent Configuration #

First, get the address of your self-service enrollment page from the IDmelon Admin Panel.

On the IDmelon Admin Panel, navigate to Security keys and select the blue button named Workflows on the top-right side. Choose Self-Service actions, and copy the generated URL:

Security keys > Workflows > Self-Service actions

Then set Self-Service URL to that address.

• On Windows and Linux, open the app menu, select Configuration, and fill in Self-Service URL.
• On IGEL OS, set it from IGEL Setup > Apps > IDmelon Agent > Agent Settings > Self-Service URL.

This field is optional. If you leave it empty, an unenrolled badge shows the This badge is not enrolled. error as before.

Self-Service Enrollment User Experience #

1. The user taps a badge that is not enrolled.
2. The agent opens the self-service portal in an in-app window titled Enroll your badge.
3. The user completes the enrollment steps on the portal.
4. The user selects Back to Home to close the enrollment window. This also works as a cancel, if the user decides not to enroll.
5. The agent returns to the tap screen. The user taps the badge again to sign in.

Note: Badge taps are ignored while the enrollment window is open.

VDI Mode #

Use VDI Mode when the device should launch a virtual desktop session after the user taps their badge.

Supported VDI Providers #

• Citrix
• Omnissa Horizon (VMware Horizon)

Note: To use a VDI provider, install the matching client on the device first: Citrix Workspace App for Citrix, or Omnissa Horizon Client for Horizon.

VDI Configuration #

Select the provider from the app menu:

• Citrix
• Horizon

Configure the provider settings:

• HTTPS Only: Set to False only if your provider environment uses HTTP or a self-signed certificate.
• Citrix URL: The base URL of your Citrix environment.
• Citrix Path: The Citrix StoreFront virtual path, such as /Citrix/[StoreName]. For more information
• Citrix Client Version: The Citrix Workspace App version installed on the device. Use 9909 on Linux.
• VMware URL: The base URL of your Horizon environment.
• VMware Path: Leave this value as /.

VDI User Experience #

When the app opens in VDI Mode, the user sees the tap screen.

The user taps their badge on the reader. If a PIN is required, the agent asks for it before continuing.

After the badge is verified, the agent completes the passkey sign-in flow and launches the configured Citrix or Horizon desktop.

After the remote session is active, the user can tap the badge again to disconnect from the session. If an application in the virtual desktop is listening for badge taps through the IDmelon VDI Bridge, the tap is sent to that application instead and the session stays open. See Badge Taps in the Virtual Desktop.

Alternatively, use Disconnect from the app menu.

Auto-Launch for a Single Desktop #

On Omnissa Horizon, if the signed-in user is entitled to exactly one desktop, the agent starts that desktop directly instead of leaving the user on the Horizon client’s desktop list.

If the user is entitled to more than one desktop, the Horizon client opens its desktop list as usual and the user picks one.

This behavior is automatic and requires no configuration. It applies to Horizon only; Citrix sessions are not affected.

Badge Taps in the Virtual Desktop #

The IDmelon VDI Bridge is installed together with the agent on Windows, Linux, and IGEL OS. It carries badge taps from the endpoint into the Citrix or Horizon session, so applications running inside the virtual desktop can react to them.

To receive taps, the virtual desktop must run the IDmelon VDI Session app, and at least one application in the session must be connected to it.

After a successful sign-in, the agent waits for the session to start. As soon as an application in the session is connected to the IDmelon VDI Session app, the agent sends the badge used for sign-in into the session once.

When the user taps a badge while the session is active:

• An application in the session is connected: The tap is sent into the session and the session stays open.
• No application is connected, or the VDI Bridge is unavailable: The tap disconnects the session, as in earlier versions.

Note: If the VDI Bridge is not installed or not reachable, the agent works as before. Sign-in and the second-tap disconnect are not affected.

SSO Integration with IDmelon #

To support passwordless login, first integrate your VDI provider with IDmelon SSO.

App Integration Guides

Enabling Passkey Login mode #

Enable Default Provider and Auto-Start Login with Passkey from the IDmelon Admin Panel:

Authentication > Authentication Profile > Managed Authentication Configuration > Default Provider

Authentication > Authentication Profile > Managed Authentication Configuration > Auto-Start Login with Passkey

Kiosk Mode #

Use Kiosk Mode when the device is shared by multiple users and should open a browser-based workspace after badge sign-in. The Kiosk URL does not control the authentication flow. The agent always uses the Microsoft Entra ID login process first, then loads the configured URL after successful authentication.

Supported Platforms #

• Microsoft Entra ID login using passkeys
• Microsoft apps such as MyApps, Outlook, and Teams
• Any other website that uses Microsoft SSO login.

Kiosk Configuration #

• Kiosk URL: The URL to open after successful Microsoft Entra ID authentication. This URL is the post-login destination, not the login provider.

Kiosk User Experience #

In Kiosk Mode, the user follows the same tap card, enter PIN, and loading process as VDI Mode. The agent signs the user in through the Microsoft Entra ID login process with IDmelon passkey authentication, and after authentication succeeds, it loads the configured Kiosk URL.

When the user is finished, they tap the badge again or select End Session from the app menu. The agent clears the browser session and returns to the tap screen for the next user.

IGEL #

On IGEL OS, settings are managed from the IGEL profile instead of the local app menu.

Open the configuration from:

IGEL Setup > Apps > IDmelon Agent > Agent Settings

The app menu on IGEL is read-only for settings. It shows the current mode, provider, and reader state, and still allows users to disconnect or exit.