diff -Nru gnome-shell-3.28.4/debian/changelog gnome-shell-3.28.4/debian/changelog
--- gnome-shell-3.28.4/debian/changelog	2019-10-25 16:23:08.000000000 +1300
+++ gnome-shell-3.28.4/debian/changelog	2020-08-31 14:44:08.000000000 +1200
@@ -1,3 +1,14 @@
+gnome-shell (3.28.4-0ubuntu18.04.4) bionic; urgency=medium
+
+  * d/p/lp-1886592-gdm-refactor-oVirt-sso.patch:
+  * d/p/lp-1886592-gdm-enable-vmware-sso.patch:
+  * d/p/lp-1886592-gdm-fixup-oVirt-service-name.patch:  
+  * d/p/lp-1886592-gdm-fixup-VMware-service-name.patch:
+    - Enable support for VMware Horizon SSO to ensure compatibility
+      with the Horizon Agent (LP: #1886592)
+
+ -- Matthew Ruffell <matthew.ruffell@canonical.com>  Mon, 31 Aug 2020 14:44:08 +1200
+
 gnome-shell (3.28.4-0ubuntu18.04.3) bionic; urgency=medium
 
   * d/p/ubuntu/search-call-XUbuntuCancel-method-on-providers-when-no-dat.patch:
diff -Nru gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-enable-vmware-sso.patch gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-enable-vmware-sso.patch
--- gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-enable-vmware-sso.patch	1970-01-01 12:00:00.000000000 +1200
+++ gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-enable-vmware-sso.patch	2020-08-31 14:42:27.000000000 +1200
@@ -0,0 +1,102 @@
+Description: gdm: Introduce vmware credential manager for pre-authenticated logins
+Author: yun341 <5933468@qq.com>
+From: Matthew Ruffell <matthew.ruffell@canonical.com>
+Origin: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/4ea0fca4fc09ffd6e0b6994ee1354f07f7d5d2b5
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1886592
+Bug-GNOME: https://gitlab.gnome.org/GNOME/gnome-shell/issues/1983
+Bug-GNOME-Merge: https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/915
+
+Index: gnome-shell-3.28.4/js/gdm/util.js
+===================================================================
+--- gnome-shell-3.28.4.orig/js/gdm/util.js
++++ gnome-shell-3.28.4/js/gdm/util.js
+@@ -11,6 +11,7 @@ const St = imports.gi.St;
+ const Batch = imports.gdm.batch;
+ const Fprint = imports.gdm.fingerprint;
+ const OVirt = imports.gdm.oVirt;
++const Vmware = imports.gdm.vmware;
+ const Main = imports.ui.main;
+ const Params = imports.misc.params;
+ const ShellEntry = imports.ui.shellEntry;
+@@ -159,6 +160,7 @@ var ShellUserVerifier = new Lang.Class({
+ 
+         this._credentialManagers = {};
+         this._credentialManagers[OVirt.SERVICE_NAME] = OVirt.getOVirtCredentialsManager();
++        this._credentialManagers[Vmware.SERVICE_NAME] = Vmware.getVmwareCredentialsManager();
+ 
+         for (let service in this._credentialManagers) {
+             if (this._credentialManagers[service].token) {
+Index: gnome-shell-3.28.4/js/gdm/vmware.js
+===================================================================
+--- /dev/null
++++ gnome-shell-3.28.4/js/gdm/vmware.js
+@@ -0,0 +1,57 @@
++// -*- mode: js; js-indent-level: 4; indent-tabs-mode: nil -*-
++/* exported getVmwareCredentialsManager */
++
++const Gio = imports.gi.Gio;
++const Lang = imports.lang;
++const Signals = imports.signals;
++const Credential = imports.gdm.credentialManager;
++
++const dbusPath = '/org/vmware/viewagent/Credentials';
++const dbusInterface = 'org.vmware.viewagent.Credentials';
++
++var SERVICE_NAME = 'gdm-vmwcred';
++
++const VmwareCredentialsIface = '<node> \
++<interface name="' + dbusInterface + '"> \
++<signal name="UserAuthenticated"> \
++    <arg type="s" name="token"/> \
++</signal> \
++</interface> \
++</node>';
++
++
++const VmwareCredentialsInfo = Gio.DBusInterfaceInfo.new_for_xml(VmwareCredentialsIface);
++
++let _vmwareCredentialsManager = null;
++
++function VmwareCredentials() {
++    var self = new Gio.DBusProxy({ g_connection: Gio.DBus.session,
++                                   g_interface_name: VmwareCredentialsInfo.name,
++                                   g_interface_info: VmwareCredentialsInfo,
++                                   g_name: dbusInterface,
++                                   g_object_path: dbusPath,
++                                   g_flags: Gio.DBusProxyFlags.DO_NOT_LOAD_PROPERTIES });
++    self.init(null);
++    return self;
++}
++
++var VmwareCredentialsManager = new Lang.Class({
++    Name: 'VmwareCredentialsManager',
++    Extends: Credential.CredentialManager,
++    _init() {
++        this.parent(SERVICE_NAME);
++        this._credentials = new VmwareCredentials();
++        this._credentials.connectSignal('UserAuthenticated',
++            (proxy, sender, [token]) => {
++                this.token = token;
++            });
++    }
++});
++Signals.addSignalMethods(VmwareCredentialsManager.prototype);
++
++function getVmwareCredentialsManager() {
++    if (!_vmwareCredentialsManager)
++        _vmwareCredentialsManager = new VmwareCredentialsManager();
++
++    return _vmwareCredentialsManager;
++}
+Index: gnome-shell-3.28.4/js/js-resources.gresource.xml
+===================================================================
+--- gnome-shell-3.28.4.orig/js/js-resources.gresource.xml
++++ gnome-shell-3.28.4/js/js-resources.gresource.xml
+@@ -7,6 +7,7 @@
+     <file>gdm/loginDialog.js</file>
+     <file>gdm/oVirt.js</file>
+     <file>gdm/credentialManager.js</file>
++    <file>gdm/vmware.js</file>
+     <file>gdm/realmd.js</file>
+     <file>gdm/util.js</file>
+ 
diff -Nru gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-oVirt-service-name.patch gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-oVirt-service-name.patch
--- gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-oVirt-service-name.patch	1970-01-01 12:00:00.000000000 +1200
+++ gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-oVirt-service-name.patch	2020-08-31 14:43:43.000000000 +1200
@@ -0,0 +1,34 @@
+Description: authPrompt: Properly get oVirt service name
+Author: Andre Moreira Magalhaes <andre@endlessm.com>
+From: Matthew Ruffell <matthew.ruffell@canonical.com>
+Origin: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/00437750ed9c7e0982854e20be8c36c6bda7b254
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1886592
+Bug-GNOME-Merge: https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1414
+
+Index: gnome-shell-3.28.4/js/gdm/authPrompt.js
+===================================================================
+--- gnome-shell-3.28.4.orig/js/gdm/authPrompt.js	2020-08-31 14:42:43.981312188 +1200
++++ gnome-shell-3.28.4/js/gdm/authPrompt.js	2020-08-31 14:42:43.977312139 +1200
+@@ -10,11 +10,13 @@
+ const Animation = imports.ui.animation;
+ const Batch = imports.gdm.batch;
+ const GdmUtil = imports.gdm.util;
++const OVirt = imports.gdm.oVirt;
+ const Params = imports.misc.params;
+ const Shell = imports.gi.Shell;
+ const ShellEntry = imports.ui.shellEntry;
+ const Tweener = imports.ui.tweener;
+ const UserWidget = imports.ui.userWidget;
++const Util = imports.misc.util;
+ 
+ var DEFAULT_BUTTON_WELL_ICON_SIZE = 16;
+ var DEFAULT_BUTTON_WELL_ANIMATION_DELAY = 1.0;
+@@ -460,7 +462,7 @@
+             // The user is constant at the unlock screen, so it will immediately
+             // respond to the request with the username
+             beginRequestType = BeginRequestType.PROVIDE_USERNAME;
+-        } else if (this._userVerifier.serviceIsForeground(GdmUtil.OVIRT_SERVICE_NAME) ||
++        } else if (this._userVerifier.serviceIsForeground(OVirt.SERVICE_NAME) ||
+                    this._userVerifier.serviceIsForeground(GdmUtil.SMARTCARD_SERVICE_NAME)) {
+             // We don't need to know the username if the user preempted the login screen
+             // with a smartcard or with preauthenticated oVirt credentials
diff -Nru gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-VMware-service-name.patch gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-VMware-service-name.patch
--- gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-VMware-service-name.patch	1970-01-01 12:00:00.000000000 +1200
+++ gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-fixup-VMware-service-name.patch	2020-08-31 14:44:08.000000000 +1200
@@ -0,0 +1,30 @@
+Description: authPrompt: set value of beginRequestType to 'DONT_PROVIDE_USERNAME'
+Author: yun341 <5933468@qq.com>
+From: Matthew Ruffell <matthew.ruffell@canonical.com>
+Origin: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/3fb321fd214469130539e1e31461257a749bff21
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1886592
+Bug-GNOME-Merge: https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/1443
+---
+ js/gdm/authPrompt.js | 2 ++
+ 1 file changed, 2 insertions(+)
+
+Index: gnome-shell-3.28.4/js/gdm/authPrompt.js
+===================================================================
+--- gnome-shell-3.28.4.orig/js/gdm/authPrompt.js
++++ gnome-shell-3.28.4/js/gdm/authPrompt.js
+@@ -11,6 +11,7 @@ const Animation = imports.ui.animation;
+ const Batch = imports.gdm.batch;
+ const GdmUtil = imports.gdm.util;
+ const OVirt = imports.gdm.oVirt;
++const Vmware = imports.gdm.vmware;
+ const Params = imports.misc.params;
+ const Shell = imports.gi.Shell;
+ const ShellEntry = imports.ui.shellEntry;
+@@ -463,6 +464,7 @@ var AuthPrompt = new Lang.Class({
+             // respond to the request with the username
+             beginRequestType = BeginRequestType.PROVIDE_USERNAME;
+         } else if (this._userVerifier.serviceIsForeground(OVirt.SERVICE_NAME) ||
++                   this._userVerifier.serviceIsForeground(Vmware.SERVICE_NAME) ||
+                    this._userVerifier.serviceIsForeground(GdmUtil.SMARTCARD_SERVICE_NAME)) {
+             // We don't need to know the username if the user preempted the login screen
+             // with a smartcard or with preauthenticated oVirt credentials
diff -Nru gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-refactor-oVirt-sso.patch gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-refactor-oVirt-sso.patch
--- gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-refactor-oVirt-sso.patch	1970-01-01 12:00:00.000000000 +1200
+++ gnome-shell-3.28.4/debian/patches/lp-1886592-gdm-refactor-oVirt-sso.patch	2020-08-31 14:42:15.000000000 +1200
@@ -0,0 +1,217 @@
+Description: gdm: Refactor oVirt to a generic CredentialManager interface
+Author: yun341 <5933468@qq.com>
+From: Matthew Ruffell <matthew.ruffell@canonical.com>
+Origin: https://gitlab.gnome.org/GNOME/gnome-shell/-/commit/809f820cd4a4eebb120ab5dde3f1985d35bcb540
+Bug-Ubuntu: https://bugs.launchpad.net/bugs/1886592
+Bug-GNOME: https://gitlab.gnome.org/GNOME/gnome-shell/issues/1983
+Bug-GNOME-Merge: https://gitlab.gnome.org/GNOME/gnome-shell/-/merge_requests/915
+
+Index: gnome-shell-3.28.4/js/gdm/authPrompt.js
+===================================================================
+--- gnome-shell-3.28.4.orig/js/gdm/authPrompt.js
++++ gnome-shell-3.28.4/js/gdm/authPrompt.js
+@@ -62,7 +62,7 @@ var AuthPrompt = new Lang.Class({
+         this._userVerifier.connect('verification-complete', this._onVerificationComplete.bind(this));
+         this._userVerifier.connect('reset', this._onReset.bind(this));
+         this._userVerifier.connect('smartcard-status-changed', this._onSmartcardStatusChanged.bind(this));
+-        this._userVerifier.connect('ovirt-user-authenticated', this._onOVirtUserAuthenticated.bind(this));
++        this._userVerifier.connect('credential-manager-authenticated', this._onCredentialManagerAuthenticated.bind(this));
+         this.smartcardDetected = this._userVerifier.smartcardDetected;
+ 
+         this.connect('next', () => {
+@@ -214,7 +214,7 @@ var AuthPrompt = new Lang.Class({
+         this.emit('prompted');
+     },
+ 
+-    _onOVirtUserAuthenticated() {
++    _onCredentialManagerAuthenticated() {
+         if (this.verificationStatus != AuthPromptStatus.VERIFICATION_SUCCEEDED)
+             this.reset();
+     },
+Index: gnome-shell-3.28.4/js/gdm/credentialManager.js
+===================================================================
+--- /dev/null
++++ gnome-shell-3.28.4/js/gdm/credentialManager.js
+@@ -0,0 +1,28 @@
++// -*- mode: js; js-indent-level: 4; indent-tabs-mode: nil -*-
++/* exported CredentialManager */
++
++const Lang = imports.lang;
++
++var CredentialManager = new Lang.Class({
++    Name: 'CredentialManager',
++
++    _init(service) {
++        this._token = null;
++        this._service = service;
++        this._authenticatedSignalId = null;
++    },
++
++    get token() {
++        return this._token;
++    },
++
++    set token(t) {
++        this._token = t;
++        if (this._token)
++            this.emit('user-authenticated', this._token);
++    },
++
++    get service() {
++        return this._service;
++    }
++});
+Index: gnome-shell-3.28.4/js/gdm/oVirt.js
+===================================================================
+--- gnome-shell-3.28.4.orig/js/gdm/oVirt.js
++++ gnome-shell-3.28.4/js/gdm/oVirt.js
+@@ -3,6 +3,9 @@
+ const Gio = imports.gi.Gio;
+ const Lang = imports.lang;
+ const Signals = imports.signals;
++const Credential = imports.gdm.credentialManager;
++
++var SERVICE_NAME = 'gdm-ovirtcred';
+ 
+ const OVirtCredentialsIface = '<node> \
+ <interface name="org.ovirt.vdsm.Credentials"> \
+@@ -29,29 +32,14 @@ function OVirtCredentials() {
+ 
+ var OVirtCredentialsManager = new Lang.Class({
+     Name: 'OVirtCredentialsManager',
++    Extends: Credential.CredentialManager,
+     _init() {
+-        this._token = null;
+-
++        this.parent(SERVICE_NAME);
+         this._credentials = new OVirtCredentials();
+         this._credentials.connectSignal('UserAuthenticated',
+-                                        this._onUserAuthenticated.bind(this));
+-    },
+-
+-    _onUserAuthenticated(proxy, sender, [token]) {
+-        this._token = token;
+-        this.emit('user-authenticated', token);
+-    },
+-
+-    hasToken() {
+-        return this._token != null;
+-    },
+-
+-    getToken() {
+-        return this._token;
+-    },
+-
+-    resetToken() {
+-        this._token = null;
++            (proxy, sender, [token]) => {
++                this.token = token;
++            });
+     }
+ });
+ Signals.addSignalMethods(OVirtCredentialsManager.prototype);
+Index: gnome-shell-3.28.4/js/gdm/util.js
+===================================================================
+--- gnome-shell-3.28.4.orig/js/gdm/util.js
++++ gnome-shell-3.28.4/js/gdm/util.js
+@@ -20,7 +20,6 @@ const Tweener = imports.ui.tweener;
+ var PASSWORD_SERVICE_NAME = 'gdm-password';
+ var FINGERPRINT_SERVICE_NAME = 'gdm-fingerprint';
+ var SMARTCARD_SERVICE_NAME = 'gdm-smartcard';
+-var OVIRT_SERVICE_NAME = 'gdm-ovirtcred';
+ var FADE_ANIMATION_TIME = 0.16;
+ var CLONE_FADE_ANIMATION_TIME = 0.25;
+ 
+@@ -158,13 +157,19 @@ var ShellUserVerifier = new Lang.Class({
+ 
+         this._failCounter = 0;
+ 
+-        this._oVirtCredentialsManager = OVirt.getOVirtCredentialsManager();
++        this._credentialManagers = {};
++        this._credentialManagers[OVirt.SERVICE_NAME] = OVirt.getOVirtCredentialsManager();
+ 
+-        if (this._oVirtCredentialsManager.hasToken())
+-            this._oVirtUserAuthenticated(this._oVirtCredentialsManager.getToken());
++        for (let service in this._credentialManagers) {
++            if (this._credentialManagers[service].token) {
++                this._onCredentialManagerAuthenticated(this._credentialManagers[service],
++                    this._credentialManagers[service].token);
++            }
+ 
+-        this._oVirtUserAuthenticatedId = this._oVirtCredentialsManager.connect('user-authenticated',
+-                                                                               this._oVirtUserAuthenticated.bind(this));
++            this._credentialManagers[service]._authenticatedSignalId =
++                this._credentialManagers[service].connect('user-authenticated',
++                                                          this._onCredentialManagerAuthenticated.bind(this));
++        }
+     },
+ 
+     begin(userName, hold) {
+@@ -222,8 +227,11 @@ var ShellUserVerifier = new Lang.Class({
+         this._smartcardManager.disconnect(this._smartcardRemovedId);
+         this._smartcardManager = null;
+ 
+-        this._oVirtCredentialsManager.disconnect(this._oVirtUserAuthenticatedId);
+-        this._oVirtCredentialsManager = null;
++        for (let service in this._credentialManagers) {
++            let credentialManager = this._credentialManagers[service];
++            credentialManager.disconnect(credentialManager._authenticatedSignalId);
++            credentialManager = null;
++        }
+     },
+ 
+     answerQuery(serviceName, answer) {
+@@ -311,9 +319,9 @@ var ShellUserVerifier = new Lang.Class({
+             });
+     },
+ 
+-    _oVirtUserAuthenticated(token) {
+-        this._preemptingService = OVIRT_SERVICE_NAME;
+-        this.emit('ovirt-user-authenticated');
++    _onCredentialManagerAuthenticated(credentialManager, _token) {
++        this._preemptingService = credentialManager.service;
++        this.emit('credential-manager-authenticated');
+     },
+ 
+     _checkForSmartcard() {
+@@ -501,9 +509,12 @@ var ShellUserVerifier = new Lang.Class({
+         if (!this.serviceIsForeground(serviceName))
+             return;
+ 
+-        if (serviceName == OVIRT_SERVICE_NAME) {
+-            // The only question asked by this service is "Token?"
+-            this.answerQuery(serviceName, this._oVirtCredentialsManager.getToken());
++        let token = null;
++        if (this._credentialManagers[serviceName])
++            token = this._credentialManagers[serviceName].token;
++
++        if (token) {
++            this.answerQuery(serviceName, token);
+             return;
+         }
+ 
+@@ -570,8 +581,10 @@ var ShellUserVerifier = new Lang.Class({
+         // If the login failed with the preauthenticated oVirt credentials
+         // then discard the credentials and revert to default authentication
+         // mechanism.
+-        if (this.serviceIsForeground(OVIRT_SERVICE_NAME)) {
+-            this._oVirtCredentialsManager.resetToken();
++        let foregroundService = Object.keys(this._credentialManagers).find(service =>
++            this.serviceIsForeground(service));
++        if (foregroundService) {
++            this._credentialManagers[foregroundService].token = null;
+             this._preemptingService = null;
+             this._verificationFailed(false);
+             return;
+Index: gnome-shell-3.28.4/js/js-resources.gresource.xml
+===================================================================
+--- gnome-shell-3.28.4.orig/js/js-resources.gresource.xml
++++ gnome-shell-3.28.4/js/js-resources.gresource.xml
+@@ -6,6 +6,7 @@
+     <file>gdm/fingerprint.js</file>
+     <file>gdm/loginDialog.js</file>
+     <file>gdm/oVirt.js</file>
++    <file>gdm/credentialManager.js</file>
+     <file>gdm/realmd.js</file>
+     <file>gdm/util.js</file>
+ 
diff -Nru gnome-shell-3.28.4/debian/patches/series gnome-shell-3.28.4/debian/patches/series
--- gnome-shell-3.28.4/debian/patches/series	2019-10-25 16:23:08.000000000 +1300
+++ gnome-shell-3.28.4/debian/patches/series	2020-08-31 14:44:08.000000000 +1200
@@ -27,3 +27,7 @@
 st-widget-Add-missing-g_return_val_if_fail.patch
 osk-layouts-Fix-French-layout.patch
 ubuntu/search-call-XUbuntuCancel-method-on-providers-when-no-dat.patch
+lp-1886592-gdm-refactor-oVirt-sso.patch
+lp-1886592-gdm-enable-vmware-sso.patch
+lp-1886592-gdm-fixup-oVirt-service-name.patch
+lp-1886592-gdm-fixup-VMware-service-name.patch