Web Interface Guide

Web Interface Administrators Guide
For other guides in this document set, go to the Document Center
Web Interface for MetaFrame Presentation Server 4.2 Citrix MetaFrame Access Suite
Use of the product documented in this guide is subject to your prior acceptance of the End User License Agreement. Note that copies of the End User License Agreement are included in the root directory of the MetaFrame Presentation Server CD-ROM and in the root directory of the Components CD-ROM. Copyright and Trademark Notice Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. Other than printing one copy for personal use, no part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Citrix Systems, Inc. Copyright 2001-2005 Citrix Systems, Inc. All rights reserved. Access Suite, Citrix, ICA (Independent Computing Architecture), Citrix Solutions Network, MetaFrame, MetaFrame XP, Presentation Server, Program Neighborhood, and SpeedScreen are registered trademarks or trademarks of Citrix Systems, Inc. in the United States and other countries. RSA Encryption 1996-1997 RSA Security Inc., All Rights Reserved. Trademark Acknowledgements Adobe, Acrobat, and PostScript are trademarks or registered trademarks of Adobe Systems Incorporated in the U.S. and/or other countries. Apple, LaserWriter, Mac, Macintosh, Mac OS, and Power Mac are registered trademarks or trademarks of Apple Computer Inc. Java, Sun, and SunOS are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Solaris is a registered trademark of Sun Microsystems, Inc. Sun Microsystems, Inc has not tested or approved this product. Microsoft, MS-DOS, Windows, Windows NT, Win32, Outlook, ActiveX, and Active Directory are either registered trademarks or trademarks of Microsoft Corp. in the United States and/or other countries. Novell Directory Services, NDS, and NetWare are registered trademarks of Novell, Inc. in the United States and other countries. Novell Client is a trademark of Novell, Inc. SafeWord is a trademark of Secure Computing Corporation, registered in the United States and other countries. UNIX is a registered trademark of The Open Group. Apache is either a registered trademark or trademark of the Apache Software Foundation in the United States and/or other countries. JavaServer Pages and Sun ONE Application Server are either registered trademarks or trademarks of Sun Microsystems Corporation in the United States and/or other countries. This product incorporates IBMs XML Parser for Java Edition, 1999, 2000 IBM Corporation. All other trademarks and registered trademarks are the property of their owners.
Document Code: September 14, 2005 11:47 am (ER)
Go to Document Center
Contents 3
Contents
Chapter 1 Introduction
Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 How to Use this Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Finding More Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 Accessing Documentation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11 Adding the Latest Version of the Guide to the Document Center . . . . . . 11 Introducing the Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 The Web Interface Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 MetaFrame Presentation Server Sites. . . . . . . . . . . . . . . . . . . . . . . . . . . . 12 Program Neighborhood Agent Services Sites . . . . . . . . . . . . . . . . . . . . . 13 Conferencing Manager Guest Attendee Sites. . . . . . . . . . . . . . . . . . . . . . 13 Management Features. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Application Access Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Security Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 Client Deployment Features . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Whats New. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 15 Integration with the Access Gateway with Advanced Access Control . . 15 Enhanced Content Redirection Support . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Web Interface Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Server Farms. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 Web Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Client Device . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 How the Web Interface Works . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19
Chapter 2
Deploying the Web Interface

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 System Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Server Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Supported MetaFrame Presentation Server Versions. . . . . . . . . . . . . . . . 22 Access Suite Console . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 Additional Software Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 23 General Configuration Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 Web Server Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25
On Windows Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 On UNIX Platforms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 User Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 Personal Digital Assistants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27 MetaFrame Presentation Server Client Device Requirements . . . . . . . . . . . . . 27 Installing the Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Installation Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Installing the Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Upgrading an Existing Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 28 Security Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Performance Considerations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 Installing the Web Interface on Windows . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30 Installing the Web Interface on UNIX Platforms . . . . . . . . . . . . . . . . . . . . . . . 31 Using Conferencing Manager on UNIX. . . . . . . . . . . . . . . . . . . . . . . . . . 33 Installation Using the Command Line . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Using Language Packs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Removing Language Packs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 Deploying Languages to Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Configure and Run Discovery . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 Creating Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37 Creating Sites on UNIX Web Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Specifying Site Configuration . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Using Site Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 38 Troubleshooting the Web Interface Installation . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Using the Repair Option . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Uninstalling the Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39 Uninstalling the Web Interface on Microsoft IIS. . . . . . . . . . . . . . . . . . . . . . . . 40 Uninstalling the Web Interface on UNIX Platforms . . . . . . . . . . . . . . . . . . . . . 40
Chapter 3
Configuring the Web Interface

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 41 Deciding Which Configuration Method to Use. . . . . . . . . . . . . . . . . . . . . . . . . . . . 42 Configuring Sites Using the Console. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Getting Help . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Getting Started with the Access Suite Console . . . . . . . . . . . . . . . . . . . . . . . . . 45 Running Discovery. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45 Creating Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46
Contents 5
Performing Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Managing Server Farms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 47 Configuring Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 48 Configuring Settings for All Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Specifying Advanced Server Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 Configuring Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Methods of Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Authentication Recommendations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Enabling Smart Card Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 Enabling Pass-Through Authentication . . . . . . . . . . . . . . . . . . . . . . . . . . 57 Enabling Explicit or Prompt Authentication . . . . . . . . . . . . . . . . . . . . . . 59 Two-Factor Authentication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 Enabling Secure Computing SafeWord on IIS . . . . . . . . . . . . . . . . . . . . . . . . . 61 SafeWord Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 61 SafeWord Agent for the Web Interface Requirements. . . . . . . . . . . . . . . 61 Enabling SafeWord Authentication Using the Console . . . . . . . . . . . . . . 62 Enabling RSA SecurID 6.0 Authentication on IIS. . . . . . . . . . . . . . . . . . . . . . . 62 SecurID Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Adding the Server Running the Web Interface as an Agent Host . . . . . . 62 Copying the sdconf.rec File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 Enabling RSA SecurID Authentication Using the Console . . . . . . . . . . . 62 Node Secret Registry Key Considerations . . . . . . . . . . . . . . . . . . . . . . . . 63 RSA SecurID Multiple Domain Support . . . . . . . . . . . . . . . . . . . . . . . . . 64 Enabling RSA SecurID 6.0 Windows Password Integration . . . . . . . . . . 64 Enabling Two-Factor Authentication on UNIX. . . . . . . . . . . . . . . . . . . . . . . . . 64 Enabling RADIUS with SafeWord . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Enabling RADIUS with RSA SecurID. . . . . . . . . . . . . . . . . . . . . . . . . . . 65 Adding the Web Interface and RADIUS Servers as Agent Hosts . . . . . . 65 Creating a Shared Secret for RADIUS. . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Enabling RADIUS Two-Factor Authentication Using the Console. . . . . 66 Using RADIUS Challenge Mode . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 Using Customized Challenge Messages. . . . . . . . . . . . . . . . . . . . . . . . . . 66 Changing Session Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 Managing Application Shortcuts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 Managing Server Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Customizing the Appearance for Users . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 69 Managing Secure Client Access. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Editing DMZ Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 Editing Secure Gateway Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71
Editing Address Translations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 73 Displaying Secure Client Access Settings . . . . . . . . . . . . . . . . . . . . . . . . 73 Managing Client Deployment . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 74 Remote Desktop Connection Requirements. . . . . . . . . . . . . . . . . . . . . . . 75 Configuring Installation Captions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Compatibility with Asian Language Web Servers . . . . . . . . . . . . . . . . . . 78 Customizing the Client for Java Deployment . . . . . . . . . . . . . . . . . . . . . 78 Editing Client-Side Proxy Settings. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 82 Managing Client Connection Settings . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 Managing Client Configuration Files. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 85 Using Application Refresh Options . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Configuring Workspace Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Feature Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 86 Using Workspace Control with Integrated Authentication Methods . . . . 87 Enabling Workspace Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 Controlling Diagnostic Logging. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Load Balancing Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 89 Using Local Site Tasks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Managing Configuration Sources. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Repairing and Unstalling Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 90 Importing and Exporting Configuration Files . . . . . . . . . . . . . . . . . . . . . . . . . . 91 Configuring the Web Interface Using the Configuration File. . . . . . . . . . . . . . . . . 91 Program Neighborhood Agent Considerations . . . . . . . . . . . . . . . . . . . . . . . . 105 Examples. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 Configuring Communication with MetaFrame Presentation Server . . . 106 Configuring Citrix SSL Relay Communication . . . . . . . . . . . . . . . . . . . 107 Configuring Secure Gateway Support . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Disabling Error Messages . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 Making the Web Interface Available to Users . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 Making the Log In Page the Default on IIS . . . . . . . . . . . . . . . . . . . . . . . . . . . 108 What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 108
Chapter 4
Configuring SmartAccess for the Web Interface

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 Controlling Access to Resources . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Making Resources Available to Users. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 System Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 110 Deploying SmartAccess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 111
Contents 7
Configuring SmartAccess . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 On the Server Running Web Interface . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 On the Server Running Advanced Access Control . . . . . . . . . . . . . . . . . . . . . 112 On Both Servers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 112 Creating Sites . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 113 Differences in the Access Suite Console . . . . . . . . . . . . . . . . . . . . . . . . 113 Configuring Workspace Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Configuring Java Client Fallback . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114 Configuring Session Time-Out. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 114
Chapter 5
MetaFrame Presentation Server Clients and the Web Interface

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 Using Web-Based Client Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 118 Copying Client Installation Files to the Web Server . . . . . . . . . . . . . . . . . . . . 118 Configuring Web-Based Client Installation. . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Client for Win32 Installation Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 119 Configuring Installation Captions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 120 Client for Java Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 The Program Neighborhood Agent Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . 121 What to Do Next. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 122
Chapter 6
Configuring Web Interface Security

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 123 Introduction to Web Interface Security . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 124 Security Protocols and Citrix Security Solutions. . . . . . . . . . . . . . . . . . . . . . . 125 Secure Sockets Layer (SSL). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Transport Layer Security (TLS) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 125 Citrix SSL Relay. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 ICA Encryption . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 126 Secure Gateway . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Securing Web Interface Communication. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 127 Securing the Program Neighborhood Agent with SSL . . . . . . . . . . . . . . . . . . . . . 128 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 128 Client Device/Server Running the Web Interface Communication . . . . . . . . . . . 128 Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Implementing SSL/TLS-Capable Web Servers and Web Browsers . . . 129 Do not Enable Pass-Through Authentication . . . . . . . . . . . . . . . . . . . . . 130
Server Running the Web Interface/MetaFrame Presentation Server Communication . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 130 Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Using Citrix SSL Relay . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 131 Enabling the Server Running the Web Interface on the MetaFrame Server . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 132 Using the HTTPS Protocol. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 Client Session/MetaFrame Presentation Server Communication . . . . . . . . . . . . . 134 Risks . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Recommendations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Use SSL/TLS or ICA Encryption. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 134 Use Secure Gateway. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135 General Security Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 135
Chapter 7
Using the Program Neighborhood Agent

Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 137 Using the Program Neighborhood Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Using the Access Suite Console for Configuration. . . . . . . . . . . . . . . . . . . . . . . . 138 Using the config.xml File. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 138 Configuring the Web Interface with Program Neighborhood Agent . . . . . . . . . . 139 Securing the Program Neighborhood Agent with SSL . . . . . . . . . . . . . . . . . . . . . 140 Example . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 140 Index . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 141
CHAPTER 1
Introduction
Overview
Welcome to the Web Interface for MetaFrame Presentation Server. This chapter introduces you to the documentation and to the Web Interface. Topics include: How to Use this Guide Introducing the Web Interface Whats New
10
How to Use this Guide

The Web Interface Administrators Guide is for Citrix administrators and Web masters responsible for installing, configuring, and maintaining MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. This is a task-based guide to help you set up the Web Interface quickly and easily. This chapter introduces the documentation and the Web Interface, and describes whats new in this version. Subsequent chapters explain how to deploy and configure the Web Interface. This guide assumes knowledge of MetaFrame Presentation Server for Windows or MetaFrame Presentation Server for UNIX.
Finding More Information

The Web Interface includes the following documentation: The Web Interface Administrators Guide (this document) provides an overview and explains how to install and configure the server running the Web Interface, MetaFrame Presentation Server Client devices, and security. This guide is available using the Document Center on the MetaFrame Presentation Server CD-ROM, and on the Support and Services area of the Citrix Web site (http:// www.citrix.com/). Online help for the Access Suite Console. To access the help system, click F1 or right-click any node in the console tree and select Help from the Context menu. The Customizing the Web Interface guide explains how to customize the Web Interface. This guide is available on the Support and Services area of the Citrix Web site (http://www.citrix.com/). The Readme file contains last minute updates, corrections to the documentation, and known issues. This file is available using the Document Center on the MetaFrame Presentation Server CD-ROM.
11
Accessing Documentation
This administrators guide is part of the MetaFrame Presentation Server documentation set. The documentation set includes online guides that correspond to different features of MetaFrame Presentation Server. Online documentation is provided as Adobe Portable Document Format (PDF) files. Use the Document Center to access the complete set of online guides. The Document Center provides a single point of access to the documentation that enables you to go straight to the section of documentation that you need. The Document Center includes: A list of common tasks and a link to each item of documentation. A search function that covers all the PDF guides. This is useful when you need to consult a number of different guides. Cross-references between documents. You can move between documents as often as you need using the links to other guides and the links to the Document Center.
Important To view, search, and print the PDF documentation, you need to have Acrobat Reader 5.0.5 with Search or a later version with Search. You can download Acrobat Reader for free from Adobe Systems Web site at http://www.adobe.com/. If you prefer to access the guides without using the Document Center, you can navigate to the component PDF files using Windows Explorer. If you prefer to use printed documentation, you can also print each guide from Acrobat Reader. More information about Citrix documentation, and details about how to obtain further information and support, is included in Getting Started with MetaFrame Presentation Server.
Adding the Latest Version of the Guide to the Document Center

You can add the latest version of the Web Interface Administrators Guide to the existing Document Center by copying the PDF file to the docs directory on the server where you originally installed the Document Center, typically this is C:\Program Files\Citrix\Documentation\docs. Note If you use the search function, results are not included for any version of the guide you add to the Document Center manually.
12
Introducing the Web Interface

The Web Interface provides users with access to MetaFrame Presentation Server applications and content through a standard Web browser or through the Program Neighborhood Agent, and allows you to configure sites for MetaFrame Conferencing Manager Guest Attendee log on. The Web Interface employs Java and .NET technology executed on a Web server to dynamically create an HTML depiction of server farms for MetaFrame Presentation Server sites. Users are presented with all the applications published in the server farm(s) you make available. You can create standalone Web sites for application access or Web sites that can be integrated into your corporate portal. Additionally, the Web Interface allows you to configure settings for users accessing applications through the Program Neighborhood Agent and create sites for guest users logging on to Conferencing Manager. The Web Interface can be configured using the Access Suite Console on Windows platforms. For more information about using this tool, see Configuring Sites Using the Console on page 44. You can also edit the configuration file (WebInterface.conf) to create and manage MetaFrame Presentation Server sites. For more information, see Configuring the Web Interface Using the Configuration File on page 91. In addition, you can customize and extend MetaFrame Presentation Server sites. The Customizing the Web Interface guide explains how to configure sites using these methods.
The Web Interface Features

This section provides information about the Web Interfaces features. For details about which MetaFrame Presentation Server and client versions are required for particular Web Interface features, see MetaFrame Presentation Server and Client Version Requirements on page 23.
MetaFrame Presentation Server Sites

The Web Interface provides functionality to create and manage MetaFrame Presentation Server sites. Users access applications and content using a Web browser.
13
Program Neighborhood Agent Services Sites

The Program Neighborhood Agent is a client designed for flexibility and ease of configuration. Using the Program Neighborhood Agent in conjunction with the Web Interface, you can integrate published resources with users desktops. Users access remote applications, desktops, and content by clicking icons on their desktop, in the Start menu, in the notification area, or any combination thereof. You can determine what, if any, configuration options your users can access and modify, such as audio, display, and logon settings.
Conferencing Manager Guest Attendee Sites

The Web Interface provides guest attendees with access to Conferencing Manager conferences through a standard Web browser. A guest attendee is a person who is invited to join a conference and either does not have, or does not want to use, a Windows NT domain name. Guest attendees access the conference through the Web Interface and use a locked down version of the published Conferencing Manager application. They have the following restrictions: They cannot create or start conferences They cannot launch applications within a conference
For more information about Conferencing Manager, see the MetaFrame Conferencing Manager Administrators Guide.
Management Features
Multiple server farm support. You can configure multiple server farms and provide users with a display of the applications available to them from all farms. You can configure each server farm individually using the Manage server farms task. For more information, see Configuring Communication with MetaFrame Presentation Server on page 106. Complete administrative control over application deployment. Web server-side scripting lets you configure all MetaFrame Presentation Server Client options in server-side scripts and ICA files. Integration with popular Web technologies. The Web Interfaces API can be accessed from Microsofts ASP.NET and Sun Microsystems JavaServer Pages. Novell Directory Services (NDS) support. The Web Interface Log In page for NDS contains a context field, allowing users to search for their user name in the tree to determine which context they are in.
14
Active Directory and user principal name (UPN) support. All Web Interface components are compatible with Microsoft Active Directory. Users visiting MetaFrame Presentation Server sites can log on to server farms that are part of an Active Directory deployment and seamlessly access published applications. The logon pages are compatible with Active Directorys use of User Principal Names.
Application Access Features

Support for servers on UNIX operating systems. Support for MetaFrame Presentation Server for UNIX farms allows the Web Interface to display and launch applications running on UNIX platforms on your users client devices. Backup servers. You can configure backup servers to ensure that users still have access to their applications in the event of a server failure. Anonymous users. This feature allows users to log on to MetaFrame Presentation Server sites using an anonymous account. Launching of published content. The Web Interface supports the content publishing features of MetaFrame Presentation Server.
Security Features
Secure Sockets Layer (SSL)/Transport Layer Security (TLS) support. The Web Interface supports SSL to secure communication between the server running the Web Interface and server farms. Implementing SSL on your Web server together with Web browsers that support SSL ensures the security of data as it travels through your network. The Web Interface uses Microsoft's Schannel security protocol on Windows platforms for MetaFrame Presentation Server sites. This protocol uses FIPS 140 validated cryptography, a standard required by some organizations. For more information about FIPS 140 validation, see the National Institute of Standards and Technology (NIST) Web site (http://csrc.nist.gov/ cryptval/). Secure Gateway for MetaFrame Presentation Server support. The Secure Gateway, together with the Web Interface, provides a single, secure, encrypted point of access through the Internet to servers on your internal corporate networks. The Secure Gateway simplifies certificate management, because a server certificate is required only on the Secure Gateway server, rather than on every server in the server farm.
15
Ticketing. This feature provides enhanced authentication security. The Web Interface obtains tickets that authenticate users to published applications. Tickets have a configurable expiration period and are valid for a single logon. After use, or after expiration, a ticket is invalid and cannot be used to access applications. Use of ticketing eliminates the explicit inclusion of credentials in the ICA files the Web Interface uses to launch applications.
Client Deployment Features

Web-based client installation. You can use the Web Interface to deploy the Client for Win32 to any device that has a Web browser. When a client device user visits a MetaFrame Presentation Server site, the client installation code detects the device and Web browser types and prompts the user to install an appropriate client. Program Neighborhood Agent support. The Program Neighborhood Agent allows users to access MetaFrame Presentation Server applications directly from the Windows desktop without using a Web browser. You can remotely configure the placement of links to remote applications from the Start menu, on the Windows desktop, or in the Windows notification area. The Program Neighborhood Agent user interface can also be locked down to prevent user misconfiguration.
Whats New
The Web Interface offers the following new enhancements and features in this release:
Integration with the Access Gateway with Advanced Access Control

SmartAccess support. The Web Interface supports SmartAccess, allowing administrators to control access to available applications on computers running MetaFrame Presentation Server through the use of Advanced Access Control policies and filters. This permits the use of endpoint analysis as a condition of application access, along with other factors. Note SmartAccess support is available for MetaFrame Presentation Server sites only. For more information and configuration instructions, see Configuring SmartAccess for the Web Interface on page 109 and the Access Gateway with Advanced Access Control Administrators Guide.
16
Navigation page integration. Administrators can now embed a MetaFrame Presentation Server site in the Advanced Access Control default navigation page. Users then access their network resources, such as Web sites, email, and applications, directly. This removes the requirement to publish a MetaFrame Presentation Server site as a link accessed from the default navigation page. For more information and configuration instructions, see Configuring SmartAccess for the Web Interface on page 109 and the Access Gateway with Advanced Access Control Administrators Guide.
Enhanced Content Redirection Support

Client to server content redirection allows users running the Program Neighborhood Agent to open published content and local files with applications published on servers. Administrators can now disable content redirection for both individual and groups of Program Neighborhood Agent Services sites, overriding any content redirection settings configured for MetaFrame Presentation Server.
Web Interface Components

A Web Interface deployment involves the interaction of three network components: One or more server farms A Web server A client device with a browser and a MetaFrame Presentation Server Client
Server Farms
A server farm is a group of servers managed as a single entity. A server farm is composed of a number of servers operating together to serve applications to MetaFrame Presentation Server Client users. Important among a server farms standard capabilities is application publishing. This is an administrative task that lets administrators make available to users specific applications hosted by the server farm. When an administrator publishes an application for a group of users, that application becomes available as an object to which clients can connect and initiate client sessions. The Program Neighborhood Client interface automates the client-side configuration process by eliminating the need for administrators or client users to browse the network for published applications. Using Program Neighborhood, users can log on to the server farm and receive a customized list of applications published for their individual user name. This list of applications is called an application set.
17
The server running the Web Interface functions as a Program Neighborhood interface for connecting to one or more server farms. The server running the Web Interface queries server farms for application set information and then formats the results into HTML pages that users can view in a Web browser. To communicate with server farms, the server running the Web Interface communicates with the Citrix XML Service running on one or more servers. The Citrix XML Service is a MetaFrame component that provides published application information to clients and servers running the Web Interface using TCP/IP and HTTP. This service functions as the contact point between the server farm and the server running the Web Interface. The Citrix XML Service is installed with MetaFrame Presentation Server for Windows, and MetaFrame Presentation Server for UNIX Operating Systems.
Web Server
The Web server hosts the Web Interface classes and Web server-side scripts. The Web Interface classes provide the following services: Authenticate users to a server farm or farms Retrieve application information, including a list of applications a user can access
The Web Interface classes are added to your Web server during installation. This installation program also adds Web pages and configuration files.
Client Device
In the context of the Web Interface, a client device is any computing appliance capable of executing a MetaFrame Presentation Server Client and a Web browser. Client devices include desktop PCs and network computers, among others. In a client device, the browser and client work together as a viewer and engine. The browser lets users view application sets (created by server-side scripting on the server running the Web Interface) while the client acts as the engine that launches published applications. The Web Interface provides Web-based client installation. Web-based client installation is a method of deploying clients from a Web site. When a user visits a site created with the Web Interface, the Web-based client installation code detects the device and the Web browser prompts the user to install an appropriate client. In the case of Windows devices, Web-based client installation can also detect the presence or absence of an installed client and prompt the user only if necessary. See Automatically Deploying Clients on page 75 for more information. The Web Interface supports many browser/client combinations. For a complete list of supported browser/client combinations, see MetaFrame Presentation Server Client Device Requirements on page 27.
18
How the Web Interface Works

The following section describes a typical interaction between server farms, a server running the Web Interface, and a client device.
This diagram shows an example of a typical Web Interface interaction. The browser on the client device sends information to the Web server, which communicates with the server farm to allow users to access their applications.
1. Client device users utilize a Web browser to view the Login page and enter their user credentials. 2. The Web server reads users credentials and uses the Web Interface classes to forward the information to the Citrix XML Service on servers in the server farms. The designated server acts as a broker between the Web server and servers. 3. The Citrix XML Service on the designated server then retrieves a list of applications from the servers that users can access. These applications comprise the users application set. The Citrix XML Service retrieves the application set from the Independent Management Architecture (IMA) system and Program Neighborhood Service, respectively. In a farm running MetaFrame Presentation Server for UNIX, the Citrix XML Service on the designated server uses information gathered from the ICA browser and the local Web Interface configuration file to determine which applications the user can access. The Citrix XML Service then returns the users application set information to the Web Interface classes running on the server. 4. The user initiates the next step by clicking one of the hyperlinks in the HTML page. 5. The Citrix XML Service is contacted to locate the server in the farm that is the least busy. The XML Service requests a ticket from the least busy server corresponding to the users credentials. The XML Service returns the least-busy servers address and ticket to the Web Interface
19
6. The classes finish parsing the template file and send a customized file to the Web browser. 7. The Web browser receives the file and passes it to the client device. 8. The client receives the file and initiates a client session with a server according to the files connection information.
What to Do Next
For information about system requirements, instructions for installing the Web Interface, and configuring the server running the Web Interface, see Deploying the Web Interface on page 21.
20
CHAPTER 2
Deploying the Web Interface
Overview
This chapter explains how to install the Web Interface on your server and configure the server to run the Web Interface. Topics include: System Requirements Installing the Web Interface What to Do Next Installing the Web Interface on UNIX Platforms Troubleshooting the Web Interface Installation Uninstalling the Web Interface
22
System Requirements
The following section describes server, Web server, and client device requirements for the Web Interface.
Server Requirements
To run the Web Interface, your servers must meet the following requirements.
Supported MetaFrame Presentation Server Versions

The Web Interface requires one of the following platforms: Citrix MetaFrame Presentation Server 4.0 for Windows Server 2003 Citrix MetaFrame Presentation Server 4.0 for Windows 2000 Server Citrix MetaFrame Presentation Server 3.0 for Windows Server 2003 Citrix MetaFrame Presentation Server 3.0 for Windows 2000 Server Citrix MetaFrame Presentation Server for UNIX Operating Systems MetaFrame XP for Windows, Service Pack 2 for Terminal Services Edition MetaFrame XP for Windows, Service Pack 3 for Windows 2000 Server MetaFrame XP for Windows, Service Pack 3 for Windows Server 2003 MetaFrame for UNIX Operating Systems Version 1.1, Feature Release 1 MetaFrame Application Server for Windows Version 1.8, Feature Release 1 and Service Pack 3
The Web Interface operates with these MetaFrame Presentation Server versions on all of their supported platforms. For a list of supported platforms, see the appropriate MetaFrame Presentation Server documentation. Citrix recommends that you have the latest version of the service pack installed on your system.
Access Suite Console

To administer the Web Interface on Windows, the Access Suite Console must be installed prior to installing the Web Interface. For information about installing the console, see the MetaFrame Presentation Server Administrators Guide.
Upgrading the Console

To access the new functionality available in Version 4.2 you must upgrade the console by installing the Access Suite Console 4.2 patch, ASC00W004.msp, available from the Citrix Web site.
Chapter 2 Deploying the Web Interface
23
Additional Software Requirements

Without the feature releases, some new features will not be available. For example, to use the Enhanced Content Publishing feature with the Web Interface, you must have MetaFrame XP for Windows, Service Pack 2 and a Feature Release 2 license installed on all servers in the server farm.
MetaFrame Presentation Server and Client Version Requirements

The following table summarizes the MetaFrame Presentation Server and client versions that are required for key Web Interface features.
Web Interface Feature Session reliability Workspace control Remote Desktop Connection Ticketing MetaFrame Presentation Server Requirements MetaFrame Presentation Server 4.0 MetaFrame Presentation Server 3.0 or later MetaFrame Presentation Server 3.0 or later MetaFrame Presentation Server 3.0 or later MetaFrame 1.8 Feature Release 1 MetaFrame XP 1.0 MetaFrame for UNIX 1.1 Feature Release 1 MetaFrame Presentation Server 3.0 or later MetaFrame XP Feature Release 1 MetaFrame Presentation Server 3.0 or later MetaFrame XP Feature Release 1 MetaFrame for UNIX 1.1 Feature Release 1 MetaFrame Presentation Server 3.0 or later MetaFrame XP Feature Release 2 Client Requirements 9.0 8.0 N/A 6.0 or later
NDS authentication
6.20 or later
DNS addressing
6.20 or later
Smart card support
6.30 or later
24
Web Interface Feature Enhanced Content Publishing
MetaFrame Presentation Server Requirements MetaFrame Presentation Server 3.0 or later MetaFrame XP Feature Release 2 MetaFrame Presentation Server 3.0 or later MetaFrame 1.8 Feature Release 1 MetaFrame XP 1.0 MetaFrame for UNIX 1.1 N/A MetaFrame Presentation Server 3.0 or later MetaFrame 1.8 Feature Release 1 MetaFrame XP 1.0 MetaFrame for UNIX 1.1 MetaFrame Presentation Server 3.0 or later MetaFrame XP Feature Release 2 N/A MetaFrame Presentation Server 3.0 or later MetaFrame XP Feature Release 2 N/A MetaFrame Presentation Server 3.0 or later MetaFrame 1.8 Feature Release 1 MetaFrame XP 1.0 MetaFrame for UNIX 1.1 Feature Release 1
Client Requirements 6.20 or later
Server-side firewall support
N/A
Client-side firewall support Load balancing
6.0 or later for SOCKS 6.30 or later for Secure Proxy N/A
End-user change password
N/A
Auto-download the Web Client for Win32 Pass-through authentication
Provided by the Web Interface Full Program Neighborhood Client for Win32/Program Neighborhood Agent 6.20 or later Provided by the Web Interface 6.20.986 or later
Embedded clients Secure Gateway support
25
General Configuration Requirements

Servers must be members of a server farm. The servers in the farm must have applications published. Additionally, if your servers are running MetaFrame 1.8 for Windows, make sure they have applications published under the server farm management scope. For information about server farm membership and publishing applications in a server farm, see the MetaFrame Presentation Server Administrators Guide. Note If you are using the Web Interface in a MetaFrame 1.8 for Windows environment, you must change the AddressResolutionType in the WebInterface.conf file from ipv4-port to ipv4. MetaFrame Presentation Server for UNIX servers must also have applications published. In addition, these applications must be configured for use with the Web Interface. See the MetaFrame Presentation Server for UNIX Administrators Guide for information about installing the Citrix XML Service for UNIX and configuring published applications for use with the Web Interface.
Web Server Requirements

A copy of the different MetaFrame Presentation Server Clients must be present on the server for Web-based installation of the clients. See MetaFrame Presentation Server Client Device Requirements on page 27 for information about supported client versions and Copying Client Installation Files to the Web Server on page 118 for information about copying the clients to the server running the Web Interface.
On Windows Platforms
You can use the Web Interface on the following Windows platforms and servers: Internet Information Services 6.0 on Windows Server 2003 Internet Information Services 5.0 on Windows 2000 with Service Pack 4 .NET Framework 1.1 with Service Pack 1 (Windows 2000 systems only) Visual J# .NET 1.1 ASP.NET
The following software must be installed prior to installing the Web Interface:
On Windows 2000 systems, ASP.NET is installed with the .NET Framework if IIS was previously installed. If IIS is not installed, you must install IIS and reinstall the Framework, or install IIS and run the aspnet_regiis -i command in the WINNT\Microsoft.NET\Framework\v1.1.4322 directory.
26
Note If you receive an internal error message when using the Web Interface on Windows 2000 systems, there may be a problem with the configuration of the .NET accounts. In this case, uninstall the Web Interface, Visual J# .NET, and all versions of the .NET Framework from the server and reinstall the software again. On Windows Server 2003 systems, ASP.NET is installed if you enabled IIS during the installation of Windows Server 2003. Otherwise, you must install IIS and select ASP.NET (which is a subcomponent of IIS). The .NET Framework and J# redistributable files are included on the Server CD-ROM in the Support folder. If your server has a statically configured IP address, you must define the primary DNS suffix or a fully qualified DNS domain name for the server. This can be done on Windows 2000 in My Network places/Local Area Connection Properties/ Internet Protocol properties. CAUTION Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. To verify correct configuration, check to see if a valid DNS suffix is present in the following registry key value data: Key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\ Tcpip\ParametersValue: Domain
On UNIX Platforms
You can use the Web Interface with the following UNIX configurations:
Operating System Red Hat Enterprise Edition Red Hat Enterprise Edition Solaris 9 Solaris 9 Server Apache 2.x WebSphere Application Server 5.1 Sun ONE 8 WebLogic Server 8.x JDK Sun 1.4.x WebSphere Sun 1.4.x WebLogic Servlet Engine Tomcat 5.x WebSphere Sun ONE WebLogic
27
User Requirements
The following browser and operating system combinations are supported for users to log on to the Web Interface:
Browser Internet Explorer 6.0 or later Safari 1.0 or later Mozilla 1.0 or later Pocket IE 2003 Operating System Windows XP, Windows 2000 with Service Pack 4, Windows 2003 Mac OS X Red Hat Enterprise Edition Pocket PC 2003
Personal Digital Assistants

You can run the Web Interface with the following Windows-based Terminals and Personal Digital Assistants (PDAs) configurations:
Device Dell Axim Wyse 3125SE Wyse 3125SE HP iPaq H5550 HPT 5510 Operating System Pocket PC 2003 WinCE 4.1 WinCE 4.2 Pocket PC 2003 WinCE 4.2 Browser Internet Explorer 6.0 Internet Explorer 5.5 Internet Explorer 6.0 Pocket Internet Explorer 2003 Internet Explorer 6.0
MetaFrame Presentation Server Client Device Requirements

To operate with the Web Interface, your client devices must have a supported client and Web browser. All clients that ship on the Components CD-ROM are compliant with the Web Interface. The Components CD-ROM is available in the MetaFrame Presentation Server media or clients are also available for free download from the Citrix Web site. Citrix recommends that you deploy the latest clients to your users to ensure that they can take advantage of the latest features. The features and capabilities of each client differfor information about supported client features, see the appropriate Administrators Guide for the client in question.
28
Installing the Web Interface

This section explains how to install the Web Interface on your server. An overview of the installation is provided, together with instructions about how to install the Web Interface on different servers.
Installation Overview
You install the Web Interface using the MetaFrame Presentation Server CD-ROM. Before installing the Web Interface, you must install the Access Suite Console, and for Windows platforms, Microsoft Internet Information Services (IIS), and ASP.NET. If you install the Web Interface on Windows platforms running in Japanese, simplified Chinese, traditional Chinese, or Korean, do not log on to Windows with a user name containing multibyte characters. For information about installing the Access Suite Console, see the MetaFrame Presentation Server Administrators Guide.
Installing the Web Interface

Installation programs for the following are available: Microsoft Internet Information Services (IIS) Tomcat, Sun ONE, and WebSphere for UNIX platforms
For more information about how to install the Web Interface, see Performance Considerations on page 29 and Installing the Web Interface on UNIX Platforms on page 31.
Upgrading an Existing Installation

You can upgrade from NFuse 1.7 and later to the most recent version of the Web Interface either by installing the Web Interface from CD-ROM or Web download files. When upgrading from an earlier version of the Web Interface that was installed with MetaFrame Presentation Server, the Web Interface is removed from the system and configuration files are not backed up. Citrix recommends that you upgrade this version of the Web Interface prior to installing MetaFrame Presentation Server. You cannot downgrade from the Web Interface for MetaFrame Presentation Server 4.0 to a previous version of the Web Interface.
29
Security Considerations
Citrix recommends that, as with any Windows-based server, you follow Microsoft standard guidelines for configuring your Windows server.
Viewing the Citrix XML Service Port Assignment

During Web Interface site creation (Windows) or .war file generation (UNIX), you are prompted for the port number on which the Citrix XML Service is running. The Citrix XML Service is the communication link between the server farm and the server running the Web Interface. This section explains how to view the port number on which the Citrix XML Service is running. To view the Citrix XML Service port assignment On the servers in the farm, open the Management Console for MetaFrame Presentation Server. In the left pane, expand Servers, right-click the server, and select Properties. In the Properties dialog box, select MetaFrame Settings to view the port assignment. If during MetaFrame Presentation Server installation, you choose the option to share Internet Information Services TCP/IP port with the XML Service, the Presentation Server Console displays Sharing with IIS as the port in use. In this case, to determine the Citrix XML Service port, you must locate the port used by Internet Information Services WWW Service. By default, the WWW Service uses port 80. On MetaFrame 1.8 servers, the port number is specified in the following registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\CtxHttp \TcpPort On MetaFrame Presentation Server for UNIX servers, type ctxnfusesrv -l at a command prompt to view port information.
Note If necessary, you can change the port used on the server. For more information, see the appropriate MetaFrame Presentation Server Administrators Guide.
Performance Considerations
If you are deploying the Web Interface to a high number of users, it may be necessary to adjust system and server parameters to increase user scalability.
30
CAUTION Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. On Windows systems, for example, you can increase the following registry value: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\ Parameters\MaxUserPort This key determines the highest port number TCP can assign when an application requests an available user port from the system. You can increase the default value of 5000 if you have large numbers of concurrent users. Additionally, you can increase the value of maxWorkerThreads and maxIoThreads on the .NET Framework. On Apache or Tomcat, you can adjust the parameters available in httpd.conf (Apache) or server.xml (Tomcat). Citrix recommends that you ensure that the Java heap size on Tomcat is sufficient to support high numbers of users if necessary. The heap size can be increased by passing the Xmxsize parameter to Java at start up. To do this, set or amend the JAVA_OPTS variable in the catalina.sh script on Tomcat.
Installing the Web Interface on Windows

Before installing the Web Interface, you must install the Access Suite Console. The Access Suite Console is installed from the MetaFrame Presentation Server CD-ROM. For more information, see the MetaFrame Presentation Server Administrators Guide. If you are upgrading from a previous version of the Web Interface, the installer prompts to back up your site and your existing sites are upgraded. Note On IIS 6.0 running Windows Server 2003, each site is assigned to an Application Pool. The Application Pool configuration contains a maximum number of worker processes. If you change the default value of 1, you may not be able to run the Web Interface.
31
To install the Web Interface 1. Log on as an administrator. 2. If you are installing the Web Interface from the MetaFrame Presentation Server CD-ROM, insert the CD-ROM in your Web servers CD-ROM drive. If you downloaded the Web Interface from a download site, copy the file WebInterface.exe to your Web server. Double-click the file. 3. Select your language from the list. The language of your operating system is detected and is displayed as the default selection. Click Next. 4. On the Welcome page, click Next. 5. On the License Agreement page, select I accept the license agreement and click Next. 6. On the Common Components page, browse to a location for the common Web Interface components (the default is C:\Program Files\Citrix\Web Interface). Click Next. 7. On the Clients page, select Install the clients from the Components CD-ROM. Click Browse to search the Components CD-ROM or CD image for the client setup files. Setup copies the contents of the CDs ICAWEB directory to the directory C:\Program Files\Citrix\Web Interface\4.0\ICAWEB that it creates off the Web servers document root. All Web sites created by the installation process assume that the Web server contains the client files in this directory structure. If you do not want to copy the clients to the Web server during Web Interface installation, select Dont install the clients from the Components CD-ROM and you can copy the clients to the server later. 8. Click Next to continue the installation. 9. When the installation is complete, click Finish. 10. Open the Access Suite Console to begin creating and configuring your sites. After installing the Web Interface, you can begin to manage your sites by configuring and running discovery. For more information, see Configure and Run Discovery on page 36.
Installing the Web Interface on UNIX Platforms

This section describes how to install the Web Interface on Tomcat. For other UNIX platforms, refer to the platforms documentation and any accompanying documentation for the platforms administration tool.
32
Note If you are installing the Web Interface on WebSphere, an Application Security Warnings message is displayed, indicating a problem with the contents of the was.policy file. This is a policy file created by WebSphere if you select Enforce Java 2 Security under Security>Global Security. Ensure that you edit the was.policy in accordance with the WebSphere Java 2 Security policy, otherwise, the Web Interface may not function properly. This policy file is located in WEBSPHERE_HOME/AppServer/installedApps/node-name/ war-file-name.ear/META-INF. The Web Interface requires a servlet engine to work on UNIX platforms. The Apache Web server requires an additional servlet engine to support the Web Interface such as Tomcat (note that Tomcat can be used as a standalone Web server or as a servlet engine). To install the Web Interface on Red Hat (Enterprise or Fedora), ensure that the sharutils package is also installed. This is required for the uudecode utility. To install the Web Interface on Tomcat 1. Copy the WebInterface.sh.gz file from the Components CD-ROM Web Interface directory to a temporary location. 2. In a UNIX shell, navigate to the directory where the installation file was downloaded. Unzip the file by typing gunzip WebInterface.sh.gz. 3. Run the installer by typing sh WebInterface.sh. 4. Press Enter to read the EULA. 5. Type Yes to accept the license agreement. 6. Select a site type from the list provided. 7. Specify if you want to use a local configuration (for example, WebInterface.conf) or use the centralized configuration (the Configuration Service). If you select local file, enter the name of the server containing application information. The XML Service must be installed and running on this server. Select an XML Service protocol from the list provided. Specify the port on which the XML Service is listening. If you select Configuration Service, enter the server (name or IP address) on which the Configuration Service is running. Enter the XML port number for the Configuration Service. You can enter multiple Configuration Services and port combinations.
33
8. If you are creating a Conferencing Manager Guest Attendee site, enter the External Conference Server location and the port number. Specify if the server is secured with SSL by selecting Yes or No. If you are creating a MetaFrame Presentation Server or Conferencing Manager site, the installer offers to copy the client files from the CD-ROM to the .war file. 9. Enter the path and name of the .war file to create. 10. A summary is displayed. Select Yes if the information displayed is correct. 11. The .war file is created and the clients are copied from the CD-ROM, if required. 12. Follow the instructions on-screen to complete the installation of the .war file.
Using Conferencing Manager on UNIX

Before you can create Conferencing Manager Guest Attendee Log In sites on Sun ONE, you must manually configure the security policy on the server after deploying the Conferencing Manager Guest Attendee WAR file. To configure the security policy on Sun ONE 1. Deploy the Conferencing Manager WAR file on Sun ONE. 2. Stop the Sun ONE server. 3. Edit the server.policy file under the deployed domain config directory. For example, if Sun ONE is installed under SunOne root/AppServer and the Conferencing Manager Guest Attendee Log In site is deployed in domain1, the file resides in SunOne root/AppServer/domains/domain1/config. SunOne root is the top level directory in which the Sun Java Application Server is installed. 4. Add the following configuration before any generic grant blocks: grant codeBase "file:SunOne root/AppServer/domains/domain1/applications/ j2ee-modules/MCMGuest/WEB-INF/lib/-" { permission java.lang.RuntimePermission "getClassLoader"; permission java.lang.RuntimePermission "createClassLoader"; permission java.net.SocketPermission "*", "connect,accept,resolve"; permission java.io.FilePermission "<>", "read,write,delete"; }; 5. Start the Sun ONE server.
34
Installation Using the Command Line

You can perform unattended installations and site management through command line scripts. WebInterface.exe (the installation file for Windows) cannot accept a command line directly. To pass a command line to it, set the environment variable WI_COMMAND_LINE=command line string In command line string, the backslash character (\) is used to escape spaces within paths. If you want to use the backslash character (for example, within a path), enter \\ or enclose the path in double quotes (\). To use double quotes, enter \. For more information about how to use the command line with the Web Interface, refer to the Knowledge Center at http://support.citrix.com/.
Using Language Packs

Language packs contain all information required to localize your sites into a specific language (German, English, Spanish, French, and Japanese), including: Resource files for sites Resource files for the Windows installer Resource files for site management Online help Resource files for the UNIX pre-install script Any localized icons and images
After installation, language packs can be added into the Common Files directory on Windows by copying the tree or unpacking the .zip file in that location. To customize a language for a specific site, you can copy the language pack into the sites location and modify it. The site will then use the modified language pack and other sites will continue to use the default. On UNIX, extra language packs can be installed by moving them into the appropriate directory within the site, and by extracting them if they are supplied in formats such as .zip. The installer defaults to the language of the operating system on which it is running, regardless of the language of the CD-ROM used for installation. For example, if you are installing on a French operating system using a German installation CD-ROM, the installer appears in French. The language default can be changed during installation, and this language is used as the default language for sites you create. The English language pack is used as the default language and must always be present on your server.
35
Removing Language Packs

Some clients, such as Windows CE devices, are not capable of displaying specific languages (for example, Japanese). In this case, the language selection drop-down list in the user interface displays block characters for unavailable languages. To avoid this, you can remove a language for all sites or certain sites. For ASPX sites, remove lang-code.lang (for example, ja.lang) from the common files. This is typically located in C:\Program Files\Citrix\Web Interface\4.0\languages. This removes the language from all sites on the server. If you want to enable this language for a particular site, move the .lang file to the languages folder for that site. For JSP sites, after creating a WAR file, open the WAR file with an appropriate tool, remove the .lang file, and package it again. This removes the language from sites deployed from that WAR file.
Deploying Languages to Users

When users log on, the language sent by the browser is detected. The screen is displayed in this language or in the sites default language if the users language is not detected or recognized. Users can select a language from those available (if more than one language pack was installed); the Login screen reloads itself in the language selected. If the site is set to kiosk mode, the users browser language is detected with each new session. If users do not normally view the Login screen (for example, during silent authentication), they can select a language from the Presentation Preferences screen. Ensure that users are provided with the correct version of the MetaFrame Presentation Server Client for their chosen language. When the user launches an application using an embedded client, the Web Interface performs one of the following steps: Launches using the embedded client in the users preferred language (if available on the server). Launches using the embedded client in the sites default language (if available on the server). Launches using the first embedded client found on the server. Displays an error to the user stating that no clients were available on the server. This message is also displayed for Web clients.
36
What to Do Next
After you install the Web Interface, you need to make the Web Interface available to your users. To do this, you create and configure sites using the Access Suite Console or edit the WebInterface.conf configuration file directly. Additionally, you may need to configure the Web Interface depending upon what other components are in your MetaFrame installation, or you may want to customize or extend the Web Interfaces capabilities. For information about how to configure the Web Interface for the Secure Gateway using the Access Suite Console, see Configuring Secure Gateway Support on page 107. For information about how to configure the Web Interface using the console or WebInterface.conf file, see Configuring Sites Using the Console on page 44 or Configuring the Web Interface Using the Configuration File on page 91. For information about security considerations, see Configuring Web Interface Security on page 123. To extend and customize Web Interface functionality, see the Customizing the Web Interface guide.
Configure and Run Discovery

To administer the Web Interface using the Access Suite Console, you must run the discovery task in the console. The first time you open the console, you are automatically prompted to start the discovery process: you are guided through selecting the components you want, configuring the discovery process, and finding the items to manage. After this, run the discovery process only if you want to discover a component or if items were added to or removed from your deployment. To run discovery 1. On the Start menu, click All Programs > Citrix > MetaFrame Presentation Server > Access Suite Console for Presentation Server. 2. On the Configure and run discovery page, click Yes. If this page is not displayed automatically, click the Configure and run discovery task. 3. Click Next. 4. On the Configuration Servers page, click Add to enter the name of a configuration server or select Do not contact any Web Interface configuration servers if you want to use local site tasks only. 5. A summary containing the configuration information appears. If this is correct, click Next. Otherwise, click Back to change this information or add another server.
37
6. On the Discovery Progress page, the number of items discovered appears. Click Finish to close this page and begin using the Access Suite Console. After running discovery to connect to a server farm, you can use the Access Suite Console to create sites.
Creating Sites
To create new sites, click Web Interface in the console tree, and click the Create site task. You can add one of the following sites: MetaFrame Presentation ServerFor users accessing published applications using the Web Interface. Program Neighborhood Agent ServicesFor users accessing published applications using the Program Neighborhood Agent. Conferencing Manager Guest AttendeeFor users logging on to Guest Attendee conferences.
You use this task to specify the IIS site, the URL to apply changes, and the configuration source for the site. These options can later be updated using the Local site tasks. You must be a local administrator on the system running the Access Suite Console to create sites. Note If you use centralized configuration, you cannot specify servers from multiple farms. Site configuration can be obtained only from servers on the same farm. When sites are created or edited, a bootstrap configuration file is updated to include the configuration source, default language, and installer-generated site identifier (used by the configuration service). The site identifier is in the form host name:IIS site number:site path:numeric where: host name is the host name of the server IIS site number is the number of the IIS site site path is the path (in the IIS metabase, under the site) of the site numeric ID is a random 128-bit ID
A backslash (\) is used as an escape character in these strings. For UNIX Web servers, host name and site path are dynamically generated, thus the SiteIDRoot field contains only the numeric ID. The site path is the recommended identification of the site obtained from the servlet engine running it, and may vary depending on the servlet engine.
38
Creating Sites on UNIX Web Servers

On UNIX, a pre-install script is run before creating each site. This script creates a customized WAR file for the site, which is then installed (usually by placing the WAR file in the correct location for the servlet engine). This script requires uudecode and Java. Sites are modified by editing the contents of the unpacked WAR file, and can be removed by deleting the WAR file.
Specifying Site Configuration

Site configuration can be stored in local configuration files or in a centralized configuration location (the configuration service). For the centralized configuration, you specify one or more host and port pairs to identify the configuration service when you create sites. For local configuration, you can copy an existing local configuration, or specify an XML Service/External Conference Service (for Conferencing Manager) to contact for farm information. You can edit a site to change the configuration source. If you change to local configuration, the existing configuration is obtained from the centralized configuration location and populates the new local file accordingly. For more information about specifying site configuration sources in the Access Suite Console, see Using Local Site Tasks on page 90. On UNIX, the pre-install script cannot create sites using local configuration files based on existing site configurations. On Windows, if centralized configuration is selected when installing a site, the site is automatically registered with the configuration service after installation. On UNIX, the site is registered on first page load after it is deployed into a servlet engine.
Using Site Tasks

To begin configuring sites, select the site under the Web Interface node in the Access Suite Console and use the tasks in the task pane. Alternatively, you can right-click a site name and select tasks from the Context menu. After you finish configuring the Web Interface, inform your users of the URL for the Login pagefor more information, see Making the Web Interface Available to Users on page 108.
39
Troubleshooting the Web Interface Installation

This section explains how to use the Repair option on Windows platforms to troubleshoot Web Interface installation, and what to do if the Repair option is unavailable or does not fix the problem.
Using the Repair Option

If you experience problems with the Web Interface installation, try using the Repair option to fix the problem. The Repair option reinstalls common files; it does not replace the scripts or the WebInterface.conf file. To run the Repair option from the .exe file 1. Double-click the WebInterface.exe file. 2. Select Repair and click Next. 3. Follow the instructions on-screen. Note If the Repair option does not fix the problem, or this option is unavailable (for example, on UNIX platforms), try uninstalling and then reinstalling the Web Interface. For information, see Uninstalling the Web Interface on page 39. You must reapply any changes you made in the WebInterface.conf file after reinstalling the Web Interface.
Uninstalling the Web Interface

When you uninstall the Web Interface, all Web Interface files are removed, including the ICAWEB directory and the Web Interface backup files. Therefore, if you want to keep any Web Interface files, copy these to another location before you uninstall the Web Interface. Under some circumstances, the Web Interface uninstaller may fail. Possible causes are: Insufficient registry access for the uninstaller IIS was removed from the system after the Web Interface was installed
40
Uninstalling the Web Interface on Microsoft IIS

To uninstall the Web Interface on Microsoft IIS 1. Use the Add/Remove Programs option available from Start > Settings > Control Panel. 2. Follow the instructions on-screen.
Uninstalling the Web Interface on UNIX Platforms

To uninstall the Web Interface on Tomcat 1. Navigate to the directory to which you originally copied the WAR file. 2. Stop your Web server. 3. Enter rm WAR file name. 4. You may also need to delete the directories in which the WAR file is expanded. Normally, this is the same directory as the WAR file with the same name. For example, the contents of Citrix.war is expanded into a directory called Citrix.
CHAPTER 3
Configuring the Web Interface
Overview
This chapter explains how to configure and customize the Web Interface using the Access Suite Console and the Web Interface configuration file. Topics include: Deciding Which Configuration Method to Use Configuring Sites Using the Console Making the Web Interface Available to Users
42
Deciding Which Configuration Method to Use

This section helps you to determine which method of configuring the Web Interface is best for your needs. You can configure and customize the Web Interface using the following methods: The Access Suite Console. The Access Suite Console allows you to perform day-to-day administration tasks quickly and easily. For example, you can use the console to specify the settings that users can select and to configure user authentication to the Web Interface. Your configuration takes effect as you make changes using the console. You can install the Access Suite Console on computers running: Any operating system from the Windows 2000 Server or Windows Server 2003 families Windows XP Professional Windows 2000 Professional
For information about how to configure the Web Interface using the console, see Configuring Sites Using the Console on page 44 and the Access Suite Console online help. The Web Interface configuration file. The WebInterface.conf file allows you to change many Web Interface properties; it is available on both Windows and UNIX platforms. You can use this file to perform day-to-day administration tasks and customize many more settings. You edit the values in the WebInterface.conf file and save the updated file to apply the changes. For information about configuring the Web Interface using the WebInterface.conf file, see Configuring the Web Interface Using the Configuration File on page 91. The Program Neighborhood Agent configuration file. You can configure the Program Neighborhood Agent using the config.xml file located on the server running the Web Interface. The config.xml file contains a number of parameters divided into the following categories: FolderDisplaySpecifies where to display application icons: in the Start menu, on the Windows desktop, or in the notification area. There are also additional parameters to specify a particular folder in the Start menu and the icon to use on the Windows desktop. This corresponds to the options on the Application Display tab of the Program Neighborhood Agent Properties dialog box. DesktopIntegrationDo not edit.
Chapter 3 Configuring the Web Interface
43
Configuration FileAllows you to specify a different URL for config.xml for the client to use in the future. This facilitates moving users to a different server running the Web Interface. RequestSpecifies where the client should request published application data from, and how often to refresh the information. LogonSpecifies the logon method to use. UserInterfaceSpecifies whether to hide or display certain groups of options presented to the user as part of the Program Neighborhood Agent interface. FileCleanupDo not edit. ICA_OptionsSpecifies the audio and video options for client connections. This corresponds to the options on the ICA Options tab of the Program Neighborhood Agent Properties dialog box.
Web server scripts and Java servlets. You can use the Web Interfaces application programming interface (API) to extensively customize your Web Interface site. You can use ASP.NET or JavaServer Pages to write Web server scripts for MetaFrame Presentation Server sites. For more information, see the Customizing the Web Interface guide.
44
Configuring Sites Using the Console

Web Interface administration is now available in the Access Suite Console. The console allows you to create and configure MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. The console allows you to manipulate many of the settings quickly and easily.
This diagram shows an example of the Access Suite Console.
When using the console, some Web Interface settings may be disabled if their value is not relevant to the current configuration and the corresponding WebInterface.conf settings are reset to their default values. Citrix recommends that you create regular backups of the WebInterface.conf file.
Getting Help
You can display online help for the Web Interface by pressing F1 or by rightclicking any node in the context tree and selecting Help.
45
Getting Started with the Access Suite Console

To use the Access Suite Console, run the console from Start > Programs or All Programs > Citrix > MetaFrame Presentation Server > Access Suite Console for Presentation Server. For more information about the Access Suite Console, see the MetaFrame Presentation Server Administrators Guide.
Running Discovery
Before you can start using the console to manage the items in your deployment, you must run discovery, which establishes connections to your server farms. The first time you open the console, you are automatically prompted to start the discovery process: you are guided through selecting the components you want, configuring the discovery process, and finding the items to manage. Using the Configure and run discovery wizard, you specify in which components you want discovery to search for new items, indicate whether or not to retrieve remote configuration for sites installed on your computer, edit configuration servers, and specify farms running MetaFrame Presentation Server. Subsequently, you run the discovery process if you want to discover a component or if items were added to or removed from your deployment. Click Run discovery in the task pane.
46
When discovery is complete, existing sites are displayed under the Web Interface in the console tree and you are ready to create new sites and administer existing sites. For example:
This diagram shows an example of the Access Suite Console containing existing sites.
Creating Sites
Using the Create site task, you can create the following site types: MetaFrame Presentation Serverfor users to access applications through a Web browser (the Web Interface) Program Neighborhood Agent Servicesfor users to access applications using Program Neighborhood Agent Conferencing Manager Guest Attendeefor guest users to log on to Conferencing Manager conferences
The Create Site wizard guides you through the process of creating one of these sites, allows you to specify the IIS location in which the site is hosted, specify whether or not the site is the default within the IIS site, and the URL to apply changes, add a location in which the site obtains its configuration, specify how users access MetaFrame Presentation Server sites, and add server farms. The new site is displayed in the console tree after this task is complete.
47
To administer the site, click it in the console tree. Site tasks, information, and alerts are displayed in the task pane and details pane. If the configuration server is not available and cannot be contacted, site tasks are not displayed in the console.
Performing Tasks
Tasks that are available for each site type are displayed in the task pane. Tasks are either performed using wizards or by setting options in dialog boxes. To execute a task, either click a task name in the task pane or right-click the site you want to configure and select a task from the menu displayed. Some tasks are available only for certain site types. This information is specified at the beginning of each of the following sections.
Managing Server Farms

Note The following section is applicable to MetaFrame Presentation Server, Program Neighborhood Agent Services, and Conferencing Manager Guest Attendee sites. Using the Manage server farms task, you can configure the Web Interface to communicate with one or more farms. Users must have an account that can authenticate to each farm specified in this task. On Windows, if the farms are on different domains, a two-way trust must be enabled between these domains. If a farm is on UNIX, each user must have a user name and password that matches the Windows farm. If the user name and password cannot be authenticated to any of the farms specified, users are presented with an invalid credentials error. Multiple server farm functionality is transparent to users because they are not informed that their application set is an aggregation from multiple server farms. Applications from multiple server farms are displayed in the same way as a single farm; folders are displayed first, followed by application icons. Consequently, applications with the same name from multiple server farms appear in an arbitrary position in the users application set. Citrix recommends that you ensure application names are unique across the server farms, such as by publishing applications in folders with different names. Note The Web Interface acquires application data from all server farms before displaying applications; each server farm is contacted in the order that it appears in the configurations. As a result, a server farm that is slow to respond impacts overall responsiveness when obtaining application sets.
48
Password Change Considerations

If there are differences among your server farms, there are additional issues that may prevent users from changing their passwords. For example: The domain policy may prevent users from changing passwords When aggregating multiple farms, the first farm listed in the configuration must be running MetaFrame XP, Service Pack 2 or later When MetaFrame Presentation Server for UNIX and MetaFrame Presentation Server for Windows are aggregated by a single site, only the Windows password can be changed
Citrix recommends that you disable user password changing in these situations. If necessary, it is possible to enable password changing in a mixed server farm deployment. The Web Interface contacts server farms in the order in which they are defined until a server farm reports that the password is successfully changed, at which point the process stops. This allows you to specify the server farm to which the change password request will be issued. However, use suitable password replication mechanisms between server farms to ensure that user passwords remain consistent. If the password change request fails, the next server farm in sequence is issued the change password request.
Configuring Server Settings

Server settings are configured for each server farm. To view and configure server farm settings, select the Manage server farms task. Using this task, you can create and edit server farm names and specify the order in which they are used for load balancing. You can also configure individual farm settings such as XML and SSL server ports, transport types, and enable ticketing. To add server farms 1. Click the Manage server farms task. 2. Click Add. In the Servers area, click Add to create a server name. 3. If you specify more than one server name, highlight a name in the list and click Move Up or Move Down to place these in the appropriate failover order. To change a server name, click Edit. To remove a server name, highlight the name in the list and click Remove. 4. Enter a name for the server farm in the Farm name box. 5. Click OK to finish adding the farm.
49
Configuring Fault Tolerance

The Web Interface provides fault tolerance among servers running the Citrix XML Service. If an error occurs while communicating with a server, the failed server is bypassed for a specified time but communication continues with the remaining servers in the Servers list. By default, a failed server is bypassed for one hour. To configure fault tolerance 1. Click the Manage server farms task. 2. Click Add if you are adding a farm or Edit to configure an existing farm. 3. In the Servers list, place the servers in order of priority. Highlight a name in the list and click Move Up or Move Down to place these in the appropriate order. 4. Change the length of time a failed server is bypassed in the Bypass any failed server for box. Note If a server running the Citrix XML Service fails, the Web Interface does not attempt to communicate with the failed server until the time specified in the Bypass any failed server for box elapses. If all servers in the list fail to respond, the Web Interface retries the servers every 10 seconds.
Enabling Load Balancing between Servers

You can enable load balancing among servers running the Citrix XML Service. Enabling load balancing allows you to evenly distribute connections among these servers so that no one server becomes overloaded. By default, load balancing is enabled. If an error occurs while communicating with a server, all further communication is load balanced among the remaining servers in the list. The failed server is bypassed for a specific time period (by default, one hour) but you can change this using the Bypass any failed server for box. See Configuring Fault Tolerance on page 49 for more information. To enable load balancing 1. Click the Manage server farms task. 2. Click Add if you are adding a farm or Edit to configure an existing farm. 3. In the Servers list, add the servers that will be used for load balancing. For information about how to add servers, see Configuring Server Settings on page 48.
50
4. Select the Use the server list for load balancing option. 5. Change the length of time a failed server is bypassed in the Bypass any failed server for box.
Configuring Settings for All Servers

You can use the Manage server farms task to specify the TCP/IP port used by the Citrix XML Service and the protocol used to transport Web Interface data between the Web server and the server running MetaFrame Presentation Server for those specified in the Servers list. The Citrix XML Service is a MetaFrame component that acts as the contact point between the server farm and the server running the Web Interface. By default, the port number is the value entered during site creation. This port number must match the port number used by the Citrix XML Service. Additionally, you can specify an expiration time for the ticket generated by the server. Ticketing provides enhanced authentication security for explicit logons by eliminating user credentials from the ICA files sent from the Web server to the client devices. Each Web Interface ticket has an expiration time of 200 seconds by default. If, for example, you want to adjust the time to your networks performance because expired tickets cannot successfully authenticate a user to the server farm, you can change the ticket time to live. If you change the IP address or addresses of a server running the Citrix XML Service, ticketing will not function until you restart the server. After changing a servers IP address or addresses, make sure you restart the machine. To specify settings for all servers 1. Click the Manage server farms task. 2. Click Add if you are adding a farm or Edit to configure an existing farm. 3. In the Settings for all servers area, enter the port number in the XML service port box. 4. In the Transport type list, select one of the following options: HTTP. Sends data over a standard HTTP connection. Use this option if you made other provisions for the security of this link. HTTPS. Sends data over a secure HTTP connection using SSL (Secure Sockets Layer) or TLS (Transport Layer Security). You must ensure that the Citrix XML Service is set to share its port with IIS and that IIS is configured to support HTTPS. SSL Relay. Sends data over a secure connection that uses the Citrix SSL Relay running on a server running MetaFrame Presentation Server to perform host authentication and data encryption.
51
5. If you are using SSL Relay, specify the TCP port of the Citrix SSL Relay in the SSL server port box (the default port is 443). The Web Interface uses root certificates when authenticating a Citrix SSL Relay server. Ensure all the servers running Citrix SSL Relay are configured to listen on the same port number. Note If you are using SSL Relay or HTTPS, ensure the server names you specify match the names on the certificate for the server running MetaFrame. 6. To enable ticketing, select the Enable ICA authentication tickets option. 7. To change the expiration time of tickets, enter appropriate values in the MetaFrame ticket time to live boxes. 8. Click OK to confirm your changes.
Specifying Advanced Server Settings

Using the Advanced settings in the Manage Server Farms dialog box, you can enable socket pooling and content redirection, specify the Citrix XML Service time-out duration, and specify the number of attempts made to contact the XML Service before it is considered failed. Enabling Socket Pooling When socket pooling is enabled, the Web Interface maintains a pool of sockets, rather than creating a socket each time one is needed and returning it to the operating system when the connection is closed. Enabling socket pooling enhances performance, particularly for SSL connections. Note In rare situations, pooled sockets may cause instability and should be disabled. Disabling pooled sockets will improve reliability, but may reduce performance. Socket pooling should not be used when the Web Interface is configured to use one or more MetaFrame for UNIX servers. To enable socket pooling 1. In the Manage Server Farms dialog box, click Advanced. 2. In the Socket Pooling area, select the Enable socket pooling check box.
52
Enabling Content Redirection

You can use the Enable content redirection setting to enable and disable content redirection from client to server for an individual Program Neighborhood Agent Services site. This setting overrides any content redirection settings configured for MetaFrame Presentation Server. When you enable content redirection from client to server, users running the Program Neighborhood Agent open published content and local files with applications published on servers. For example, a Program Neighborhood Agent user who receives an email attachment in a locally running email program opens the attachment in a published application. When you disable content redirection, users open published content and local files with locally installed applications. By default, content redirection is enabled from client to server for Program Neighborhood Agent Services sites. You configure content redirection from client to server by associating published applications with file types. For more information about file type association, see the MetaFrame Presentation Server Administrators Guide. To enable or disable content redirection 1. In the Manage server farms dialog box, click Advanced. 2. In the Content redirection area, do one of the following: To enable content redirection, select the Enable content redirection check box. Or To disable content redirection, clear the Enable content redirection check box.
Configuring XML Service Communication

By default the Citrix XML Service times out after one minute and is considered failed after five attempts are made to communicate with it. You can change these settings by altering the default values. To configure XML Service communication 1. In the Manage server farms dialog box, click Advanced. 2. To configure the Citrix XML Service time-out duration, enter appropriate values in the Socket timeout boxes. 3. To specify how many attempts are made to contact the Citrix XML Service before it is considered failed, during which it will be bypassed, enter a value in the Number of attempts before an XML service fails box.
53
Configuring Authentication
Note The following section is applicable to MetaFrame Presentation Server and Program Neighborhood Agent Services sites. You can use the Configure authentication methods task to configure the ways in which users can authenticate to MetaFrame Presentation Server and the Program Neighborhood Agent.
Methods of Authentication
Authentication takes place when a user accesses applications. If authentication is successful, the users application set is displayed. You can configure the following authentication methods: Explicit (MetaFrame Presentation Server sites) or Prompt (Program Neighborhood Agent Services sites). Users are required to log on by supplying a user name and password on IIS. User Principal Names (UPN), Microsoft domain-based authentication, and Novell Directory Service (NDS) are available. For MetaFrame Presentation Server sites, RSA SecurID, and SafeWord authentication are also available. Pass-through. Users can authenticate using the credentials they provided when they logged on to their Windows desktop on IIS. Users do not need to reenter their credentials and their application set is displayed automatically. Additionally, you can use Kerberos authentication to connect to servers. If you specify the Kerberos authentication option and Kerberos fails, pass-through authentication also fails and users cannot log on. For more information about Kerberos, see the MetaFrame Presentation Server Administrators Guide. Pass-through with smart card. Users can authenticate by inserting a smart card into a smart card reader attached to the client device on IIS. Pass-through authentication is enabled; thus, the user is not prompted for a PIN. If you are configuring a Program Neighborhood Agent Services site, you can use Kerberos authentication to connect to servers. If you specify the Kerberos authentication option and Kerberos fails, pass-through authentication also fails and users cannot log on. For more information about Kerberos, see the MetaFrame Presentation Server Administrators Guide. Smart card. Users can authenticate using a smart card on IIS. The user is prompted for a PIN.
54
Anonymous. Anonymous users can log on without supplying a user name and password, and launch applications published for anonymous users on the server. Note Citrix recommends that you do not enable anonymous user access if you are using MetaFrame 1.8 with Feature Release 1. When anonymous user access is enabled with this version of MetaFrame, users can view explicitly published applications.
CAUTION Web Interface anonymous users can obtain Secure Gateway tickets, despite not being authenticated by the Web Interface. Because the Secure Gateway relies on the Web Interface issuing tickets only to authenticated users, this compromises one of the security benefits of using the Secure Gateway in your installation.
Authentication Recommendations
Ensure users log on to their workstations and the Web Interface consistently, either explicitly (with a user name and password) or using smart cards, not a mixture of both methods. For example, if a user logs on to the Windows desktop using a smart card, and then logs on to the Web Interface explicitly, the credentials supplied by the client may be incorrect. In this case, the client may supply the PIN rather than the user name and password. If you change the methods for authenticating to the Web Interface, error messages may be displayed to existing users. Users must close and restart any browsers used to access the Web Interface.
Enabling Smart Card Authentication

Smart cards are credit card-sized plastic cards with embedded computer chips. Smart cards can contain memory only, memory with security logic, or memory with CPU capabilities. Smart cards can be used to secure communications over a network and to provide authentication between clients and servers. The user inserts the smart card into a smart card reader attached to the client device and then is prompted for a PIN. If smart card with pass-through authentication is enabled, users are prompted for a PIN when they log on to the client device. During all subsequent logons (and during application launches) users are not prompted again for their PIN. The following section provides information about smart card requirements and explains the steps that you must perform to enable smart card support. For an example of how to configure smart card authentication in the Web Interface, see ExampleEnabling Smart Card Authentication on page 56.
55
Smart Card Support Requirements

To use smart card authentication, the Web Interface must be running on IIS and users must be running Internet Explorer Version 5.5 or later on 32-bit Windows systems. Smart card support is not available on UNIX platforms. Secure Sockets Layer (SSL) must be enabled on the Web server. Because SSL is the mechanism underlying smart card technology, SSL must be used between the browser and Web server. See the Web server documentation for further information. If you want to enable smart card (with or without other authentication methods), you must configure the Log In page so it is accessible using HTTPS connections only. If plain HTTP is used or HTTPS is misconfigured, all users receive an error message and cannot log on. To avoid this problem, publish the full HTTPS URL to all users; for example, https://www.yourcompany.com:449/Citrix/MetaFrame. For more information about client device requirements and server requirements for smart card support, see the Client for 32-bit Windows Administrator's Guide and the MetaFrame Presentation Server Administrators Guide.
Step 1Installing the Full Client for Win32

You must install the full Client for Win32 on your users client devices, using an administrator account. The pass-through authentication feature is available only in the full Client for Win32 on the Components CD-ROM. For security reasons, the downloadable clients for Win32 do not include this feature. This means that you cannot use Web-based client installation to deploy clients containing this feature to your users.
Step 2Editing the Appsrv.ini File

If you want to enable pass-through authentication to reduce the number of prompts for the users PIN, you must edit the Appsrv.ini file, located in users profiles. For example, if a users profile is stored locally, this is located in C:\Documents and Settings\user\Application Data\ICAClient. (Note that Application Data is a hidden folder.) In the [WFClient] section, add the following entries:
EnableSSOnThruICAFile=On SSOnUserSetting=On
Note Enabling pass-through authentication poses a security risk. See the Caution in Pass-Through Requirements on page 58 for more information.
56
Step 3Enabling the Windows Directory Service Mapper

You must ensure the Windows Directory Service Mapper is enabled on the server running the Web Interface. Web Interface authentication uses Windows domain accountsthat is, user name and password credentials. However, certificates are stored on smart cards. The Directory Service Mapper uses Windows Active Directory to map a certificate to a Windows domain account. To enable the Windows Directory Service Mapper on IIS 5.0 1. Open Internet Information Service (IIS) Manager on the server running the Web Interface. 2. Right-click the Web Sites directory located under the server running the Web Interface and click Properties. 3. From the Internet Information Services tab, ensure WWW Service is shown in the Master Properties section and select Edit. 4. From the Directory Security tab, select Enable the Windows directory service mapper. 5. Click OK to enable the Directory Service Mapper. To enable the Windows Directory Service Mapper on IIS 6.0 1. Open Internet Information Service (IIS) Manager on the server running the Web Interface. 2. Right-click the Web Sites directory located under the server running the Web Interface and click Properties. 3. From the Directory Security tab, select Enable the Windows directory service mapper in the Secure Communications section. 4. Click OK to enable the Directory Service Mapper.
Step 4Enabling Smart Card Authentication Using the Console

You must configure the Web Interface to enable smart card authentication (so that users can access the Web Interface and display their application sets) and authentication to the server (so that users can launch applications in a client session using the Web Interface). To do this, use the Configure authentication methods task.
ExampleEnabling Smart Card Authentication

This example illustrates the steps required to allow a user to log on to the Web Interface and launch applications using a smart card.
57
You want to enable smart card authentication for the user Gary. Gary is using a Windows 2000 with Service Pack 4 client device. A smart card reader is attached to his client device and smart card support is configured on the server. Currently, the Web Interface is configured to allow only explicit authentication using a user name and password. To enable smart card authentication 1. Use the Components CD-ROM to install the full Client for Win32 on Garys client device. The installation of the client is performed using an administrator account. During installation of the Client for Win32, respond Yes to the prompt Would you like to enable and automatically use your local user name and password for Citrix sessions from this client? 2. Edit the Appsrv.ini file in Garys profile. This is located in C:\Documents and Settings\Gary\Application Data\ICAClient In the [WFClient] section, add the following entries:
3. Ensure that the Windows Directory Service Mapper is enabled. For more information, see Step 3Enabling the Windows Directory Service Mapper on page 56. 4. Use the Configure authentication methods task in the Access Suite Console to enable smart card authentication. When Gary selects Smart Card on the Log In page, he enters his PIN to log on (assuming he logged on to his Windows desktop using his smart card). Note If you do not want Gary to have to reenter his PIN when he logs on to the Web Interface, select Pass-through with smart card.
Enabling Pass-Through Authentication

Using the console, you can enable pass-through authentication for users logging on to their desktops with user name, password, and domain credentials. This feature allows users to authenticate using the credentials they provided when they logged on to their Windows desktop. Users do not need to reenter credentials and their application set is automatically displayed. The following section provides information about pass-through authentication requirements and explains the steps you must perform to enable pass-through support.
58
Pass-Through Requirements
To use the pass-through authentication feature, your servers must be running MetaFrame Presentation Server with Feature Release 2 or later, the Web Interface must be running on IIS on Windows 2000 with Service Pack 4 or Windows Server 2003, and users must be running Internet Explorer Version 5.5 or later. CAUTION If the servers are running versions prior to MetaFrame Presentation Server with Feature Release 2, users may be able to view all applications when using pass-through. If users are using clients earlier than Version 6.30 and ICA encryption (SecureICA) is enabled, pass-through will not work. To use pass-through with ICA encryption, you must have the latest clients and the server must be running MetaFrame Presentation Server with Feature Release 2 or later. CAUTION When a user selects an application, a file is sent to the browser. The file can contain a setting that instructs the client to send the users workstation credentials to the server. By default, the client does not honor this setting; however, there is a risk that if the pass-through feature is enabled on the MetaFrame Presentation Server Client for Win32, an attacker could send the user a file that causes the users credentials to be misrouted to an unauthorized or counterfeit server. Therefore, use pass-through authentication only in secure, trusted environments.
Step 1Installing the Full Client for Win32

You must install the full Client for Win32 on your users client devices, using an administrator account. Pass-through is available only in the full Client for Win32, available on the Components CD-ROM. For security reasons, the downloadable Client for Win32 does not include this feature. This means that you cannot use Web-based client installation to deploy clients containing this feature to your users. During installation of the Client for Win32, respond Yes to the prompt Would you like to enable and automatically use your local user name and password for Citrix sessions from this client? This enables pass-through authentication; until this feature is enabled, users of this client device cannot use it. Note If you do not enable pass-through during installation of the Client for Win32, you can enable it after installation. For more information about enabling this, see the Client for 32-bit Windows Administrator's Guide.
59
Step 2Editing the Appsrv.ini File

You must also edit the Appsrv.ini file, located in users profiles, to enable passthrough. For example, if a users profile is stored locally, this file is located in C:\Documents and Settings\user\Application Data\ICAClient. (Note that Application Data is a hidden folder.) In the [WFClient] section, add the following entries:
Step 3Enabling Pass-Through Using the Console

You must use the Access Suite Console to enable pass-through authentication. When you enable this feature, users do not need to enter their credentials again and their application set is automatically displayed. To enable pass-through authentication, use the Configure authentication methods task. Additionally, you can enable Kerberos with pass-through authentication for MetaFrame Presentation Server sites; and for Program Neighborhood Agent Services sites; you can also specify Kerberos for pass-through with smart card authentication.
Enabling Explicit or Prompt Authentication

If explicit or prompt authentication is enabled, users must have a user account and supply a user name, password, and a domain name to log on. You can change the explicit authentication settings using the console. For example, you can configure whether or not users are allowed to change their logon passwords within a session. To enable explicit or prompt authentication 1. Click the Configure authentication methods task. 2. Select Explicit or Prompt to force users to supply a user name and password to log on. 3. If you are configuring a MetaFrame Presentation Server site, you can select either RSA SecurID or SafeWord from the Enforce 2-factor authentication list. For more information about configuring SafeWord authentication, see Two-Factor Authentication on page 60. For more information about configuring RSA SecurID authentication, see Enabling RSA SecurID 6.0 Authentication on IIS on page 62. 4. If you are configuring a MetaFrame Presentation Server site, you can specify that users can change their logon passwords within a Web Interface session using the Allow user to change password options:
60
Select Never if you do not want to allow users to change their passwords. To let users change their logon password only when the password expires, select Only when it expires. When you enable this option, if a user fails to log on to the Web Interface due to an expired password, the user is redirected to the Change password dialog box. After changing their password, users are automatically logged on to the Web Interface using the new password. To let users change their password as often as they want in the Web Interface, select At any time. When you enable this option, the change password icon appears on users pages. When users click this icon, a dialog box appears where users can enter a new password.
If you are configuring a Program Neighborhood Agent Services site, you can specify if users can save their passwords using the Allow user to save password option. 5. Select the type of authentication that explicit users must use: Select Windows or NIS (UNIX) to specify Microsoft domain-based authentication. You can specify whether you allow any domains to be entered in the users Domain box, or specify which domains are permitted. Additionally, you can specify which User Principal Names (UPN) suffixes are accepted. By default, all UPN suffixes are permitted.
Note If users receive a wrong credentials error message during log on, this may be due to an empty domain box. To resolve this issue, select Hide Domain field during log in, or if you are using a mixed farm environment, add UNIX as the domain name and ensure it is the first item in the Domains list. Select Use NDS authentication to specify Novell Directory Service (NDS) authentication and enter a name in the Default tree name box. You can then configure context restriction or contextless authentication.
Note By default, eDirectory does not give anonymous connection access to the cn attribute, which is required for contextless logon. For information about how to reconfigure eDirectory, visit http://developer.novell.com/.
Two-Factor Authentication
You can configure the following two-factor authentication methods for MetaFrame Presentation Server sites:
61
Secure Computing SafeWord for Citrix. A two-factor authentication technology, using alphanumeric codes generated by SafeWord tokens and (optionally) PIN numbers to create a passcode. Users enter their domain credentials and SafeWord passcodes in the Log In page before they can access applications on the server. RSA SecurID. A two-factor authentication method that uses numbers generated by RSA SecurID tokens (tokencodes) and PIN numbers to create a PASSCODE. Users enter their user names, domains, and RSA SecurID PASSCODES on the Log In page before they can access applications on the server. When creating users on the ACE/Server, user logon names must be the same as their domain user names.
Note When using RSA SecurID authentication, the system can generate and display a new PIN to the user. This PIN is displayed for 10 seconds or until the user clicks OK or Cancel to ensure that the PIN cannot be viewed by others. This feature is not available on PDAs. For security reasons, users cannot log on using the Program Neighborhood Agent if the Web Interface is using RSA SecurID or Secure Computing SafeWord authentication.
Enabling Secure Computing SafeWord on IIS

The following section describes how to enable Secure Computing SafeWord support. By default, the SafeWord server port defaults to 5031, but this is configurable. The server running the Web Interface does not need to belong to the Active Directory domain where SafeWord is integrated.
SafeWord Requirements
To use SafeWord authentication with the Web Interface for IIS: The SafeWord Agent for the Web Interface must be installed on the server running the Web Interface The Web Interface must be installed prior to installing the SafeWord Agent for the Web Interface
SafeWord Agent for the Web Interface Requirements

If you are using the Web Interface for MetaFrame XP Version 2.0 or earlier and are using SafeWord for Citrix 1.1, you can upgrade to the Web Interface for MetaFrame Presentation Server Version 4.0.
62
If you do not have earlier versions of the Web Interface integrated with SafeWord, you must obtain an updated version of the SafeWord Agent for the Web Interface from Secure Computing. For more information about configuring your SafeWord product, see http://www.securecomputing.com/.
Enabling SafeWord Authentication Using the Console

You must configure the Web Interface to enable SafeWord authentication to the Web Interface (so that users can access and display their application set) and to the server (so that users can launch applications in a client session using the Web Interface). To do this, use the Configure authentication methods task.
Enabling RSA SecurID 6.0 Authentication on IIS

The following sections describe how to enable RSA SecurID support.
SecurID Requirements
To use SecurID authentication with the Web Interface for IIS: The RSA ACE/Agent for Windows 6.0 must be installed on the server running the Web Interface The Web Interface must be installed after the installation of the ACE/Agent
Adding the Server Running the Web Interface as an Agent Host

You must create an Agent Host for the server running the Web Interface in the RSA ACE/Server database, so that the RSA ACE/Server recognizes and accepts authentication requests from the server running the Web Interface. When creating an Agent Host, select Net OS Agent from the Agent type list.
Copying the sdconf.rec File

Locate (or if necessary, create) the sdconf.rec file on the RSA ACE/Server and copy it to the %SystemRoot%\System32 directory on the server running the Web Interface. This file provides the server with the information necessary to connect to the RSA ACE/Server.
Enabling RSA SecurID Authentication Using the Console

You must configure the Web Interface to enable RSA SecurID authentication to the Web Interface (so that users can access and display their application set) and to the server (so that users can launch applications in a client session using the Web Interface). To do this, use the Configure authentication methods task.
63
Node Secret Registry Key Considerations

The node secret is used to ensure secure communication between the server running the Web Interface and the RSA ACE/Server. The node secret can become out of sync between these two servers in the following circumstances: If the server running Web Interface is reinstalled If the Agent Host record for the server running the Web Interface is deleted and then added again If the Node Secret Created box is not selected in the Edit Agent Host dialog box on the RSA server If the RSA server is reinstalled If the node secret registry key is deleted on the server running the Web Interface
If the node secret on the server running the Web Interface and the RSA ACE/Server does not match, RSA SecurID fails.You must reset the node secret on the server running the Web Interface and the RSA ACE/Server. CAUTION Using Registry Editor incorrectly can cause serious problems that may require you to reinstall your operating system. Citrix cannot guarantee that problems resulting from the incorrect use of Registry Editor can be solved. Use Registry Editor at your own risk. To reset the node secret on the server running the Web Interface 1. In the system registry, navigate to: HKEY_LOCAL_MACHINE\SOFTWARE\SDTI\ACECLIENT 2. Delete the NodeSecret key. Note Reinstalling the Web Interface does not delete the node secret key. If the Agent Host entry remains unchanged on the RSA server, the node secret can be reused.
64
RSA SecurID Multiple Domain Support

If you have user accounts that share the same user name but exist in different Windows domains, you must identify them in the RSA ACE/Server database with a default log in using the form DOMAIN\username (as opposed to username only), and configure the Web Interface to send the domain and user name to the ACE/ Server, using the Web Interface Console authentication methods wizard.
Enabling RSA SecurID 6.0 Windows Password Integration

The Web Interface for IIS supports the Windows password integration feature that is available with RSA SecurID 6.0. With this feature enabled, users of the Web Interface can log in and launch applications with their SecurID PASSCODE. Users need only supply a Windows PASSCODE the first time they log on to the Web Interface or when their password needs to be changed. To use SecurID 6.0 Windows password integration with the Web Interface for IIS: The RSA ACE/Agent Local Authentication Client for Windows 6.0 must be installed on the server running the Web Interface (administrators must log on to the Web Interface using local machine administrator credentials) The Web Interface must be installed after the installation of the ACE/Agent The RSA Authentication Agent Offline Local service must be running on the server running the Web Interface The Agent Host for the server running the Web Interface in the RSA ACE/ Server 6.0 database must be configured to enable the Windows password integration feature The database system parameters must be configured to enable the Windows password integration feature at the system level
Enabling Two-Factor Authentication on UNIX

The following sections describe how to enable Secure Computing SafeWord and RSA SecurID support on UNIX. For JSP (UNIX) sites, the Web Interface uses the Remote Authentication Dial In User Service (RADIUS) authentication protocol (as opposed to the proprietary agent software that must be installed for IIS sites). Both SafeWord and SecurID can be installed and configured to be presented as a RADIUS server.
65
Enabling RADIUS with SafeWord

When installing the SafeWord server software, choose to install the IAS RADIUS Agent. Follow the on-screen instructions regarding installation of the RADIUS client(s) with the Windows IAS snap-in. A new RADIUS client needs to be configured for each server running the Web Interface that authenticates users against the SafeWord server. Each RADIUS client created must be provided with the following: The fully qualified domain name or IP address of the server running the Web Interface with which the RADIUS client is associated. A secret, that is known to the associated server running the Web Interface. For more information, see Creating a Shared Secret for RADIUS on page 66. The client type should be set to RADIUS standard. The Request must contain the Message Authenticator attribute option must be enabled for extra security.
Enabling RADIUS with RSA SecurID

RADIUS is enabled on the ACE/Server using the SecurID 6.0 Configuration Management Tool. For more information about this tool, see the RSA documentation provided with the SecurID software.
Adding the Web Interface and RADIUS Servers as Agent Hosts

Assuming the ACE/Server that authenticates users will also act as the RADIUS server, you must create an Agent Host for the local RADIUS server running in the RSA ACE/Server database. When creating the Agent Host, set the name and IP address to that of the local server, and select Net OS Agent from the Agent type list. The local server must be assigned as the acting server. In addition, you must create an Agent Host for each server running the Web Interface in the RSA ACE/Server database so that the RSA ACE/Server recognizes and accepts authentication requests from the server running the Web Interface through the RADIUS server. When creating this Agent Host, select Communication Server from the Agent type list, and set the encryption key to the value of the secret that is shared with the Web Interface. For more information, see Creating a Shared Secret for RADIUS on page 66.
66
Creating a Shared Secret for RADIUS

The RADIUS protocol requires the use of a shared secretdata that is known only to the RADIUS client (that is, the Web Interface) and the RADIUS server against which it authenticates. The Web Interface stores this secret in a text file on the local file system. The location for this file is indicated in the web.xml file in the radius_secret_path parameter stored on the UNIX server. To create the shared secret, create a text file called radius_secret.txt containing any string. Move this file to the location specified in the web.xml file, and ensure that it is locked down and can be accessed only by the appropriate users or processes.
Enabling RADIUS Two-Factor Authentication Using the Console

You must enable two-factor authentication to the Web Interface (so that users can access and display their application set) and to the server (so that users can launch applications in a client session using the Web Interface). To do this, use the Configure authentication methods task in the Access Suite Console. For JSP (UNIX) sites, in addition to enabling two-factor authentication, you can specify one or more RADIUS server addresses (and optionally ports), the load balancing or failover behavior of the servers, and the response time-out.
Using RADIUS Challenge Mode

By default, the SecurID RADIUS server is in RADIUS Challenge Mode. In this mode: The Web Interface displays a generic challenge screen with a message, an HTML password box, and OK and Cancel buttons. Challenge messages are not localized by the Web Interface. Messages are in the language of the challenge messages set on the SecurID RADIUS server.
If users do not submit a response (for example, if they click Cancel), they are directed back to the Login page. Citrix recommends that this mode is used only if software components or products other than the Web Interface also use the RADIUS server for authentication.
Using Customized Challenge Messages

You can configure customized challenge messages for the SecurID RADIUS server. When using custom messages that are known to the Web Interface, it can present user interface pages identical to those displayed by the Web Interface for IIS, and these pages are localized. This feature requires changes to the RADIUS server configuration and must be implemented only if the RADIUS server is used to authenticate Web Interface users.
67
You can change challenge messages by launching the RSA RADIUS Configuration Utility. For more information about using this tool, see the RSA documentation provided with the SecurID software. To display the same messages to users accessing sites on IIS and UNIX servers, the following challenges must be updated:
Message For Does User Want a System PIN Is User Ready To Get System PIN Is User Satisfied With System PIN New Numeric PIN of Fixed Length New Alphanumeric PIN of Fixed Length New Numeric PIN of Variable Length New Alphanumeric PIN of Variable Length New PIN Accepted Enter Yes or No Next Token Code Required Packet Challenge Challenge Challenge Challenge Challenge Challenge Challenge Challenge Challenge Challenge Updated Value CHANGE_PIN_EITHER SYSTEM_PIN_READY CHANGE_PIN_SYSTEM_[%s] CHANGE_PIN_USER CHANGE_PIN_USER CHANGE_PIN_USER CHANGE_PIN_USER SUCCESS FAILURE NEXT_TOKENCODE
Changing Session Options

Note The following section is applicable to Program Neighborhood Agent Services sites only. You can use the Change session options task to configure the following settings for user sessions: Window sizes. Use these options to select the window sizes available for ICA sessions, and to define custom sizes in pixels or screen percentage. Color. Options enabled in this section are available for users to select. Windows key combinations. Use these options to enable the targets of Windows key combinations that users can select. Windows key combinations do not affect seamless connections. You can provide options in the users Connection Preference screen for the following modes: Local. Key combinations apply to the local desktop only; they are not passed to the ICA sessions. Remote. Key combinations apply to the remote desktop in the ICA session.
68
Full screen only. Key combinations apply to the remote desktop in the ICA session only when it is in full screen mode.
Audio. Options enabled in this section are available for users to select. Workspace control options. Use these options to configure workspace control settings. For more information about workspace control, see Configuring Workspace Control on page 86.
Managing Application Shortcuts

Note The following section is applicable to Program Neighborhood Agent Services sites only. You can use the Manage application shortcuts task to specify how the Program Neighborhood Agent displays shortcuts for published applications. You can create the following types of shortcuts: Start menu. You can use the settings specified in the Manage application shortcuts page, settings defined during application publishing in MetaFrame Presentation Server, or use both settings. You can also define how and if shortcuts are displayed in the Start menu, and allow users to specify this setting. Additionally, you can create shortcuts in the Programs menu, create an additional submenu, and/or allow users to specify a submenu name. Desktop. You can use the settings specified in the Manage application shortcuts page, settings defined during application publishing in MetaFrame Presentation Server, or use both settings. You can also define how and if shortcuts are displayed on the desktop, and allow users to specify this setting. Additionally, you can use a custom folder name, allow users to select a name, and/or use a custom URL for icons. Notification area. You can display applications in the notification area and/or allow users to specify how applications are displayed.
Using the Manage application shortcuts task, you can also remove shortcuts. You can specify when shortcuts are removed (either when the Program Neighborhood Agent closes or when users log off from the Program Neighborhood Agent), and which shortcuts are removed (Program Neighborhood shortcuts or Program Neighborhood and user-created shortcuts). If you select both Program Neighborhood and user-created shortcuts, you can also specify the search folder depth to improve performance.
69
Managing Server Settings

Note The following section is applicable to Program Neighborhood Agent Services sites only. Use the Manage server settings task to enable: SSL/TLS for communication. Smart card logon and SSL/TLS-secured communications between the client and the server running the Web Interface are not enabled by default. You can enable SSL/TLS communication from this page, forcing URLs to apply the HTTPS protocol automatically. In addition, you must enable SSL on the server running MetaFrame Presentation Server. Allow users to customize the server URL. The server URL points the Program Neighborhood Agent to the correct configuration file. The default path is determined based on the server address entered by the user during installation of the agent. You can allow users to change the server URL, which enables the Server URL option on the Server tab of the Properties dialog box. Automatic refresh. You can define how often the client should refresh its configuration settings. Configuration redirection. You can define when users are redirected to a different serverat connection time or a scheduled client refresh.
Customizing the Appearance for Users

Note The following section is applicable to MetaFrame Presentation Server and Conferencing Manager Guest Attendee sites. You can customize the appearance of the user interface if, for example, you want the site to have a specific corporate look and feel. Use the Customize appearance for user task to customize: Overall Layout. Customize the users overall screen layout or allow users to customize the layout. You can select auto, full display, or compact screen layout. A compact user interface may be useful, for example, for users accessing their applications on PDAs. This interface does not contain the welcome message and message center areas, and does not show client installation captions. Additionally, messages are displayed above the main page. Branding. Format the users screen with a customized look and feel by displaying headers and footers, branding colors, header images, and logo images. Additionally, you can create a hyperlink for logos.
70
Applications window. Specify the window title bar color and image, title bar text color, number of application icon columns that are displayed, and allow users to customize these settings. Welcome area. Specify the title bar background color, title bar text color, welcome message text language, welcome message text, and any additional languages.
The graphics in these option pages update as you make your changes, and are reflected in the main Customize appearance for user page.
Managing Secure Client Access

Note The following section is applicable to MetaFrame Presentation Server and Conferencing Manager Guest Attendee sites. If you are using a firewall or the Secure Gateway in your MetaFrame Presentation Server deployment, you can use the Manage secure client access tasks to configure the Web Interface to include the appropriate settings. For example, you can configure the Web Interface to provide an alternate address, if the server is configured with an alternate address and the firewall is configured for Network Address Translation. This section explains how to use the Manage secure client access tasks to edit demilitarized zone (DMZ) settings, configure Secure Gateway settings, edit address translations, and how to display your settings in the details pane.
Editing DMZ Settings

You can configure client addresses, masks, and access methods using the Edit DMZ settings task. The order in which entries appear in the client address table is the order in which the rules are applied. For example, the access method specified for all client machines is applied first, then applied in the order of the rules in the table. To add or edit a client route 1. From the Edit DMZ settings dialog box, click Add to add a new client route or Edit to edit an existing client route. 2. Enter the network address and subnet mask that identify the client network. 3. Select an access method from the following options: Direct. The IP address given to the client is the actual address of the server. This is the default setting.
71
Alternate. The alternate address is given to the client. The server must be configured with an alternate address and the firewall configured for network address translation. Translated. The address given to the client is determined by the address translation mappings set in the Web Interface. Secure Gateway Direct. Secure Gateway Alternate. Secure Gateway Translated.
4. Click OK to finish making changes.
Editing Secure Gateway Settings

If you are using Secure Gateway in your MetaFrame Presentation Server installation, you must configure the Web Interface for Secure Gateway support. To do this, use the Edit Secure Gateway settings task. The Secure Gateway acts as a secure Internet gateway between SSL/TLS-enabled clients and servers. The Internet portion of traffic between client devices and the Secure Gateway server is encrypted using SSL/TLS. Users can access information remotely without compromising security. The Secure Gateway also simplifies certificate management, because you require a certificate only on the Secure Gateway server, rather than on every server in the farm. The Secure Gateway transparently encrypts and authenticates all connections to protect against eavesdropping and data tampering. The Secure Gateway safely and easily extends access to server farms over the Internet to remote workers and telecommuters in a simplified, cost effective, secure manner. The Secure Gateway uses existing Citrix technologies and security infrastructure to provide a clientspecific security layer that protects Citrix client/server communications on your network.
The Secure Gateway works with the Web Interface to provide a single, secure, encrypted point of access through the Internet to servers on internal corporate networks. This means office workers can access corporate information remotely, without compromising network security, from anywhere in the world, from any device, and at any time. Secure Gateway ticketing (STA) is the mechanism used to notify the Secure Gateway that a user is authenticated and can be granted access to the server farm. Tickets are generated and verified by the Secure Ticket Authority server. When a user selects an application, the Web Interface sends the address of the server on which the application resides to the Secure Ticket Authority in return for a ticket. This ticket is later exchanged by the Secure Gateway for the address of the server.
72
The use of tickets enhances security, because the internal network addresses of servers are hidden. See Editing Address Translations on page 73 for an example of how to configure Secure Gateway support. For more information about the Secure Gateway, see the Secure Gateway for MetaFrame Administrators Guide. To edit Secure Gateway settings 1. From the Edit Secure Gateway settings dialog box, specify the fully qualified domain name (FQDN) of the Secure Gateway server that clients must use in the Secure Gateway address (FQDN) box. This must match what is on the certificate installed on the Secure Gateway server. 2. Specify the port number on the Secure Gateway server that clients must use in the Secure Gateway port box. The default port number is 443. 3. To use session reliability, select the Enable session reliability through Secure Gateway 3.0 option. 4. In the Secure Ticket Authorities area, click Add to specify the URL of a Secure Ticket Authority that the Web Interface can use. The Secure Ticket Authority is displayed in the Secure Ticket Authority URLs list. Secure Ticket Authorities are included with the XML service, for example, in http://mfsrv01/Scripts/CtxSta.dll. Secure Ticket Authorities are generally used for fault tolerance; however, Citrix recommends that you do not use an external load balancer for this purpose. You can specify up to 256 Secure Ticket Authorities in this list. 5. To place the Secure Ticket Authorities in order of priority, highlight a Secure Ticket Authority URL and click Move Up or Move Down. To remove a Secure Ticket Authority URL, highlight it in the list and click Remove. 6. Choose whether or not to enable load balancing between Secure Ticket Authorities using the Use for load balancing option. Enabling load balancing allows you to evenly distribute connections among servers so that no one server becomes overloaded. If an error occurs while communicating with a server, all further communication is load balanced among the remaining servers in the list. 7. The Web Interface provides fault tolerance among servers in the Secure Ticket Authority list. If an error occurs while communicating with a server, the failed server is bypassed for the time specified in the Bypass any failed server for box. 8. Click OK to finish making changes.
73
Editing Address Translations

Using the Edit address translations task, you can map the server address to the address and port translated by the internal firewall. Users can then launch applications if the address and port of the server is translated at the internal firewall. You can use the Web Interface to define mappings from internal IP addresses to external IP addresses and ports. For example, if your server is not configured with an alternate address, you can configure the Web Interface to provide an alternate address. To configure internal firewall address translation 1. In the Edit address translations page, click Add to add an address translation or Edit to edit an existing address translation. 2. In the Access type area, select one of the following: Client route translation, Secure Gateway route translation, or Both. 3. In the Internal IP address box, enter the normal (internal) IP address of the server. 4. In the Internal port box, enter the port number of the server. 5. In the External address box, enter the translated (external) IP address or host name that clients must use to connect to the server. 6. In the External port box, enter the port number of the server. 7. Click OK. The mapping appears in the Address Translation table. 8. To remove a mapping, select the mapping in the Address Translation table and click Remove.
Displaying Secure Client Access Settings

Use the Display settings task to view all secure client access settings that are currently configured for the site. You can view the different configurations for each secure client access task using the View drop-down menu, and you can click the link in the display to launch the pages associated with that task.
74
Managing Client Deployment

Note The following section is applicable to MetaFrame Presentation Server and Conferencing Manager Guest Attendee sites. To access applications or log on to conferences, users must have a supported Web browser and a MetaFrame Presentation Server Client or Remote Desktop Connection software. Use the Manage client deployment task to specify which clients are deployed. Users can launch applications using only the clients specified in this task. You can: Configure Web-based client installation. This feature allows you to easily deploy and install the appropriate clients on your users devices using installation captions. Installation captions are links that are presented to users who require a client. Users click a link to install the client on their client device. Configure the Web Interface to automatically deploy the smaller Web client installation or the full Client for Win32 to Windows users accessing applications through Internet Explorer. Configure the Web Interface to deploy Remote Desktop Connection software. Enable users to choose how their applications are launched. Specify the components included in the Client for Java deployment or allow users to select the components that they require.
Client Settings
The following clients are available for application launching: Local client. The full client is automatically deployed to users, including seamless window support. Applications are launched in desktop windows that can be resized. If users are accessing applications through a PDA device, you must enable the local client. Native embedded client (ActiveX or Netscape plugin). Users download and install this client when applications are launched. Seamless windows are not supported; applications are launched in a fixed-size window. Client for Java. The Client for Java is automatically deployed to users. This client supports seamless windows; applications are launched in desktop windows that can be resized. Embedded Remote Desktop Connection software. Remote Desktop Connection software is automatically deployed to users. Seamless windows are not supported; applications are launched in a fixed-size window.
75
You must specify a default client. To do this, select a client and use the Set as default button in the Manage client deployment wizard. Note The native embedded client and embedded Remote Desktop Connection software are not supported on Personal Digital Assistants (PDAs) running Pocket PC.
Remote Desktop Connection Requirements

Remote Desktop Connection functionality is available on 32-bit Windows systems with Internet Explorer 5.5 or later. If you are configuring a Conferencing Manager Guest Attendee site and users will connect using Remote Desktop Software, ensure that conferences are created using a color depth of 256 or lower. Otherwise, users connecting with Remote Desktop Software will receive an error message and will be unable to log in. If the clients browser does not place the Web Interface site in the intranet or the Trusted Sites zone, it will display an error message and refer the user to the online help for more information. In this instance, Citrix recommends that users be advised of the following procedure. To add the server running the Web Interface to the Trusted Sites zone 1. In Internet Explorer, open the Tools menu. 2. Select Internet Options. 3. Open the Security page. 4. Select Trusted Sites. 5. Click Sites. 6. In the Add this Web site to the zone box, enter the name of the server running the Web Interface; for example, http://servername. 7. Click Add to add the server to the Web sites list. 8. Click OK twice to close the Internet Options dialog box.
Automatically Deploying Clients

You can automatically deploy the Client for Java if, for example, the client is not installed on the users local machine. To enable automatic fallback to the Client for Java 1. In the Manage client deployment wizard, select Local client and/or Native embedded client.
76
2. Select Client for Java and click Next. 3. In the Specify launch client settings page, select the Automatic fallback to the Client for Java option. 4. Continue through the rest of the wizard and click Finish to accept the changes. Note The Client for Java must be deployed for users connecting with a Safari Web browser. Additionally, you can automatically deploy the Web client to users running Internet Explorer. If you enable this feature, when users access the Web Interface, their client devices and Web browser are detected. If they are on a Windows platform and they do not have a client, or their current client is not up-to-date, the Web Interface attempts to install the specified client on their client devices automatically. Users install the client by clicking Yes in the dialog box that appears. You can deploy the minimal Web client installation file (wficac.cab). This client does not install all components (such as Program Neighborhood); therefore, this client is smaller and easier to download and may be suitable for users on low bandwidth connections. The following features are not available using the minimal Web client: SecureICA (RC5) encryption Universal Printer Driver SpeedScreen latency reduction Client audio mapping Wheel mouse support Multiple monitor support User-to-user shadowing Content redirection Novell Directory Services support Extended parameter passing Client COM port mapping
77
Panning and scaling Per-user time zone support Support for protocols other than TCP/IP Single sign-on
For more information about the features available in the Web clients, see the Client for 32-bit Windows Administrator's Guide. To enable the Web client download option, select the Automatically update the Web Client at log on option in the Manage client deployment task. Note Automatic installation of the Web client on Windows workstations requires the user to have administrative rights on the client device, or that the ActiveX control be registered in Active Directory. See the Microsoft support Web site for more details.
Configuring Installation Captions

You can deploy and install the appropriate clients on users devices. If you deploy the local client or the Client for Java, the Web Interface detects the users client device and Web browser and displays a link to download the appropriate client installation file, if necessary. The user clicks this link to install the client on the users client device. These links are called installation captions. For example:
This screen capture shows an example of an installation caption that may appear in the users Log In page.
Note To use Web-based client installation, ensure your Web server contains the client installation files. For more information about Web-based client installation, see MetaFrame Presentation Server Clients and the Web Interface on page 117.
78
You can use one of the following settings: Auto. If the user does not have an appropriate client installed, the installation caption is displayed. This is the default setting and is valid for the Client for Win32 only. Yes. The installation caption is always displayed on all platforms. No. The installation caption is never displayed.
To configure the clients offered to users by installation captions, you must edit the WebInterface.conf file. For more information, see Configuring Web-Based Client Installation on page 119 and Configuring the Web Interface Using the Configuration File on page 91.
Compatibility with Asian Language Web Servers

You can configure the Web Interface to generate ICA files in Unicode, which increases the number of non-European language characters clients recognize. ICA files are text files that contain parameters and instructions for launching published applications. This feature works only with clients available with MetaFrame Presentation Server 3.0 and later; earlier versions of the clients do not support Unicode ICA files. To ensure that ICA files are in Unicode, select the Support version 8 or later of the clients option.
Customizing the Client for Java Deployment

You can configure the components included in the deployment of the client for Java. The size of the Client for Java download is determined by the packages you include in the download. The fewer packages selected, the smaller the download (the download can be as small as 540K). If you want to limit the size of the download for users on low bandwidth connections, you can deploy only a minimum set of components. Alternatively, you can enable users to control which components are required. Note Some components that you make available in the Client for Java may require further configuration on the client device or on the server. For more information about the Client for Java and its components, see the Client for Java Administrators Guide.
79
The following table explains the options available:

Package Audio Description Enables applications running on the server to play sounds through a sound device installed on the client device. You can control the amount of bandwidth used by the client audio mapping on the serversee the MetaFrame Presentation Server Administrators Guide for information. Enables users to copy text and graphics between server-based applications and applications running locally on the client device. Accelerates the display of the input text on the client device. Secures communication using Secure Sockets Layer (SSL) and TLS (Transport Layer Security). SSL/TLS provides server authentication, encryption of the data stream, and message integrity checks. Provides strong encryption to increase the privacy of client connections. Enables users to access their local drives from within a client session. When users connect to the server, their client drives are mounted automatically, such as floppy disks, network drives, and CD-ROM drives. Users can access their locally stored files, work with them during their client sessions, and save them again on a local drive or on a drive on the server. To enable this setting, users must also configure client drive mapping in the Client for Java Settings dialog box. See the Client for Java Administrators Guide for more information. Enables users to print to their local or network printers from within a client session. Enables the Client for Java Settings dialog box. This dialog box is utilized by users to configure the Client for Java.
Clipboard Local text echo SSL/TLS
Encryption Client drive mapping
Printer mapping Configuration UI
Using Private Root Certificates with the Client for Java Version 9.x
If you configured a Secure Gateway or the Citrix SSL Relay service with a server certificate obtained from a private certificate authority (for example, if you issue your own certificates using Microsoft Certificate Services), you must import the root certificate into the Java keystore on each client machine. For more information, see the Client for Java Administrators Guide.
Using Private Root Certificates with the Client for Java Version 8.x
To use private root certificates with Version 8.x of the client, select the Use a private root certificate option. Enter the file name of the certificate in the Certificate file name box. The certificate must be located in the same directory on the Web server as the Java Client packages (such as ICAWEB\icajava in the common files directory on IIS).
80
Important This option does not verify that the root certificate is delivered over a secure connection. Because the root certificate could be transmitted over an unencrypted HTTP link, it is potentially vulnerable to attack. Citrix recommends that you configure the Web server to use HTTPS connections.
Deploying the Client for Java Using the Web Interface with Custom SSL/TLS Certificates
Use the following procedure to configure the Web Interface to use a single custom SSL root certificate if you are using the Client for Java Version 8.x. The certificate is made available to the Java Client as an individual file in the clients codebase directory on the Web server. This can cause problems for .cer files because IIS sends these using MIME text and the file can become corrupted during transport (for example, line endings change). Also, some Java Virtual Machines (JVM), such as the IBM JVM on OS/2, will not retrieve certificates when specified as individual files. Citrix recommends that you package custom root certificates into a single archive file to supply multiple certificates. This procedure is documented in the Client for Java Administrators Guide. The following procedure describes how to configure custom certificates using the Web Interface and the Client for Java. To configure custom certificates 1. Contact your Certificate Authority and obtain the root certificates that correspond to the server certificates being used on the servers. 2. In a text editor, locate and open the appembedJICA.inc file. By default, this is located in C:\Inetpub\Wwwroot\Citrix\MetaFrame\site\include. 3. Locate the section between the <applet> and </applet> HTML tags. 4. Before the </applet> tag, specify which SSL/TLS certificates the Client for Java should use. Use the following parameters: SSLNoCACerts. The number of specified certificates in the client archive.
81
SSLCACert0, SSLCert1...SSLCertn. The names of the root certificates to use when validating the name of the server certificate. The number of root certificates that you specify must match the number specified in the SSLNoCACerts parameter.
For example, if you have three custom root certificates with filenames A.crt, B.crt, and C.cer, insert the following lines: <param name="SSLNoCACerts" value="3"> <param name="SSLCACert0" value="A.crt"> <param name="SSLCACert1" value="B.crt"> <param name="SSLCACert2" value="C.cer"> 5. Search for the codebase parameter and make a note of the path listed on this line. <%=langCode%> is the folder name of the language with which you are working. Do not edit this line. 6. If the client will be deployed in Microsoft Internet Explorer with the Microsoft JVM, package the certificates in a .cab file. For more information, see the Client for Java Administrators Guide. 7. Search for the cabinets parameter. Add the name of the archive you created in Step 6. For example, if you named your archive MyCerts.cab, change the following: <param name=cabinets value="<%=jicaCabFiles%>"> to <param name=cabinets value="<%=jicaCabFiles%>MyCerts.cab"> 8. Copy your archive file to the directory specified in the codebase attribute that you noted in Step 5. The default path is C:\Inetpub\Wwwroot\Citrix\ICAWEB\en\icajava. 9. Save the appembedJICA.inc file. 10. On the client device, launch the Web browser and connect to the server running the Web Interface. All embedded Java Client sessions to secured servers work transparently using SSL.
82
Editing Client-Side Proxy Settings

Note The following section is applicable to MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. If you are using a proxy server at the client-side of the Web Interface installation, you can configure whether or not clients must communicate with the server through the proxy server. You use the Edit client-side proxy task to do this. A proxy server positioned at the client-side of a Web Interface installation provides security benefits that include: Information hiding, where system names inside the firewall are not made known to systems outside the firewall through DNS (Domain Name System) Channeling different TCP connections through one connection
Using the Access Suite Console, you can set default proxy rules for clients. However, you can also configure exceptions to this behavior for individual clients. To configure exceptions, you associate the proxy servers external IP address with the proxy servers internal address and port. You can also specify that proxy behavior is controlled by the client. For example, to use the Secure Proxy feature in MetaFrame Presentation Server, configure the Web Interface to use the proxy settings specified on the client and configure the client for Secure Proxy. For more information about using clients to control proxy behavior, see the relevant MetaFrame Presentation Server Client Administrators Guide. To configure default proxy settings 1. Click the Edit client-side proxy task. 2. Click Add to create a new mapping or Edit to edit an existing mapping. 3. Enter the external address of the proxy in the IP Address box. 4. Enter the subnet mask in the Subnet Mask box. 5. In the Proxy list, select one of the following: Auto detect. The client auto-detects the Web proxy based on the clients browser configuration. Client defined. The settings configured by the user for the client. None. No proxy is used. SOCKS. If this option is selected, you must enter the address of the proxy server in the Proxy Address box and the port number in the Proxy Port box. The proxy address can be an IP address or a DNS name.
83
Secure (HTTPS). If this option is selected, you must enter the address of the proxy server in the Proxy Address box and the port number in the Proxy Port box. The proxy address can be an IP address or a DNS name.
6. Click OK. The mapping is added to the Mapping list. 7. You can control the order in which multiple mappings are applied. Select a mapping and click Move Up or Move Down to place the mappings in order of priority. To remove a mapping, select the mapping and click Remove.
Managing Client Connection Settings

Note The following section is applicable to MetaFrame Presentation Server and Conferencing Manager Guest Attendee sites. Using the Manage client connection settings task, you can specify the settings that users can adjust. For MetaFrame Presentation Server sites, you can enable or specify whether or not users can adjust the following options: Bandwidth control Color depth Audio quality Printer mapping Window size PDA synchronization settings Windows key combinations Kiosk mode
84
Bandwidth control allows users to select session settings based on their connection bandwidth. These options are displayed in the Log In page under Advanced Options in the Connection Speed drop-down list. Bandwidth control provides control for color depth, audio, and printer mapping. To enable this feature, you must also select Allow user to customize printer mapping in the Manage client connection settings task. Additionally, you can use ICA override files to control other ICA settings for bandwidth control:
File Name bandwidth_ high.ica bandwidth_ medium_high.ica bandwidth_ medium.ica bandwidth_low.ica default.ica Description Contains the override ICA settings for high bandwidth connections. Contains the override ICA settings for medium high bandwidth connections. Contains the override ICA settings for medium bandwidth connections. Contains the override ICA settings for low bandwidth connections. Contains the override ICA settings used when no bandwidth is selected.
If the Client for Java is used, bandwidth control determines whether or not audio and printer mapping packages are downloaded. If Remote Desktop Connection is used, audio quality is either mapped to On or Off and further quality control is not provided. Low bandwidth is recommended for wireless WAN connections. Note If Remote Desktop Connection is used in conjunction with bandwidth control, the Web Interface specifies parameters appropriate to the selected bandwidth. However, the actual behavior depends on the version of the Remote Desktop Software, Terminal Servers, and the server configuration. By default, users can adjust the window size of client sessions. For Conferencing Manager Guest Attendee sites, you can configure: Windows key combinations Kiosk mode
Kiosk mode is ideal for situations in which client devices are public terminals and used by a variety of users. When kiosk mode is enabled, users settings are not stored and are retained only for the duration of their session. If you prevent users from adjusting a setting, the setting is not displayed in the user interface and the settings specified for the published application in the Management Console for MetaFrame Presentation Server are used.
85
Managing Client Configuration Files

Note The following section is applicable to Program Neighborhood Agent Services sites only. The Program Neighborhood Agent options configured with the console are stored in a configuration file on the server running the Web Interface (for sites using local configuration) or in the Configuration Service for a server farm (for sites using centralized configuration). The configuration file controls the range of parameters that appear as options in the userss Properties dialog box. Users can choose from available options to set preferences for their ICA sessions, including logon mode, screen size, audio quality, and the locations of links to published resources. For locally configured sites, a default configuration file, config.xml, is installed with default settings and is ready for use without modification in most network environments. The config.xml file is stored in the \conf\clientconfigs directory for the site. New and backup configuration files that you create using the Access Suite Console are stored in the same folder as the default configuration file. Use the Export client configuration task to save a copy of the selected config.xml file to another location (such as a file directory) and the Delete client configuration task to remove a selected client configuration from the site. CAUTION Using multiple client configuration files (config.xml) is not supported in Version 4.2. A Program Neighborhood Agent Services site that has multiple client configurations accepts authentication from any of the methods specified in any of the sites client configurations. If you need different client configurations, use multiple sites to ensure that security conflicts are avoided. Existing sites that have multiple client configurations can be managed as in previous releases. However, new client configurations cannot be created.
86
Using Application Refresh Options

Note The following section is applicable to Program Neighborhood Agent sites only. Use the Manage application refresh task to specify when the users list of published resources is refreshed and if users can customize these settings. You can enable refresh when the Program Neighborhood Agent starts up, when applications are launched, and specify how often the list is refreshed.
Configuring Workspace Control

Note The following section is applicable to MetaFrame Presentation Server sites only. Use the Manage workspace control task to allow users to quickly disconnect all running applications, reconnect to disconnected applications, and log off from all running applications. This allows users to move between client devices and gain access to all of their applications (disconnected only or disconnected and active) either when they log on or manually at any time. For example, hospital workers may need to move between workstations and access the same set of applications each time they log on to MetaFrame Presentation Server. Note Workspace control cannot be used with the Client for Windows CE, the Client for Win32 prior to version 8, or Remote Desktop Connection software. Additionally, this feature works only with servers running MetaFrame Presentation Server Version 3.0 or later.
Feature Requirements
The following requirements and recommendations apply to the workspace control feature: If the Web Interface detects that it is being accessed from within a client session, the workspace control feature is disabled. To use single sign-on, smart card, or smart card with single sign-on, you must set up a trust relationship between the server running the Web Interface and the Citrix XML Service. For more information, see Using Workspace Control with Integrated Authentication Methods on page 87.
87
Applications published for anonymous use are terminated when both anonymous and authenticated users disconnect, provided that the Citrix XML Service is set to trust Web Interface credentials. Thus, users cannot reconnect to anonymous applications after they disconnect. If client credential pass-through is not enabled, smart card users are prompted for their PINs for each session being reconnected. This is not an issue with single sign-on or smart cards with single sign-on because client credential passthrough is enabled with these options. Each session times out after a period of inactivity (typically 20 minutes). When the HTTP session times out, the Login screen appears; however, any applications launched or reconnected in that session are not disconnected. Users must manually disconnect, log off, or log back on to the Web Interface and use the Log off buttons or disconnect.
Using Workspace Control with Integrated Authentication Methods

If users log on using smart card, pass-through with smart card, or pass-through authentication, you must set up a trust relationship between the server running the Web Interface and any other server in the farm that the Web Interface accesses for published applications. Without the trust relationship, the Disconnect, Reconnect, and Log Off commands fail for those users logging on with smart card or passthrough. You do not need to set up a trust relationship if your users are authenticated by the server on which their applications run; that is, if users do not log on using smart card or pass-through authentication methods. To set up the trust relationship in the Presentation Server Console, open the Properties of the server running MetaFrame Presentation Server, choose XML Service in the left pane, and select Trust requests sent to the XML Service. The Citrix XML Service communicates information about published applications between the Web Interface and servers running MetaFrame Presentation Server. If you configure a server to trust requests sent to the XML Service, consider these factors: When you set up the trust relationship, you depend on the Web Interface server to authenticate the user. To avoid security risks, use IPSec, firewalls, or any technology that ensures only trusted services communicate with the XML Service. If you set up the trust relationship without using IPSec, firewalls, or other security technology, it is possible for any network device to disconnect or terminate client sessions. The trust relationship is not necessary if sites are configured using explicit authentication only. Enable the trust relationship only on servers directly contacted by the Web Interface. These servers are listed on the Manage server farms page.
88
Configure IPSec, firewalls, or other technology that you use to secure the environment to restrict access to the Citrix XML Service to only the Web Interface servers. For example, if the Citrix XML Service is sharing a port with Microsoft Internet Information Services (IIS), you can use the IP address restriction capability in IIS to restrict access to the Citrix XML Service.
Enabling Workspace Control

To enable workspace control, use the Manage workspace control task. Use this dialog box to: Enable automatic reconnection when users log on to allow users to reconnect to disconnected applications or both disconnected and active applications Enable the Reconnect button to allow users to reconnect to disconnected applications or both disconnected and active applications Allow users to log off from both the Web Interface and active sessions or from the Web Interface only
To enable automatic reconnection when users log on 1. Select the Automatically reconnect to sessions when user logs in option. To automatically reconnect both disconnected and active sessions, select All sessions To automatically reconnect disconnected sessions only, select Disconnected sessions only
2. Use the Allow user to customize option to allow users to select these options in the user interface. To enable the Reconnect option 1. Select the Automatically reconnect to sessions after user logs in option. To configure the Reconnect command to automatically reconnect both disconnected and active sessions, select All sessions To configure the Reconnect command to automatically reconnect disconnected sessions only, select Disconnected sessions only
2. Use the Allow user to customize option to allow users to select these options in the user interface. To configure log off behavior 1. In the Log off section, to log users off from the Web Interface and all active sessions, select Log off all sessions when user logs off from the Web Interface.
89
2. Use the Allow user to customize option to allow users to select these options in the user interface.
Controlling Diagnostic Logging

Note The following section is applicable to MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. Use the Control diagnostic logging task to increase system security for error logging. You can suppress duplicate events from being logged repeatedly, and configure how many duplicate events will be logged and how often. You can also use this task to specify the URL for error redirection. If you specify a customized error callback URL, you must handle all the error IDs with this URL and provide error messages to your users. In addition, this error callback URL will replace the users Log off page, even when users are logged off successfully without any error.
Load Balancing Sites

Note The following section is applicable to MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. Use the Load balance sites tasks to group sites so that they share the same configuration and can be used for load balancing. Sites that use a centralized configuration source can be grouped together using this task. This task is not displayed for local sites. To create a site group, use the Create site group task. Enter a name for the group and then select the sites you want to place in this group. Sites must use the same configuration source, technology (for example, Windows or UNIX), type (for example, MetaFrame Presentation Server), and must be the same version to be included in a group. After a site is added to a group, you cannot perform local site tasks on that site and the sites configuration is removed. To use local site tasks, you must remove the site from the group using the Remove sites from group task; the group configuration is used for the site. Additionally, you can use the Ungroup task to remove all sites from the group.
90
Using Local Site Tasks

Note The following section is applicable to MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. Use Local site tasks to specify the configuration location for sites and how IIS hosts sites. These tasks are available on the machine containing the Web Interface installation only. You can edit the information you entered when you created the site, and add servers for centralized configuration for the site.
Managing Configuration Sources

The Manage configuration source task allows you to specify whether or not the site uses local configuration (configuration for the site is held on the local computer) or centralized configuration (configuration for the site is held on a remote server running MetaFrame Presentation Server). If you are using a firewall between the server running the Web Interface and the server running MetaFrame Presentation Server, follow the procedure below to use centralized configuration for local sites. To use centralized configuration for local sites behind firewalls 1. Use the Export configuration task and save the configuration to a file. 2. Use the Manage configuration source task to enable centralized configuration. Click Yes if a warning appears. 3. Run the Access Suite Console on the server running MetaFrame Presentation Server and use the Import configuration task to import the saved configuration.
Repairing and Unstalling Sites

You can use the Repair site and Uninstall site tasks to repair and remove sites. Uninstalling a site completely removes it from the system and you can no longer perform tasks on the site. Important If custom scripts and images have been created for the site and you run the Repair site task, these customized files will be removed. Customized files are also removed when using the Manage IIS Hosting task. Citrix recommends that you back up any files you create before you use either of these tasks.
91
Importing and Exporting Configuration Files

Note The following section is applicable to MetaFrame Presentation Server, Program Neighborhood Agent, and Conferencing Manager Guest Attendee sites. You can import existing configuration files to use with a selected site and export configuration files for use with other sites. To do this, use the Import configuration and Export configuration tasks.
Configuring the Web Interface Using the Configuration File

The Web Interface includes a configuration file, called WebInterface.conf, that lets you change several of the properties of locally configured MetaFrame Presentation Server sites. You can use this file to perform day to day administration tasks and customize many more settings. For example, you can use WebInterface.conf to specify the settings that users can adjust on the Settings page or configure user authentication to the Web Interface. The WebInterface.conf file is available on all platforms in the software directory. On Windows this is typically C:\Inetpub\wwwroot\Citrix\MetaFrame\conf; on UNIX systems, this may be /usr/local/tomcat/webapps/Citrix/MetaFrame/WEBINF. You can override some values in WebInterface.conf on a per-page basis in your Web server scripts. For more information about Web server scripts, see the Customizing the Web Interface guide. Important For changes made to WebInterface.conf to take effect on UNIX platforms, you must stop and restart the server running the Web Interface. Additionally, ensure that you save your changes with UTF-8 encoding.
92
The following table shows the parameters that WebInterface.conf can contain (in alphabetical order). If a parameter is not specified in WebInterface.conf, its default value is used.
Parameter AdditionalExplicit Authentication Description Defines the explicit two-factor authentication that must be carried out, in addition to SAM, ADS or NDS. This replaces the deprecated setting of EnableSecurIDWithExplicit Authentication. Specifies what type of address to use for the NFuse_AppServerAddress tag in Template.ica. Specifies whether users can provide MetaFrame Presentation Server with the type of connection between their Web browser and MetaFrame Presentation Server, to optimize ICA settings. Specifies whether to allow users to specify the number of columns. Specifies whether the user is permitted to adjust the audio quality for ICA sessions. Whether to allow users to enable/ disable client printer mapping. Specifies whether the user is permitted to change which client is used to launch the application. Specifies whether the user is permitted to change the Client for Java packages that are downloaded. Whether to allow users to choose which user interface to use. Values None, SecurID, SafeWord, RADIUS Site Types MetaFrame Presentation Server
AddressResolution Type
Ipv4-port, ipv4, dns, dns-port
MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server
AllowBandwidth Selection
Off, On
AllowCustomizeApp Columns AllowCustomize Audio AllowCustomizeClient PrinterMapping AllowCustomize Clients AllowCustomizeJava ClientPackages
On, Off Off, On
MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server
Off, On Off, On
Off, On
AllowCustomize Layout
Off, On
MetaFrame Presentation Server
93
Parameter AllowCustomize Logoff
Description Specifies whether users can override the behavior displayed by the workspace control feature when the user logs off from MetaFrame Presentation Server. Specifies whether the MetaFrame Presentation Server user is able to override the behavior of workspace control at logon. Specifies whether the MetaFrame Presentation Server user is able to override the behavior of workspace control when Reconnect is clicked. Specifies whether the user can access the Settings screen and make changes. Specifies whether to allow users to select the key combination passthrough behavior. Specifies whether to allow users to enable/disable PDA synchronization. Specifies whether the user is permitted to change the color depth for ICA sessions. Specifies whether the user is allowed to change the window size for ICA sessions. Defines under what conditions users can change their password. Specifies whether to return the alternate server address in the ICA file.
Values On, Off
Site Types MetaFrame Presentation Server
AllowCustomize ReconnectAtLogin
On, Off
AllowCustomize ReconnectButton
On, Off
AllowCustomize Settings AllowCustomize TransparentKey Passthrough AllowCustomizeVirtual COMPortEmulation AllowCustomizeWin Color AllowCustomizeWin Size AllowUserPassword Change AlternateAddress
On, Off
MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server
Off, On
On, Off
Off, On
On, Off
Never, Expired-only, Always Off, Mapped, On
AppColumns
The number of columns of application icons in the Application screen.
Integer 1 - 300 (3)
94
Parameter Authentication Methods
Description Defines the permitted logon methods. This is a comma separated list and can contain any of the specified values in any order. Specifies whether the ActiveX client should be downloaded to users with no client, or one that is out of date. Whether to use the Client for Java to launch applications if no native client is detected on Win32 platforms. Specifies the color for the lines and bars in the header and footer areas. Time before a failed RADIUS server is considered for reuse. Time before a failed STA server is considered for reuse.
Values Explicit, Anonymous, CertificateSingle SignOn, Certificate, SingleSignOn Off, On
Site Types MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server
AutoDeployWebClient
AutoFallbackToJava Client
Off, On
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
BrandingColor
Hex color number or color name A number in seconds (600) A number in seconds (3600)
BypassFailedRadius ServerDuration BypassFailedSTA Duration
ClientAddressMap
Part of the server side firewall configuration. A list of client address, address type pairings. The first can be a partial address, or a subnet address and mask, while the latter takes the values: Normal, Alternate, Translated, SG, SGAlternate, and SGTranslated. Using an asterisk (*) in place of a client address or subnet indicates the default for all otherwise unspecified clients.
<ClientAddress>| <Subnet Address>/ <Subnet Mask>|*, Normal|Alternate| Translated|SG| SGTranslated| SGAlternate,
95
Parameter ClientProxy
Description Client side firewall option. Specifies a list of client subnet addresses and masks, or address prefixes, and associated proxy settings. The client address in the returned ICA file is determined by these settings. Using an asterisk (*) in place of a client address or subnet indicates the default for all otherwise unspecified clients. The value of the third field (proxy address) in each set of three is ignored unless the second field (proxy type) is an explicit proxy type (SOCKS or Secure), but it must always be present; the default value for this field is the minus sign (-). A URL to be used as the hyperlink for the company logo if CompanyLogo is specified. A URL to the company logo image. Specifies from where Web Interface should load the configuration.
Values <ClientAddress>| <Subnet Address>/ <Subnet Mask>|*, Auto|Client|None| SOCKS|Secure, |<ProxyAddress>| <ProxyAddress>: <ProxyPort>,
Site Types MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
CompanyHomePage
A valid URL
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
CompanyLogo
A valid URL
Configuration Location
Path to the configuration file within the web app | commaseparated list of server-address:port, where server-address is either a DNS name or an IP address File | ConfigurationService
ConfigurationSource Type
Which type of configuration is used by the site.
MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
CSG_EnableSession Reliability
Specifies whether or not to use Session Reliability through the Secure Gateway.
Off, On
96
Parameter CSG_Server
Description Specifies the address of the Secure Gateway.
Values None. Server address as a FQDN
Site Types MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Conferencing Manager
CSG_ServerPort
Specifies the port of the Secure Gateway.
None. Server port
CSG_STA_URL<n>
Server providing the Secure Ticket Authority function.
None A URL to an STA
DefaultClient
Whether to show all clients available for download when platform cannot be auto detected. Only relevant if install captions are to be shown. The default language to be used if a browser requests a nonsupported language.
On, Off
DefaultLocale
en | fr | de | es | ja | any other supported language identifier
MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Conferencing Manager
DefaultWelcome MessageLocale
Locale of the default Welcome message text to be displayed in the Welcome area of the Login screen and Application screen. This should match up to the langcode part of one of the defined WelcomeMessage_lang-code settings, for example, en. Whether to display the footer defined in footer.inc. Whether to display the header defined in header.inc.
None en | fr | de | es | ja | any other supported language identifier
DisplayFooter
On, Off
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager
DisplayHeader
On, Off
97
Parameter DisplayMainBoxTitle BarBgImage DuplicateLogInterval
Description Whether to use background image or simple background color for the main box title bar. Specifies the time period over which DuplicateLogLimit log entries will be monitored.
Values On, Off
Site Types MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager Program Neighborhood Agent Services
A number in seconds (60)
DuplicateLogLimit
Specifies the number of duplicate log entries allowed in the time period DuplicateLogInterval.
Integer greater than 0 (10)
EnableFileType Association
Specifies whether file type association is enabled or disabled for a site. If this is Off, content redirection is not available for the site. Whether to enable Kerberos authentication. Specifies whether older MetaFrame Presentation Server Clients that cannot read UTF-8 ICA files are supported. If this is Off, MetaFrame Presentation Server will produce ICA files in UTF-8 encoding. Specifies whether the workspace control feature should logoff Active applications when the user logs off from MetaFrame Presentation Server. Turn this on to permit sessions on multiple RADIUS servers to be load balanced in a random-access manner. Failover between the servers still occurs regardless of whether this is On or Off.
On, Off
EnableKerberosTo MPS EnableLegacyICA ClientSupport
Off, On On, Off
MetaFrame Presentation Server MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server
EnableLogoff Applications
On, Off
EnableRadiusServer LoadBalancing
On, Off
98
Parameter EnableSTALoad Balancing
Description Turn this on to permit requests to multiple Secure Gateway STA servers to be load balanced.
Values On, Off
Site Types MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server MetaFrame Presentation Server
EnableVirtualCOM PortEmulation EnableWorkspace Control
Whether to enable PDA synchronization through tethered USB connection. Specifies whether the workspace control feature is available to MetaFrame Presentation Server users. Specifies a URL for Web Interface to redirect to when an error occurs. It takes four query string parameters: NFuse_MessageType NFuse_MessageKey NFuse_MessageArgs NFuse_LogEventID Specifies all the information for a farm.
On, Off
On, Off
ErrorCallbackURL
A valid URL
Farm<n>
XML service address [,XML service address,...] [,Name:<name>] [,XMLPort:<port>] [,Transport:<HTTP| HTTPS|SSL>] [,SSLRelayPort: <port>] [,BypassDuration: <duration>] [,LoadBalance: <on|off>] [,ECSUrlURL>] [,AuthenticationTickets: <on|off>] [TicketTimeToLive: <seconds (200)>] A valid URL
MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
HeadingImage
A URL to the image to be displayed as the heading of Web Interface.
MetaFrame Presentation Server Conferencing Manager
99
Parameter HideDomainField HpUxUnixClient
Description Controls whether the domain field is displayed on the Login screen. Specifies download caption and links for the associated platform. Specifies download caption and links for the associated platform. File name of the Client for Win32.
Values Off, On "Default". Caption and links "Default". Caption and links wficat.cab
Site Types MetaFrame Presentation Server MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager
IbmAixClient
ICAWebClient
IcaWebClientClassID
Class ID of the ActiveX client.
238f6f83-b8b4-11cf8771-00a024541ee3 The latest client version
ICAWebClientVersion
Version number of client (from the Client CD-ROM). Used with autoWebClientDownload. Ignore the client-provided client address when set.
IgnoreClientProvided ClientAddress
Off, On
InternalServer AddressMap
A list of normal, translated address pairings. The normal address identifies the Secure Gateway server address and the translated address is that which should be returned to the MetaFrame Presentation Server Client. Specifies download caption and links for the associated platform. The default set of Client for Java packages to download. Consists of a comma-separated list in arbitrary order.
NormalAddress = TranslatedAddress,
JavaClient
"Default". Caption and links ConfigUI, PrinterMapping, SecureICA, Audio, ClientDriveMapping, ClipBoard, SSL, Thinwire1, ZeroLatency
JavaClientPackages
100
Parameter JavaClientRoot Certificate
Description The file name of a private root certificate for the Client for Java. The certificate must be located in the same directory as the Client for Java packages. Controls whether user settings should be persistent or last only for the lifetime of the session. When kiosk mode is enabled, user settings will not persist from one session to another. Defines from which clients the user is allowed to select. Used in conjunction with AllowCustomizeClients. Preferred client to use for launches. Specifies download caption and links for the associated platform. Domain names to use for display and/or restriction purpose for explicit authentication. Specifies which Login screen is displayed. May be either domainbased, or NDS. Specifies download caption and links for the associated platform. Specifies the background color for the main box title bar. Specifies a URL to the background image for the main box title bar.
Values None. A valid filename
Site Types MetaFrame Presentation Server Conferencing Manager
KioskMode
Off, On
MetaFrame Presentation Server Conferencing Manager
LaunchClients
Ica-Local, Ica-Java, Ica-Embedded, Rdp-Embedded Ica-Local, Ica-Java, ca-Embedded, Rdp-Embedded "Default". Caption and links List of NetBIOS domain names
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager
LaunchMethod
LinuxClient
LoginDomains
LoginType
Default, NDS
MacClient
"Default". Caption and links Hex color number or color name A valid URL.
MainBoxTitleBarBg Color MainBoxTitleBarBg Image
101
Parameter MainBoxTitleFont Color MessageHeadingBg Color MessageHeadingFont Color NDSContextLookup Servers
Description Font color for the main box title bar. Background color for the headings of the welcome area and the message center. Font color for the headings of the welcome area and the message center. Specifies the LDAP servers to use. If the port is not specified, it is inferred from the protocol: ldap for the default LDAP port (389), or ldaps for the default LDAP over SSL port (636). A maximum of 512 servers is supported. If this parameter is empty or not present, the contextless logon functionality is disabled. Specifies whether or not to load balance the configured LDAP servers. When using NDS authentication, this specifies the NDS tree to use.
Values Hex color number or color name Hex color number or color name Hex color number or color name None. ldap://[:]| ldaps://[:],...
Site Types MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services
NDSContextLookup Loadbalancing
Off, On
MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
NDSTreeName
None. NDS tree
OtherClient
Specifies download caption and links for unrecognized client platforms. Specifies a custom message to be displayed along with the download links for the clients. Specifies whether to use socket pooling or not.
"Default". Caption and links None. Custom message text Off, On
OverrideClientInstall Caption PooledSockets
102
Parameter RadiusRequest Timeout RadiusServers
Description Specifies the time-out value to use when waiting for a response from the session's RADIUS server. A comma-separated list of RADIUS servers and optionally the ports on which they listen. Servers can be specified using IPs or names, and the server and port for each element are separated using a colon. If the port is omitted, MetaFrame Presentation Server assumes the RADIUS default of 1812. A maximum of 512 RADIUS servers can be configured. Filename of the Remote Desktop Connection software used for embedded launches and autodeployment of this client. Class ID of the Remote Desktop Connection ActiveX client shipped with Windows Server 2003. Version number of the Remote Desktop Connection software shipped with Windows Server 2003. Specifies whether workspace control should reconnect to applications at logon, and if so, whether to reconnect all applications, or disconnected applications only. Specifies whether workspace control should reconnect to applications when the MetaFrame Presentation Server users click Reconnect, and if so, whether to reconnect to all applications, or disconnected applications only. Controls TLS settings.
Values time-out in seconds (30) server[:port][,]
Site Types MetaFrame Presentation Server MetaFrame Presentation Server
RdpWebClient
msrdp.cab
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services
RdpWebClientClassID
7584c670-2274-4efbb00b-d6aaba6d3850 5,2,3790,0
RDPWebClient Version
ReconnectAtLogin
DisconnectedAndActive , Disconnected, None
ReconnectButton
DisconnectedAndActive , Disconnected, None
RequestICAClient SecureChannel
Detect-AnyCiphers, TLS-GovCiphers, SSLAnyCiphers
MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
103
Parameter RestrictDomains
Description Controls whether LoginDomains is to be treated as a restriction or display list for explicit authentication. The number of times a failed request to the XML Service is retried before the service is deemed to have failed. Specifies download caption and links for the associated platform. An optional comma-separated list of context names for use with NDS authentication. Part of server side firewall support. A list of normal, translated address pairings. The normal address identifies the server address and the translated address is returned to the client. Specifies download caption and links for the associated platform. Controls the display of download captions. Auto specifies that the download caption is shown if the user does not have a client installed and automatic Web installation is disabled. On other platforms, the caption is always shown.
Values Off, On
Site Types MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager
RetryCount
Integer greater than 0 (5)
ScoUnixClient
"Default". Caption and links None. Comma delimited list of context names NormalAddress, TranslatedAddress,
SearchContextList
ServerAddressMap
SgiUnixClient
"Default". Caption and links Auto, Off, On
ShowClientInstall Caption
104
Parameter SiteIDRoot
Description A string that provides the basis of a unique site identifier. For windows the SiteIDRoot is used directly as the site identifier when communicating with the configuration service. For UNIX, runtime information is added to the SiteIDRoot to form the site identifier for the configuration service. Specifies download caption and links for the associated platform. Specifies the time-out value to use when communicating with the XML service.
Values This is a random number generated by the installer
Site Types MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager
SolarisUnixClient
"Default". Caption and links time-out in seconds (60)
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Program Neighborhood Agent Services MetaFrame Presentation Server Conferencing Manager
Timeout
TransparentKey Passthrough Tru64Client
Specify the mode of Windows key combinations pass-through. Specifies download caption and links for the associated platform. Restrict UPN authentication to these suffixes for explicit authentication. Whether to use the compact user interface.
Local, Remote, FullScreenOnly "Default". Caption and links List of UPN suffixes
UPNSuffixes
UserInterfaceLayout
Auto | Normal | Compact
105
Parameter WelcomeMessage_ <lang-code>
Description Localized welcome message text to be displayed in the welcome area of the Login screen and Application List screen. lang-code is en, fr, de, es, ja or any other standard language code. Specifies download caption and links for the associated platform. Specifies download caption and links for the associated platform.
Values None. HTML formatted text.
Site Types MetaFrame Presentation Server Conferencing Manager
Win16Client
"Default". Caption and links "Default". Caption and links
MetaFrame Presentation Server Conferencing Manager MetaFrame Presentation Server Conferencing Manager
Win32Client
Program Neighborhood Agent Considerations

Specific WebInterface.conf value settings affect the validation of Program Neighborhood Agent requests. Citrix recommends that the settings in WebInterface.conf be consistent with settings in the config.xml file in the Program Neighborhood Agent. The following table explains these parameters (in alphabetical order), the values that affect the Program Neighborhood Agent settings, and their recommended settings:
Parameter AuthenticationMethods Value N/A Recommended Setting Use the same authentication method configured in the Web Interface. Authentication will fail if this method differs in config.xml. This field stops the Program Neighborhood Agent users from successfully authenticating with any other domain. NDS must be enabled in config.xml. DefaultTree in the Logon section of config.xml must contain the same setting.
ForceLoginDomain
N/A
LoginType NDSTreeName
N/A N/A
106
To configure the Web Interface when using the Program Neighborhood Agent 1. Open the WebInterface.conf file. 2. Locate the following parameters: AuthenticationMethods ForceLoginDomain LoginType NDSTreeName
3. Amend the settings for these parameters as shown in the table above. 4. Restart the server running the Web Interface to apply the changes.
Examples
This section provides typical examples of how to configure the Web Interface using the WebInterface.conf file.
Configuring Communication with MetaFrame Presentation Server

In this example, you want to specify the name of an additional server running the Citrix XML Service. The Citrix XML Service acts as a communication link between the server farm and the server running the Web Interface. Communication is currently with a server called marx but you want to add a server called engels in case marx fails. To do this: 1. Locate the following line in WebInterface.conf:
Farm1=
2. Edit this line to include the additional server, as follows:

Farm1=marx,engels
107
Configuring Citrix SSL Relay Communication

In this example, you want to secure communication between the Web server and the MetaFrame server, using Secure Sockets Layer (SSL). Citrix SSL Relay is installed on a MetaFrame server that has a FQDN of www.hegel.company-name.com. Citrix SSL Relay listens for connections on TCP port 443. Communication is currently with the server marx but you want to replace marx with www.hegel.company-name.com. To do this: Open WebInterface.conf and locate the following lines:
Farm1=www.hegel.company-name.com, Name:marx, Transport:SSL, SSLRelayPort:443
Note The server name specified must match the name on the servers certificate.
Configuring Secure Gateway Support

In this example, you want to specify a Secure Gateway server called csg1.citrix.com on which MetaFrame Presentation Server Clients use port 443, using the following two Secure Ticket Authority addresses: http://server1.citrix.com/scripts/CtxSta.dll http://server2.citrix.com/scripts/CtxSta.dll
Include the following lines in WebInterface.conf:

CSG_STA_URL1=http://server1.citrix.com/scripts/CtxSta.dll CSG_STA_URL2=http://server2.citrix.com/scripts/CtxSta.dll CSG_Server=csg1.citrix.com CSG_ServerPort=443
ClientAddressMap=*,CSG (to enable the Secure Gateway for all users)
Disabling Error Messages

On Windows platforms, you can disable the custom error message provided with the Web Interface to display more informative error messages. To do this, edit the web.config file located in the sites root directory. Change the following line: <customErrors mode="On" defaultRedirect="html/serverError.html" /> to: <customErrors mode="Off" defaultRedirect="html/serverError.html" />
108
Making the Web Interface Available to Users

When the Web Interface is installed and configured, inform your users of the URL for the Log In page. If users want to bookmark this page in their browsers, Citrix recommends that the bookmark be set to http://servername/site path without specifying a particular page (such as login.aspx). On UNIX Web servers, the site path (the portion of the URL after the host name and port number) is determined by the servlet engine. When installing the WAR file within the servlet engine, you can modify this path. The default is usually /WAR file name, where the file name is WARFileName.war. For WebLogic, a separate XML file must be created to modify this path. Example XML files with usage notes are generated with the WAR file, and are located in /Citrix/WAR file name.
Making the Log In Page the Default on IIS

You can set the Login page to be the default for users during Web Interface installation, so that the URL is http://servername/. To do this, enable the Set as the default page for the IIS site option in the Create site task.
What to Do Next
For more information about deploying MetaFrame Presentation Server clients to Web Interface users or about configuring the Client for Macintosh, see MetaFrame Presentation Server Clients and the Web Interface on page 117. For information about security considerations, see Chapter 5, Configuring Web Interface Security on page 123.
CHAPTER 4
Configuring SmartAccess for the Web Interface
Overview
This chapter describes how to configure SmartAccess for the Web Interface. Topics include: Controlling Access to Resources Making Resources Available to Users Configuring SmartAccess
110
Controlling Access to Resources

You can configure the Web Interface and Advanced Access Control to use SmartAccess. SmartAccess controls user access to available applications on computers running MetaFrame Presentation Server through the use of Advanced Access Control policies and filters. This permits the use of endpoint analysis as a condition for application access, along with other factors. Note SmartAccess support is not available on UNIX platforms.
Making Resources Available to Users

With SmartAccess, users log on to a logon point to gain access to their resources. You make resources available to users by configuring a logon point to provide access to a MetaFrame Presentation Server site: Embedded in the default navigation page. The user logs on to an appropriate logon point and is directed to the default navigation page where applications are accessed directly from the Applications panel. SmartAccess provides passthrough authentication to the Web Interface. Published as the default home page users are directed to following logon. The user logs on to an appropriate logon point and is directed straight to their Web Interface application list. SmartAccess provides passthrough authentication to the Web Interface. Embedded within an access center or third party portal. The user logs on to appropriate logon point and is directed to an Access Center or third party portal containing the Web Interface applications list. SmartAccess provides passthrough authentication to the Web Interface.
System Requirements
To use SmartAccess you must ensure the following software is installed on your servers: Citrix Access Gateway with Advanced Access Control 4.2 MetaFrame Presentation Server 4.0 Access Suite Console 4.0 (for MetaFrame Presentation Server), with the Access Suite Console 4.2, ASC00W004.msp, patch applied Web Interface for MetaFrame Presentation Server 4.2
Chapter 4 Configuring SmartAccess for the Web Interface
111
You must also ensure that address translation and firewall settings are identical for the Web Interface and Advanced Access Control.
Deploying SmartAccess
The recommended deployment for using SmartAccess with the Web Interface is illustrated below
This diagram shows the recommended deployment for using SmartAccess with the Web Interface.
MetaFrame Presentation Server, the Web Interface, and Advanced Access Control are all installed on servers within the internal network. Access Gateway is installed in the DMZ. When you install Advanced Access Control, an instance of the Logon Agent is also installed. The Logon Agent provides the user interface for logging on to a server in your access server farm. When a user logs on, they are authenticated by the Access Gateway and directed to their resources subject to the access policies configured in Advanced Access Control.
112
Configuring SmartAccess
To configure SmartAccess and make MetaFrame Presentation Server sites available to users you must complete a number of tasks.
On the Server Running Web Interface

Create MetaFrame Presentation Server sites to use Advanced Access Control as their access method. See Creating Sites on page 113.
On the Server Running Advanced Access Control

Create a Web resource for the MetaFrame Presentation Server site Create a logon point configured to display the Web resource to users in one of the following ways: As an embedded site with applications listed in the Applications panel of the default navigation page As a default home page following logon As an embedded site within an access center or third party portal
Deploy the logon point Create an access policy configured to allow the following: User logon Access to the Web resource
For more information and configuration instructions, see the Access Gateway with Advanced Access Control Administrators Guide.
On Both Servers
Configure workspace control settings for logon points. See Configuring Workspace Control on page 114. Configure Java Client fallback settings for logon points. See Configuring Java Client Fallback on page 114. Configure session time-out settings for logon points. See Configuring Session Time-Out on page 114.
113
Creating Sites
You must create MetaFrame Presentation Server sites configured for use with SmartAccess. Note You must use Version 4.2 of the console to create and manage sites for use with SmartAccess. Version 4.0 of the console or command line tool cannot be used to manage sites created with later versions of the console. To create sites for use with SmartAccess 1. Under Common Tasks in the task pane, click Create Site. The Create Site wizard appears. 2. On the Site Type page, select MetaFrame Presentation Server and click Next. 3. On the IIS Hosting page, enter your required settings. Click Next. 4. On the Configuration Source page, enter your required settings. Click Next. 5. On the Access Method page, select Using Advanced Access Control and enter the Advanced Access Control authentication service URL created when you installed Advanced Access Control (see the Access Gateway with Advanced Access Control Administrators Guide for further information). For example: http://aac.server.net/CitrixAuthService/AuthService.asmx 6. Click Next. 7. Complete the remainder of the wizard according to the on-screen instructions. Click Finish.
Differences in the Access Suite Console

If you configure MetaFrame Presentation Server sites for use with SmartAccess, the following changes occur in the Access Suite Console: Configure Authentication Methods does not appear for Web Interface sites set to use Advanced Access Control because Advanced Access Control manages the authentication for these sites. Manage Workspace Control contains a warning panel if the site is selected for Advanced Access Control use. These settings need to be configured appropriately. See Configuring Workspace Control on page 114. Java Client Fallback contains a warning panel for sites selected for Advanced Access Control use. These settings need to be configured appropriately. See Configuring Java Client Fallback on page 114.
114
Configuring Workspace Control

Workspace control settings can be configured in both Web Interface and Advanced Access Control. A MetaFrame Presentation Server site configured for SmartAccess can be accessed both directly and through the Advanced Access Control default navigation page at the same time, through different logon points. This can cause conflicts with workspace control. To avoid this, disable all Advanced Access Control workspace control settings for all logon points that have a MetaFrame Presentation Server site as their home page, (that is, those logon points where the home page is set as Application with the highest display priority and an appropriate resource selected). All other logon points can have workspace control configured as desired.
Configuring Java Client Fallback

For MetaFrame Presentation Server sites using Advanced Access Control, Java Client fallback can be enabled in both the Web Interface and Advanced Access Control. This can cause inconsistent user experience if a site is accessed both directly and through the Advanced Access Control default navigation page at the same time, through different logon points. To avoid this, ensure that logon points with the Advanced Access Control default navigation page as their home page have the same Java Client fallback settings as the Web Interface site.
Configuring Session Time-Out

Session time-out settings can be configured in both the Web Interface and Advanced Access Control for each logon point. For each logon point ensure that settings are identical for both applications. For Advanced Access Control, see the Access Gateway with Advanced Access Control Administrators Guide for instructions about configuring session time-out. For the Web Interface, you must manually edit the web.config configuration file. To configure session time-out settings by editing web.config 1. Open a text editor (for example, Notepad). 2. Using the text editor, in the root directory of your Web Interface site, open the file web.config.
115
3. In the First system.web section of web.config, add a sessionState element to declare a new time-out value in minutes. 4. For example, to change the session time-out to one hour, add the line (in bold) to web.config:
<configuration> <system.web> <sessionState timeout="60" /> <compilation debug="false" defaultLanguage="C#"> <assemblies>
5. Save and then close the file. Note web.config entries are case-sensitive; therefore, use sessionState and not sessionstate. The settings take effect immediately.
116
CHAPTER 5
MetaFrame Presentation Server Clients and the Web Interface
Overview
This chapter provides information about deploying and using MetaFrame Presentation Server Clients with the Web Interface. It explains how to deploy clients using the Web-based client installation feature, and provides additional information about the Client for Java. Topics include: Using Web-Based Client Installation Client for Java Overview The Program Neighborhood Agent Overview
118
Using Web-Based Client Installation

To use the Web Interface, users must have a supported Web browser and a MetaFrame Presentation Server Client. When a user logs on to a Web Interface site, the Web-based client installation feature checks the users computer for the presence of client software. If the client software is not detected, the Web-based client installation feature presents the appropriate client software for download and setup. The links presented to users are called installation captions. The following shows a typical installation caption:
This screen capture shows an example installation caption that may appear in the users Login page.
Copying Client Installation Files to the Web Server

To use Web-based client installation, the Web server must contain the client installation files. During Web Interface installation, Setup prompts you to supply the Components CD-ROM or CD image. Setup copies the contents of the CDs ICAWEB directory to a directory called \ICAWEB in the common files root directory (for example, C:\Program Files\Citrix\Web Interface\4.0\ICAWEB). In the \ICAWEB directory, clients are arranged by language and platform (for example, ICAWEB\en\ica32), with the exception of the Client for Java, which is located in ICAWEB\icajava. If you did not copy the client installation files to the Web server during Web Interface installation, make sure you copy these files to the Web server before using Web-based client installation. To copy the client files to the Web server 1. Locate the ICAWEB directory where the Web Interface is installed. For example, C:\Program Files\Citrix\Web Interface\4.0\ICAWEB.
Chapter 5 MetaFrame Presentation Server Clients and the Web Interface
119
2. Insert the Components CD-ROM in the Web servers CD-ROM drive or browse the network for a shared Components CD image. 3. Change directories to the CDs \ICAWEB directory. Copy the contents from the \ICAWEB directory to the CD into the \ICAWEB directory on the server running the Web Interface. Make sure you copy the contents of the directory and not the \ICAWEB directory itself.
Configuring Web-Based Client Installation

This section explains how to configure the installation captions presented to users, and the Client for Win32 offered to Windows client devices. It explains how to do this using the WebInterface.conf file. Note For information about configuring Web-based client installation using the Access Suite Console, see Automatically Deploying Clients on page 75.
Client for Win32 Installation Files

By default, Web-based client installation offers the Web Client installation file to 32-bit Windows client devices. However, you can modify this behavior so that the Program Neighborhood Client or the Program Neighborhood Agent are offered instead. The following describes the differences between these installation files: Web Client installation file (ica32t.exe). This version installs the Web client. Program Neighborhood Client installation file (ica32.exe). Installs all components of the Client for Win32 including the Program Neighborhood user interface. You must use the ica32.exe or ica32.msi archive to install the Client for Win32 if your users require full client functionality. Program Neighborhood Agent installation file (ica32a.exe). Installs all components of the Client for Win32 including the Program Neighborhood Agent user interface. You can use ica32a.exe or ica32a.msi to allow users to access Web Interface-enabled published applications directly from the Windows desktop, the Start menu, or in the Windows notification area.
To configure the Web Interface to offer a different Client for Win32 1. Open the WebInterface.conf file. 2. Edit the ICAWebClient parameter. For example:
ICAWebClient=wficat.cab
120
Configuring Installation Captions

You can configure whether or not installation captions are presented to users and the text displayed in the captions. To do this, you use the ShowClientInstallCaption and OverrideClientInstallCaption parameters in WebInterface.conf. Note For information about configuring installation captions using the console, see Automatically Deploying Clients on page 75. The ShowClientInstallCaption parameter specifies whether or not Web-based client installation captions are displayed to users. There are three options: Auto. On Windows platforms, if the user does not have a client installed, an installation caption appears. On other platforms, the installation caption is always shown. This is the default setting. On. The installation caption is always displayed on all platforms. Off. The installation caption is never displayed.
The OverrideClientInstallCaption parameter specifies a custom message that can be displayed along with the download links for the clients. By default, this parameter is commented out by a number sign (#) at the beginning of the line and the default messages are used. The default message is specific to the identified client platform, and is similar to the following: You do not have the Client (ActiveX) for 32-bit Windows installed on your system. You must install the client to launch the applications. Select the icon below to install the client. To display a custom message with the download links 1. Open the WebInterface.conf file. 2. Edit the OverrideClientInstallCaption parameter. For example:
OverrideClientInstallCaption=Please install a client. Here are the clients we offer:
Chapter 5 MetaFrame Presentation Server Clients and the Web Interface
121
Client for Java Overview

If you are deploying clients over a low-bandwidth network or you are not sure what platform your users are on, consider using the Client for Java. The Client for Java is an applet that is cross-platform compatible and can be deployed by the server running the Web Interface to any Java-compatible Web browser. Using the Web Interface, you can configure the Client for Java to be a small download (as small as 540K) by removing unwanted components. Alternatively, you can configure the Web Interface to allow users to control which Client for Java components they require. For more information about how to configure the components included in the deployment of the Client for Java using the Access Suite Console, see Customizing the Client for Java Deployment on page 78. The Client for Java is optimized for zero-residence download-and-run deployment, where it is not possible or desirable to install a client on the client device. You can also deploy the Client for Java independently of the Web Interface. For more information, see the Client for Java Administrators Guide. The user can adjust client settings using a graphical user interface when the Client for Java is running as an applet. See the Client for Java Administrators Guide for more information.
The Program Neighborhood Agent Overview

The Program Neighborhood Agent allows you to seamlessly integrate published content with users desktops. With the Program Neighborhood Agent, users can access remote applications by clicking icons on the Windows desktop, in the Start menu, in the Windows notification area, or a combination of these. The Program Neighborhood Agent operates in the background. It has no user interface except for a shortcut menu in the notification area. Therefore, working with remote applications has the look and feel of working with local applications. Client/server data transfer occurs over standard HTTP or HTTPS protocols, which makes it easy to use the Program Neighborhood Agent in conjunction with firewalls using port 80. You can edit the Program Neighborhood Agent configuration settings to dynamically manage and control the clients on the network. For example, you can prevent users from editing certain settings and to enable specific Program Neighborhood Agent settings to client devices. You can control the properties for the Program Neighborhood Agent in two ways: Using the Access Suite Console Using a single, editable configuration file called config.xml
122
The console provides a tool to view and change current settings. Parameters and values from the config.xml file are displayed in the interface, allowing you to make changes by selecting options and entering values in fields. For more information about Program Neighborhood Agent configuration using the console, see Configuring Sites Using the Console on page 44. For specific information about installing and configuring the Program Neighborhood Agent, see the Client for 32-bit Windows Administrator's Guide.
What to Do Next
For information about security considerations, see Chapter 5, Configuring Web Interface Security on page 123.
CHAPTER 6
Configuring Web Interface Security
Overview
This chapter provides information about how to secure your data in a Web Interface environment. Topics include: Introduction to Web Interface Security Securing Web Interface Communication Securing the Program Neighborhood Agent with SSL Server Running the Web Interface/MetaFrame Presentation Server Communication Client Session/MetaFrame Presentation Server Communication General Security Considerations
124
Introduction to Web Interface Security

A comprehensive security plan must include the protection of your data at all points in the application delivery process. This chapter describes Web Interface security risks and recommendations for each of the following communication links: Client device/server running the Web Interface communication. Explains risks associated with passing Web Interface data between browsers and servers and suggests strategies for protecting data in transit and data written on client devices. Server running the Web Interface/MetaFrame Presentation Server communication. Describes how to secure the authentication and published application information that passes between the server running the Web Interface and the MetaFrame farm. Client session/MetaFrame Presentation Server communication. Explains risks associated with passing client session information between clients and servers and discusses implementations of the Web Interface and MetaFrame security features that protect such data.
This diagram shows how the client device interacts with the server running MetaFrame Presentation Server and the server running the Web Interface.
Chapter 6 Configuring Web Interface Security
125
Security Protocols and Citrix Security Solutions

This section introduces some of the security protocols and Citrix solutions you can use to secure your Web Interface deployment. It provides introductory information about the SSL and TLS security protocols, Citrix SSL Relay, Secure Gateway, and ICA encryption. It also tells you where to find more information about these technologies.
Secure Sockets Layer (SSL)

The SSL protocol provides the ability to secure data communications across networks. SSL provides server authentication, encryption of the data stream, and message integrity checks. SSL uses cryptography to encode messages, authenticate their identity, and ensure the integrity of their contents. This guards against risks such as eavesdropping, misrouting, and data manipulation. SSL relies on public key certificates, issued by certificate authorities, to ensure proof of identity. For more information about SSL, cryptography, and certificates, see the MetaFrame Presentation Server Administrators Guide, the Citrix SSL Relay for UNIX Administrators Guide, and the Secure Gateway Administrators Guide.
Transport Layer Security (TLS)

TLS is the latest, standardized version of the SSL protocol. The Internet Engineering Taskforce (IETF) renamed it TLS when they took over responsibility for the development of SSL as an open standard. Like SSL, TLS provides server authentication, encryption of the data stream, and message integrity checks. Support for TLS Version 1.0 is included in MetaFrame Presentation Server, Feature Release 2. Because there are only minor technical differences between SSL Version 3.0 and TLS Version 1.0, the server certificates you use for SSL in your installation also work for TLS. Some organizations, including U.S. government organizations, require the use of TLS to secure data communications. These organizations may also require the use of validated cryptography, such as Federal Information Processing Standard (FIPS) 140. FIPS is a standard for cryptography. Note On UNIX platforms, the maximum SSL/TLS certificate key size supported by the Web Interface is 2048 bits.
126
Citrix SSL Relay

Citrix SSL Relay is a MetaFrame Presentation Server component that uses SSL to secure communication between servers running the Web Interface and server farms. Citrix SSL Relay provides server authentication, data encryption, and message integrity for a TCP/IP connection. The SSL Relay is provided by the Citrix XTE Service. Citrix SSL Relay operates as an intermediary in the communication between the server running the Web Interface and Citrix XML Service. When using Citrix SSL Relay, the Web server first verifies the identity of the Citrix SSL Relay by checking the relays server certificate against a list of trusted certificate authorities. After this authentication, the Web server and Citrix SSL Relay negotiate an encryption method for the session. The Web server then sends all information requests in encrypted form to Citrix SSL Relay. Citrix SSL Relay decrypts the requests and passes them to the Citrix XML Service. When returning the information to the Web server, the server sends all information through the Citrix SSL Relay server, which encrypts the data and forwards it to the Web server for decryption. Message integrity checks verify each communication was not tampered with. For more information about Citrix SSL Relay, see the MetaFrame Presentation Server Administrators Guide or the Citrix SSL Relay for UNIX Administrators Guide.
ICA Encryption
Using ICA encryption, you can encrypt the information sent between a server and a client. This makes it difficult for unauthorized users to interpret an encrypted transmission. Therefore, ICA encryption provides confidentiality to guard against the threat of eavesdropping. However, there are other security risks and using encryption is only one aspect of a comprehensive security policy. Unlike SSL/TLS, ICA encryption does not provide authentication of the server. Therefore information could, in theory, be intercepted as it crosses the network and rerouted to a counterfeit server. Also, ICA encryption does not provide integrity checking. ICA encryption is not available for MetaFrame Presentation Server for UNIX servers.
127
Secure Gateway
You can use the Secure Gateway with the Web Interface to provide a single, secure, encrypted point of access through the Internet to servers on the internal corporate networks. The Secure Gateway acts as a secure Internet gateway between SSL/TLS-enabled clients and servers. The Internet portion of traffic between client devices and the Secure Gateway server is encrypted using SSL/TLS. This means that users can access information remotely without compromising security. The Secure Gateway also simplifies certificate management, because you require a certificate only on the Secure Gateway server, rather than on every server in the farm.
This diagram shows how the Secure Gateway secures communication between SSL/ TLS-enabled clients and servers.
For more information about the Secure Gateway, see the Secure Gateway Administrators Guide. For information about how to configure the Web Interface for Secure Gateway support using the Access Suite Console, see Editing Secure Gateway Settings on page 71.
Securing Web Interface Communication

When using the Web Interface, you can put in place the following to secure client-to-server communication: Instruct users to connect to Web Interface pages using HTTPS (secure HTTP). Internet Information Services must have an SSL certificate installed to establish a secure HTTP connection. Configure Web Interface ticketing to further secure the direct communication between the clients and the servers. Configure the Web Interface to use Citrix SSL Relay for encryption between the server running the Web Interface and the servers.
Tip To ensure that only ICA connections using SSL (typically port 443) are allowed through a firewall, ensure port 1494 is blocked and open port 2598.
128
Securing the Program Neighborhood Agent with SSL

To use SSL to secure the communications between the Program Neighborhood Agent and the server running the Web Interface, change the URLs in the following parameters in the config.xml file to use HTTPS. Not all parameters may be specified in your version of the file. FolderDisplay/DesktopDisplay/Icon/Location ConfigurationFile/Location Request/Enumeration/Location Request/Resource/Location
To secure the connection between the Program Neighborhood Agent and the server using SSL, follow the instructions in Managing Secure Client Access on page 70 to configure the Web Interface to use SSL. Check the Enable SSL box in the ICA Client Options tab of the application properties dialog box in the Management Console.
Example
If the line specifying Request/Resource/Location is <Location>http:// server3.eng.citrix.com/Citrix/PNAgent/launch.aspx</Location>, change it to <Location>https://server3.eng.citrix.com/Citrix/PNAgent/launch.aspx </Location>.
Client Device/Server Running the Web Interface Communication

Communication between MetaFrame Presentation Server Clients and the server running the Web Interface consists of passing several different types of data. As users identify themselves, browse applications, and eventually select an application to execute, the Web browser and Web server pass user credentials, application set lists, and session initializing files. Specifically, this network traffic includes: HTML form data. Web Interface sites use a standard HTML form to transmit user credentials from the Web browser to the Web server at user logon time. The Web Interface form passes the user name and credentials in clear text. HTML pages and session cookies. After the user enters credentials in the Login page, the credentials are stored on the Web server and protected by a session cookie. The HTML pages sent from the Web server to the browser contain application sets. These pages list the applications available to the user.
129
ICA files. When the user selects an application, the Web server sends an ICA file for that application to the browser. The ICA file contains a ticket that can be used to log on to the server (except in the case of smart card authentication). ICA files do not include a ticket for pass-through authentication.
Risks
Attackers can exploit Web Interface data as it crosses the network between the Web server and browser and as it is written on the client device itself: An attacker can intercept logon data, the session cookie, and HTML pages in transit between the Web server and Web browser. Although the session cookie used by the Web Interface is transient and disappears when the user closes the Web browser, an attacker with access to the client devices Web browser can retrieve the cookie and possibly use credential information. Although the ICA file does not contain any user credentials, it contains a one-time use ticket that expires in 200 seconds, by default. An attacker may be able to use the intercepted ICA file to connect to the server before the authorized user can use the ticket and make the connection. If single sign-on is enabled, an attacker could send the user an ICA file that causes the users credentials to be misrouted to an unauthorized or counterfeit server.
Recommendations
The following recommendations combine industry-standard security practices with Citrix-provided safeguards to protect data traveling between client devices and the Web server and data written to client devices.
Implementing SSL/TLS-Capable Web Servers and Web Browsers

Securing the Web server to the Web browser component of the Web Interface communication begins with implementing secure Web servers and Web browsers. Many secure Web servers rely upon SSL/TLS technology to secure Web traffic. In a typical Web server to Web browser transaction, the Web browser first verifies the identity of the Web server by checking the Web servers certificate against a list of trusted certificate authorities. After verification, the Web browser encrypts user page requests and then decrypts the documents returned by the Web server. At each end of the transaction, TLS (Transport Layer Security) or Secure Sockets Layer (SSL) message integrity checks ensure that the data was not tampered with in transit.
130
In a Web Interface deployment, SSL/TLS authentication and encryption create a secure connection over which the user can pass credentials posted in the Log In page. Data sent from the Web server, including the credentials cookie, ICA files, and HTML application list pages, is equally secure. To implement SSL/TLS technology on your network, you must have an SSL/TLS-capable Web server and SSL/TLS-capable Web browsers. The use of these products is transparent to the Web Interface. You do not need to configure Web servers or browsers for the Web Interface. For information about configuring the Web server to support SSL/TLS, see the Web servers documentation. Important Many SSL/TLS-capable Web servers use TCP/IP port 443 for HTTP communications. By default, the Citrix SSL Relay uses this port as well. If your Web server is also a server running the Citrix SSL Relay, make sure you configure either the Web server or Citrix SSL Relay to use a different port.
Do not Enable Pass-Through Authentication

To prevent the possible misrouting of user credentials to an unauthorized or counterfeit server, do not enable pass-through authentication in a secure installation. Use this feature only in a small, trusted environment.
Server Running the Web Interface/MetaFrame Presentation Server Communication

Communication between the Web Interface and server running MetaFrame Presentation Server in a Web Interface deployment involves passing user credential and application set information between the Web Interfaces classes on the server and the Citrix XML Service in the server farm. In a typical Web Interface session, the classes pass credentials to the Citrix XML Service for user authentication and the Citrix XML Service returns application set information. The server and farm use a TCP/IP connection and the Citrix XML protocol to pass the information.
Risks
The Web Interface XML protocol uses clear text to exchange all data with the exception of passwords, which it passes using obfuscation. The XML communication is vulnerable to the following attacks: An attacker can intercept the XML traffic and steal application set information and tickets. An attacker with the ability to crack the obfuscation can obtain user credentials as well.
131
An attacker can impersonate the server and intercept authentication requests.
Recommendations
Citrix recommends implementing one of the following security measures for securing the XML traffic between the Web server and server farm: Use Citrix SSL Relay as a security intermediary between the Web server and server farm. Citrix SSL Relay performs host authentication and data encryption. In deployments that do not support running the Citrix SSL Relay, run the server running the Web Interface on the server running MetaFrame Presentation Server. Use the HTTPS protocol to send Web Interface data over a secure HTTP connection using SSL if IIS is installed on the server for another purpose.
Using Citrix SSL Relay

Citrix SSL Relay is a default component of MetaFrame Presentation Server. On MetaFrame 1.8 servers, you must install Citrix MetaFrame 1.8 Service Pack 2 or later to use the Citrix SSL Relay. On MetaFrame 1.1 for UNIX, you must install Feature Release 1 or later to use the Citrix SSL Relay. In addition, each MetaFrame 1.8 or MetaFrame Presentation Server for UNIX server must have a Feature Release 1 license installed and activated. On the server side, you must install a server certificate on the Citrix SSL Relay server and verify the Citrix SSL Relay servers configuration. For information about installing a server certificate and configuring the Citrix SSL Relay on servers, see the MetaFrame Presentation Server Administrators Guide. You can also consult the application help in the Citrix SSL Relay Configuration Tool. For MetaFrame Presentation Server for UNIX servers, see the Citrix SSL Relay for UNIX Administrators Guide. When configuring the Citrix SSL Relay, make sure the Citrix SSL Relay server permits passing SSL traffic to the servers you are using as the Citrix XML Service contacts. By default, the Citrix SSL Relay forwards traffic only to the server on which it is installed. You can, however, configure the Citrix SSL Relay to forward traffic to other servers. If the Citrix SSL Relay in your deployment is on a machine other than the machine to which you want to send Web Interface data, make sure the Citrix SSL Relays server list contains the server to which you want to forward Web Interface data. You can configure the Web Interface to use Citrix SSL Relay using the Access Suite Console or the WebInterface.conf file. For information about using the console, see Managing Server Farms on page 47.
132
To configure the Web Interface to use Citrix SSL Relay using WebInterface.conf 1. Open the WebInterface.conf file. 2. Change the SSLRelayPort setting in the Farmn parameter to the port number of the Citrix SSL Relay on the server. 3. Change the value of the Transport setting in the Farmn parameter to SSL. Tip For an example of how to configure the Web Interface to use Citrix SSL Relay using WebInterface.conf, see Configuring Citrix SSL Relay Communication on page 107.
Adding Certificates to the Server Running the Web Interface

On UNIX, the Web Interface includes native support for the following certificate authorities: VeriSign, Inc., http://www.versign.com/ Baltimore Technologies, http://www.baltimore.com/
If you want to add support for other certificate authorities, you must add the certificate authoritys root certificate to the server running the Web Interface. To add a new root certificate to the server running the Web Interface Copy the root certificate to your Web server. On Windows, the certificate is copied using the Certificate Microsoft Management Console (MMC) Snap-In. On UNIX, copy the certificate to the ./cacerts directory.
For information about certificates, see the installation chapter of the MetaFrame Presentation Server Administrators Guide. For MetaFrame Presentation Server for UNIX servers, see the Citrix SSL Relay for UNIX Administrators Guide.
Enabling the Server Running the Web Interface on the MetaFrame Server
For those deployments that do not support the Citrix SSL Relay, you can eliminate the possibility of network attack by running a Web server on the server supplying the Web Interface data. Hosting your Web Interface sites on such a Web server routes all Web Interface requests to the Citrix XML Service on the local host, thereby eliminating transmission of the Web Interface data across the network. However, the benefit of eliminating network transmission must be weighed against the risk of exploitation of the Web server.
133
Note On MetaFrame Presentation Server systems, Setup lets you force the Citrix XML Service to share Internet Information Servicess TCP/IP port instead of using a dedicated port. If you enable port sharing, the Citrix XML Service and the Web server use the same port by default. At minimum, you can place both the Web server and the server running MetaFrame Presentation Server behind a firewall so that the communication between the two is not exposed to open Internet conditions. In this scenario, client devices must be able to communicate through the firewall to both the Web server and the server running MetaFrame Presentation Server. The firewall must permit HTTP traffic (often over the standard HTTP port 80 or 443 if a secure Web server is in use) for client device to Web server communication. For client to server communication, the firewall must permit inbound ICA traffic on port 1494 and port 2598. See the server documentation for information about using ICA with network firewalls. For information about using the Web Interface with network address translation, see the Customizing the Web Interface guide.
Using the HTTPS Protocol

You can use the HTTPS protocol to secure the Web Interface data passing between the Web server and the server running MetaFrame Presentation Server. HTTPS uses SSL/TLS to provide strong encryption of data. The Web server makes an HTTPS connection to IIS running on the server running MetaFrame Presentation Server. This requires IIS port sharing at the server running MetaFrame Presentation Server, and for IIS running on the server running MetaFrame Presentation Server to have SSL enabled. The server name you specify (using the console, or in the Farm parameter in WebInterface.conf) must be a fullyqualified DNS name that matches the name of the IIS SSL server certificate. The Citrix XML Service is reached at: https://servername/scripts/wpnbr.dll. For information about how to configure the Web Interface to use the HTTPS protocol using the Access Suite Console, see Managing Secure Client Access on page 70. To configure the Web Interface to use HTTPS using the WebInterface.conf file 1. Open the WebInterface.conf file. 2. Change the value of the Transport setting in the Farmn parameter to HTTPS.
134
Client Session/MetaFrame Presentation Server Communication

The Web Interface communication between client devices and servers consists of passing several different types of client session data including initialization requests and client session information. Initialization requests. The first step in establishing a client session, called initialization, requires the client to request a client session and produce a list of session configuration parameters. These parameters control various aspects of the client session such as which user to log on, the size of the window to draw, and the program to execute in the session. Client session information. After client session initialization, the client passes user keyboard and mouse input to the server as the user client graphical updates.
Risks
To capture and interpret client to server network communications, an attacker must be able to crack the binary client protocol. An attacker with binary client protocol knowledge can: Intercept initialization request information sent from the client, including user credentials Intercept client session information including text and mouse clicks entered by users and screen updates sent from the server
Recommendations
Use SSL/TLS or ICA Encryption
Citrix recommends implementing SSL/TLS or ICA encryption to secure the traffic between your clients and servers. Both methods support 128-bit encryption of the data stream between the client and server, but SSL/TLS also supports verification of the identity of the server. Support for SSL is included in Feature Release 1 for MetaFrame XP and higher, and Feature Release 1 for MetaFrame for UNIX and higher. Support for SSL/TLS is included in Feature Release 2 for MetaFrame XP and higher. Support for ICA encryption is included in Feature Release 1 for MetaFrame 1.8 and MetaFrame Presentation Server and higher. See the client documentation or the Citrix download site for a list of clients that support each method. See the MetaFrame Presentation Server Administrators Guide for more information about ICA encryption.
135
Use Secure Gateway

You can use the Secure Gateway to secure the traffic between your clients and servers over the Internet. The Secure Gateway acts as a secure Internet gateway between SSL/TLS-enabled clients and servers. For more information about the Secure Gateway, see the Secure Gateway Administrators Guide. For information about how to configure the Web Interface for Secure Gateway support using the Access Suite Console, see Configuring Secure Gateway Support on page 107.
General Security Considerations

Citrix recommends that, as with any Windows-based server, you follow Microsoft standard guidelines for configuring the Windows server. Always ensure that all components are up-to-date with all the latest patches. For details and to check for the latest download recommendations, see Microsofts Web site at http://support.microsoft.com.
136
CHAPTER 7
Overview
This chapter introduces the Program Neighborhood Agent and explains how to configure this feature using the config.xml file. Topics include: Using the Program Neighborhood Agent Using the Access Suite Console for Configuration Using the config.xml File Configuring the Web Interface with Program Neighborhood Agent Securing the Program Neighborhood Agent with SSL
138

The Program Neighborhood Agent allows users to access published applications directly from the Windows desktop without using a Web browser. You can remotely configure the placement of links to remote applications from the Start menu, on the Windows desktop, or in the Windows notification area. The Program Neighborhood Agent user interface can also be locked down to prevent user misconfiguration. You can use the Access Suite Console or the config.xml file to configure the Program Neighborhood Agent. For security reasons, users cannot log in through the Program Neighborhood Agent if the Web Interface is using RSA SecurID authentication.
Using the Access Suite Console for Configuration

The Program Neighborhood Agent is configured with default presentation options, authentication methods, and server connection options. The Access Suite Console provides a tool to change the default settings to prevent users from changing specific options. For more information about using the console, see Configuring Sites Using the Console on page 44.
Using the config.xml File

You can also configure the Program Neighborhood Agent using the config.xml file located in the wwwroot\Citrix\PNAgent\conf\clientconfigs directory on the server running the Web Interface. The config.xml file contains a number of parameters divided into eight categories: FolderDisplay. Specifies where to display application icons: in the Start menu, on the Windows desktop, or in the notification area. There are also additional parameters to specify a particular folder in the Start menu and the icon to use on the Windows desktop. This corresponds to the options on the Application Display tab of the PN Agent Properties dialog box. DesktopIntegration. Do not edit. Configuration File. Allows you to specify a different URL for config.xml for the client to use in the future. This facilitates moving users to a different server running the Web Interface. Request. Specifies where the client should request published application data from, and how often to refresh the information. Logon. Specifies the logon method to use.
Chapter 7 Using the Program Neighborhood Agent
139
UserInterface. Specifies whether to hide or display certain groups of options presented to the user as part of the Program Neighborhood Agent interface. FileCleanup. Do not edit. ICA_Options. Specifies the audio and video options for client connections. This corresponds to the options on the ICA Options tab of the Program Neighborhood Agent Properties dialog box.
For more information about using the config.xml file, see the Client for 32-bit Windows Administrator's Guide.
Configuring the Web Interface with Program Neighborhood Agent

Specific WebInterface.conf parameter settings affect the validation of Program Neighborhood Agent requests. Citrix recommends that the settings in WebInterface.conf be consistent with settings in the config.xml file in the Program Neighborhood Agent. The following table explains these parameters (in alphabetical order), the values that affect the Program Neighborhood Agent settings, and their recommended settings:
Parameter AuthenticationMethods Value N/A Recommended Setting Use the same authentication method configured in the Web Interface. Authentication will fail if this method differs in config.xml. This field stops the Program Neighborhood Agent users from successfully authenticating with any other domain. NDS must be enabled in config.xml. DefaultTree in the Logon section of config.xml must contain the same setting.
ForceLoginDomain
N/A
N/A N/A
To configure the Web Interface when using the Program Neighborhood Agent 1. Open the WebInterface.conf file. 2. Locate the following parameters: AuthenticationMethods ForceLoginDomain
140
3. Amend the settings for these parameters as described in the table above. 4. Restart the server running the Web Interface to apply the changes. For more information about config.xml settings, see the Client for 32-bit Windows Administrator's Guide. For more information about WebInterface.conf file settings, see Configuring the Web Interface Using the Configuration File on page 91.
Securing the Program Neighborhood Agent with SSL

To use SSL to secure the communications between the Program Neighborhood Agent and the server running the Web Interface, change the URLs in the following parameters in the config.xml file to use HTTPS. Not all parameters may be specified in your version of the file. FolderDisplay/DesktopDisplay/Icon/Location ConfigurationFile/Location Request/Enumeration/Location Request/Resource/Location
To secure the connection between the Program Neighborhood Agent and the server using SSL, follow the instructions in Managing Secure Client Access on page 70 to configure the Web Interface to use SSL. Check the Enable SSL box in the ICA Client Options tab of the application properties dialog box in the Management Console.
Example
If the line specifying Request/Resource/Location is <Location>http:// server3.eng.citrix.com/Citrix/PNAgent/launch.aspx</Location>, change it to <Location>https://server3.eng.citrix.com/Citrix/PNAgent/launch.aspx </Location>.
Index
141
Index
A
Access Suite Console 42 about 42 getting started 45 using 44 Acrobat Reader requirements 11 address translation configuring 70 mapping 73 address translations editing 73 Advanced Access Control integration with 15, 110 advanced server settings 51 anonymous authentication 54 security considerations 54 application publishing 16 application refresh options 86 application sets 16 application shortcuts managing 68 appsrv.ini file editing for pass-through 59 editing for smart card support 55 authentication anonymous 54 configuring 53 explicit 53, 59 methods 53 pass-through 53, 57 pass-through with smart card 53 prompt 53, 59 recommendations 54 smart card 53 two-factor 60
C
certificate key size 125 Citrix SSL Relay configuring the Web Interface for 50, 107 overview 126 see also SSL Citrix XML Service configuring communication with 52, 106 configuring fault tolerance 49 role in the Web Interface 17 TCP/IP port configuration 50 viewing the port assignment 29 classes 17 client configuration files managing 85 client connection settings managing 83 client deployment managing 74 client devices requirements 27 role in the Web Interface 17 security 128, 134 client files copying to the server 118 Client for Java deployment of components 78 overview 121 using private root certificates with 79 Client for Win32 configuring for pass-through 58 configuring for smart card support 55 deploying automatically 76 installation files 119 Program Neighborhood Agent 121 client installation 77 clients deploying with custom certificates 80 download settings 77 installation 77 user customization 83 client-side proxy settings editing 82 command line 34
B
bandwidth control 84
142
Components CD 27 Conferencing Manager configuring on UNIX 33 Conferencing Manager Guest Attendee sites 13 configuration files exporting 91 importing 91 configure and run discovery 36, 45 configuring SmartAccess 112 using the Access Suite Console 42 config.xml 42, 121 about 138 content publishing 14 content redirection enabling 52 context-sensitive help 44 cookies 128 creating sites 37, 46
H
help displaying 44 HTTP 50 HTTPS 50 HTTPS protocol 133
I
ICA Encryption 126, 134 ICA files 129 initialization 134 installation using the command line 34 installation captions 77, 118, 120 installing on UNIX platforms 32 on Windows 30 overview 28 security considerations 29 integration with Advanced Access Control 15, 110 Internet Information Services requirements 25
D
Dell Axim requirements 27 deploying SmartAccess 111 diagnostic logging controlling 89 discovery 45 DMZ settings editing 70 documentation other sources 10
J
JavaServer Pages 43
L
language packs 34 legacy support 78 load balancing between Secure Ticket Authorities 72 XML requests 49 load balancing sites 89 local site tasks 90 Login page making the default 108
E
enabling content redirection 52 socket pooling 51 error messages disabling 107 expiry time of tickets 50 explicit authentication 53
M
MetaFrame Presentation Server UNIX configuration requirements 25 MetaFrame Presentation Server for UNIX determining Citrix XML service ports 29 MetaFrame Presentation Server sites 12 Microsoft domain-based authentication 60
F
fault tolerance configuring 49, 72 firewall configuring address translation 70
Index
RSA SecurID authentication 59 PASSCODES 61 tokencodes 61 running discovery 36, 45
143
N
navigation page 110 integration with 16 NDS authentication 23, 60 support 13 network address translation 70 Novell Directory Services see NDS
S
Safari requirements 27 SafeWord authentication 59 secure client access 70 secure client access settings displaying 73 Secure Gateway about 127 between clients and MetaFrame Presentation Server 135 configuring the Web Interface for 71 example of how to configure 107 ticketing 71 Secure Sockets Layer see SSL Secure Ticket Authority 71 SecureICA see ICA Encryption securing the Web Interface 127 security 123 and anonymous authentication 54 Citrix SSL Relay client-to-server communication 127 configuring the Citrix SSL Relay 131 general considerations 135 ICA Encryption 126 network communication 128, 130 client and server 134 protocols and Citrix solutions 125 Secure Gateway 127 between clients and MetaFrame Presentation Server 135 configuring the Web Interface for 71 SSL adding certificates 132 between clients and MetaFrame Presentation Server 134 between Web server and Web browser 129 TLS between clients and MetaFrame Presentation
O
online help 44
P
pass-through configuring 57 pass-through authentication 53 pass-through with smart card 53 password enabling users to change 59 performance considerations 29 Personal Digital Assistants requirements 27 supported configurations 27 private root certificates 79 Program Neighborhood Agent 121 about 121 configuration 42 configuration settings 105 configuring 138 config.xml 138 securing 128, 140 Program Neighborhood Agent Services sites 13 prompt authentication 53 publishing applications 16 publishing content 14
R
readme file 10 Remote Desktop Connection and the Trusted Sites zone 75 requirements 75 Repair option 39 repairing sites 90
144
socket pooling enabling 51 SSL adding certificates 132 and Secure Gateway 71 between clients and MetaFrame Presentation Server 134 certificate key size 125 configuring the Citrix SSL Relay 131 overview 125 secure Web servers 129 see Citrix SSL Relay support support for SmartAccess 15 system requirements 2227 client device 27 SmartAccess 110 Web server 25
Server 134 between Web server and Web browser 129 overview 125 when installing the Web Interface 29 server farms creating 48 managing 47 password change considerations 48 removing 48 role in the Web Interface 16 specifying settings for all servers 50 server settings managing 69 specifying advanced 51 servers configuring communication with 106 role in the Web Interface 17 scripts 43 security 129 security considerations 134 session options changing 67 sessions see client sessions site configuration 38 site tasks using 38 using local 90 site types 46 sites configuring using the Access Suite Console 44 creating 37, 46 creating for use with SmartAccess 113 creating on UNIX 38 load balancing 89 repairing 90 specifying configuration 38 uninstalling 90 smart card about 53 enabling 54 example of how to configure 56 requirements 55 SmartAccess 15, 110 and workspace control 114 configuring 112 creating sites for use with 113 deploying 111 support for 15 system requirements 110
T
tasks performing 47 ticketing 15, 129 and Secure Gateway 71 configuring ticket expiry time 50 TLS and Secure Gateway 71 between clients and MetaFrame Presentation Server 134 certificate key size 125 overview 125 secure Web servers 129 troubleshooting installation 39 two-factor authentication 60
U
Unicode ICA files 78 uninstalling 39 uninstalling sites 90 UNIX platforms installing on 31 upgrading 28 UPN authentication 60 restricting suffixes 60 support
user appearance customizing 69 user principal name see UPN user requirements 27
Index
145
W
Web Client deploying 76 Web Interface configuring 42 configuring with Program Neighborhood Agent 139 features 12 how it works 18 introduction 12 making available to users 108 overview 18 running on a server 132 Web server requirements 25 Web-based client installation 17 copying clients to the server 118 WebInterface.conf about 42 configuring the Web Interface with 91 parameters 92 Windows authentication 60 Windows Directory Service Mapper 56 Windows platforms installing on 30 Windows-based Terminals 27 workspace control about 86 and SmartAccess 114 automatic reconnection 88 enabling 88 log off behavior 88 reconnect option 88 requirements 86 with integrated authentication 87

Web Interface Guide

Uploaded by

Document Informationclick to expand document information

Copyright:

Available Formats

Web Interface Guide

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Web Interface Guide

Uploaded by

Copyright:

Available Formats

Web Interface Administrators Guide

For other guides in this document set, go to the Document Center

Document Code: September 14, 2005 11:47 am (ER)

Deploying the Web Interface

Web Interface Administrators Guide

Configuring the Web Interface

Web Interface Administrators Guide

Configuring SmartAccess for the Web Interface

MetaFrame Presentation Server Clients and the Web Interface

Configuring Web Interface Security

Web Interface Administrators Guide

Using the Program Neighborhood Agent

Web Interface Administrators Guide

How to Use this Guide

Finding More Information

Adding the Latest Version of the Guide to the Document Center

Web Interface Administrators Guide

Introducing the Web Interface

The Web Interface Features

MetaFrame Presentation Server Sites

Program Neighborhood Agent Services Sites

Conferencing Manager Guest Attendee Sites

Web Interface Administrators Guide

Application Access Features

Client Deployment Features

Integration with the Access Gateway with Advanced Access Control

Web Interface Administrators Guide

Enhanced Content Redirection Support

Web Interface Components

Web Interface Administrators Guide

How the Web Interface Works

Web Interface Administrators Guide

Deploying the Web Interface

Web Interface Administrators Guide

Supported MetaFrame Presentation Server Versions

Access Suite Console

Upgrading the Console

Chapter 2 Deploying the Web Interface

Additional Software Requirements

MetaFrame Presentation Server and Client Version Requirements

Smart card support

Web Interface Administrators Guide

Web Interface Feature Enhanced Content Publishing

Client Requirements 6.20 or later

Server-side firewall support

Client-side firewall support Load balancing

End-user change password

Auto-download the Web Client for Win32 Pass-through authentication

Embedded clients Secure Gateway support

Chapter 2 Deploying the Web Interface

General Configuration Requirements

Web Server Requirements

Web Interface Administrators Guide

Chapter 2 Deploying the Web Interface

Personal Digital Assistants

MetaFrame Presentation Server Client Device Requirements

Web Interface Administrators Guide

Installing the Web Interface

Installing the Web Interface