Integrating APM with Citrix XML Brokers

Creating a pool of Citrix XML Brokers

On the Main tab, click
Local Traffic
>
Pools
.The Pool List screen opens.
Click
Create
.The New Pool screen opens.
In the
Name
field, type a unique name for the pool.
In the Resources area, using the
New Members
setting, add each resource that you want to include in the pool:
Either type an IP address in the
Address
field, or select a preexisting node address from the
Node List
.
If access to the XML Broker is through SSL, in the
Service Port
field, type
443
or select
HTTPS
from the list; otherwise, type
80
or select
HTTP
from the list.
Click
Add
.
Click
Finished
.

Configuring a Citrix remote desktop resource

On the Main tab, click
Access Policy
>
Application Access
>
Remote Desktops
>
Remote Desktops List
.The Remote Desktops list opens.
Click
Create
.The New Resource screen opens.
Type a name for the remote desktop resource.
For the
Type
setting, retain the default
Citrix
.
For the
Destination
setting, select
Pool
and select the pool that you created previously.
In the Single Sign-On area, select the
Enable SSO
check box for single sign-on to a Citrix XML Broker after logging in to Access Policy Manager
®
(APM
®
).
From the
SSO Method
list, select the type of single sign-on to use, either Password-based, Kerberos, SmartCard, or Anonymous.The Kerberos and SmartCard options enable password-less authentication. You cannot use either of them successfully unless Citrix is configured for SmartCard SSO (Kerberos) or SmartCard.The fields that are displayed vary based on this selection.
In the
Username Source
field, accept the default or type the session variable to use as the source for the SSO user name.
In the
Password Source
field, accept the default or type the session variable to use as the source for the SSO user password.
In the
Domain Source
field, accept the default or type the session variable to use as the source for the SSO user domain.
From the
Kerberos SSO
list, select a Kerberos SSO configuration that has already been configured.
In the Customization Settings for language_name area, type a
Caption
.The caption is the display name of the Citrix resource on the APM webtop.
Click
Finished
.All other parameters are optional.

Configuring a dynamic webtop

On the Main tab, click
Access Policy
>
Webtops
.The Webtops screen displays.
Click
Create
.The New Webtop screen opens.
In the
Name
field, type a name for the webtop.
From the
Type
list, select
Full
.The Configuration area displays with additional settings configured at default values.
Click
Finished
.

Creating an access policy for Citrix SSO (APM dynamic webtop)

Configure the appropriate AAA servers to use for authentication.
An Active Directory AAA server must include the IP address of the domain controller and the FQDN of the Windows domain name. If anonymous binding to Active Directory is not allowed in your environment, you must provide the admin name and password for the Active Directory AAA server.
Create an access profile using default settings.

On the Main tab, click
Access Policy
>
Access Profiles
.The Access Profiles List screen opens.
In the Access Policy column, click the
Edit
link for the access profile you want to configure.The visual policy editor opens the access policy in a separate screen.
Click the
(+)
icon anywhere in the access policy to add a new action item.
Note:
Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
Type
client
in the search field, and select
Client Type
from the results.A properties screen displays.
Click
Save
.
On the properties screen, on the Logon tab, select an access policy as appropriate:
Logon Page
: Specify this if you allow one-factor password authentication with a single logon prompt containing one password field.
Citrix Logon Prompt
: Specify this if you allow two-factor password authentication with a single logon prompt containing two password fields.
Click
Save
.The properties screen closes, and the Client Type action and Logon action displays in the visual policy editor.
To configure actions for Citrix Receiver for Windows and Linux clients, perform these substeps.
Note:
Citrix Receiver for Windows version 3.4 and later, and Citrix Receiver for Linux, version 13 and later, support Active Directory authentication only.
Click the (
+
) icon on the Citrix Receiver (legacy) branch after the Client Type action.
On the Logon tab, select either
Logon Page
or
Citrix Logon Prompt
, and click
Add Item
.A properties screen displays. The default page settings are acceptable.
Click
Save
.
After the Logon Page action, add an SSO Credential Mapping action with default settings.
After the SSO Credential Mapping action, click the (
+
) icon.
Type
var
into the search field, select
Variable Assign
from the results, and click
Add Item
.Use the Variable Assign action to pass the domain name for the Citrix remote desktop resource so that a user is not repeatedly queried for it.A properties screen opens.
Click
Add new entry
.An
empty
entry appears in the Assignment table.
Click the
change
link next to the empty entry.A dialog box opens, where you can enter a variable and an expression.
From the left-side list, retain the
Custom Variable
setting, and type
session.logon.last.domain
.
From the right-side list, retain the
Custom Expression
setting, and type
expr {"example.com"}
to assign the domain name for the Citrix remote desktop resource (where
example.com
is the domain name of the resource).The Citrix remote desktop resource equates to an XML Broker that is selected from a pool.
Click
Finished
.
Click
Save
.
After the previous action, click the
Deny
ending, and select the
Allow
ending.
The access policy branch for legacy Citrix Receiver clients is complete.
To configure actions for Citrix Receiver for iOS, Android, and Mac, complete the remaining steps.Citrix Receiver for iOS, Android, and Mac, support both RSA SecurID and AD Auth authentication. This example shows how to use both.
After the Client Type action, on the Citrix Receiver branch, click the (
+
) icon.
On the Logon tab, select either
Logon Page
, and click
Add Item
.
Customize the Logon Page to accept an RSA token and an Active Directory password:
In row 2: From the
Type
list, select
password
; in the
Post Variable Name
field, type
password1
; in the
Session Variable Name
field, type
password1
.APM stores the text that a user types into this field in the session.logon.last.password1 session variable.You have added another password field to the logon page.
In
Login Page Input Field #2
, type
Password
.You replaced the existing prompt for the first password field.
In
Login Page Input Field #3
, type
Passcode
.You provided a prompt for the second password field.
To add RSA SecurID authentication, click the plus (
+
) icon between
Logon Page
and
Deny
:
Type
rsa
in the search field, select
RSA SecurID
from the results, and click
Add Item
.
From the
Server
list, select the AAA RSA SecurID server that you created previously and click
Save
.The properties screen closes.
After the RSA SecurID action, add a Variable Assign action.Use the Variable Assign action to move the AD password into the session.logon.last.password session variable; the authentication agent requires this.A Variable Assign properties page opens.
Click
Add new entry
.An
empty
entry appears in the Assignment table.
Click the
change
link next to the empty entry.A dialog box opens, where you can enter a variable and an expression.
From the left-side list, retain the
Custom Variable
setting, and type
session.logon.last.password
.
From the right-side list, retain the
Custom Expression
setting, and type
expr { "[mcget -secure session.logon.last.password1]" }
. For two-factor authentication, type
expr {[mcget {session.logon.last.password1}]}
.
Click
Finished
to save the variable and expression, and return to the Variable Assign action screen.
Click
Save
.
After the previous action, add an AD Auth action and configure properties for it:
From the
AAA Server
list, select the AAA server that you created previously.
If you are using Android Citrix receiver with a disabled session ID rotation in APM, you must set
Max Logon Attempts
to
1
.
Configure the rest of the properties as applicable to your configuration, and click
Save
.
Click the Add Item (
+
) icon between
AD Auth
and
Deny
.
On the Assignment tab, select
SSO Credential Mapping
, and click
Add Item
.
Click
Save
.
The SSO Credential Mapping makes the information from the session.logon.last.password variable available for Citrix SSO.
Add a Variable Assign action after the SSO Credential Mapping action.Use the Variable Assign action to pass the domain name for an XML Broker so that a user is not repeatedly queried for it.
Click
Add new entry
.An
empty
entry appears in the Assignment table.
Click the
change
link next to the empty entry.A dialog box opens, where you can enter a variable and an expression.
From the left-side list, select
Custom Variable
(the default), and type
session.logon.last.domain
.
From the right-side list, select
Custom Expression
(the default), and type an expression
expr {"example.com"}
.
Click
Finished
to save the variable and expression, and return to the Variable Assign action screen.
On the fallback path between the last action and
Deny
, click
Deny
, and then click
Allow
and
Save
.The access policy branch for the Citrix Receiver client type is complete.
Click the
Apply Access Policy
link to apply and activate the changes to the access policy.
Click
Close
.

Assigning Citrix resources to an access policy for Citrix integration

Click the
(+)
icon anywhere in the access policy to add a new action item.
Note:
Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
On the Assignment tab, select
Advanced Resource Assign
and click
Add Item
.The properties screen opens.
Click
Add new entry
.An
Empty
entry displays.
Click the
Add/Delete
link below the entry.The screen changes to display resources that you can add and delete.
Select the Remote Desktop tab.A list of remote desktop resources is displayed.
Select Citrix remote desktop resources and click
Update
.You are returned to the properties screen where Remote Desktop and the names of the selected resources are displayed.
Click
Add new entry
.An
Empty
entry displays.
Click the
Add/Delete
link below the entry.The screen changes to display resources that you can add and delete.
Select the Webtop tab.A list of webtops is displayed.
Select a webtop and click
Update
.The screen changes to display properties and the name of the selected webtop is displayed.
Select
Save
to save any changes and return to the access policy.

Adding Citrix Smart Access actions to an access policy

Click the(
+
) icon anywhere in your access profile to which you want to add the Citrix Smart Access action item.The Add Item screen opens.
From
General Purpose
, select
Citrix Smart Access
and click
Add Item
.The Variable Assign: Citrix Smart Access properties screen opens.
Type the name of a Citrix SmartAccess filter in the open row under Assignment.A filter can be any string. Filters are not hardcoded, but must match filters that are configured in the XenApp™ server for application access control or a user policy.
In the XenApp server, you must specify
APM
as the Access Gateway farm when you configure filters.
To add another filter, click
Add entry
and type the name of a Citrix filter in the open row under Assignment.
When you are done adding filters, click
Save
to return to the Access Policy.
Click the
Apply Access Policy
link to apply and activate the changes to the access policy.

Example access policy with Citrix SmartAccess filters

Verifying log settings for the access profile

On the Main tab, click
Access Policy
>
Access Profiles
.The Access Profiles List screen opens.
Click the name of the access profile that you want to edit.The properties screen opens.
On the menu bar, click
Logs
.The access profile log settings display.
Move log settings between the
Available
and
Selected
lists.You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.
Note:
Logging is disabled when the
Selected
list is empty.
Click
Update
.

Adding a connectivity profile

On the Main tab, click
Access Policy
>
Secure Connectivity
.A list of connectivity profiles displays.
Click
Add
.The Create New Connectivity Profile popup screen opens and displays General Settings.
Type a
Profile Name
for the connectivity profile.
From the
Parent Profile
list, select the default profile,
connectivity
.
To use a Citrix bundle that you have configured, select
Citrix Client Settings
from the left pane and select the bundle from the
Citrix Client Bundle
list in the right pane.The default Citrix client bundle is included if you do not perform this step.
Click
OK
.The popup screen closes, and the Connectivity Profile List displays.

Adding Citrix Receiver for HTML5 to a connectivity profile

From the command line, type
msiexec /a filepath to MSI file /qb TARGETDIR=filepath to target folder
.
On the Main tab, click
Access Policy
>
Application Access
>
Remote Desktops
>
Citrix Client Bundles
.
In the
Name
field, type a name that includes
html5
.
From the
Source
list, select
Windows Package File
.
Click
Choose File
and upload the file ./Citrix/HTML5 Management/HTML5Client.zip.
On the Main tab, click
Access Policy
>
Secure Connectivity
.
Click the
Connectivity Profile List
tab.
Select the connectivity profile you want to update.
Click
Edit Profile
.A popup screen opens.
Click
Citrix Client Settings
.
From the
Citrix Client Bundle
list, select the bundle with
html5
in its name.
On the Main tab, click
Access Policy
>
Hosted Content
>
Manage Profile Access
.
Click the checkbox next to the Access Profile that is associated with the Citrix Virtual Server.
Click
OK
.

Creating a virtual server to support Citrix web and mobile clients

On the Main tab, click
Local Traffic
>
Virtual Servers
.The Virtual Server List screen opens.
Click the
Create
button.The New Virtual Server screen opens.
In the
Name
field, type a unique name for the virtual server.
In the
Destination Address
field, type the IP address for a host virtual server.This field accepts an address in CIDR format (IP address/prefix). However, when you type the complete IP address for a host, you do not need to type a prefix after the address.
In the
Service Port
field, type
443
or select
HTTPS
from the list.
From the
Configuration
list, select
Advanced
.
For the
SSL Profile (Client)
setting, from the
Available
list, select an SSL profile with an SSL certificate that the clients trust, and use the Move button to move the name to the
Selected
list.
If access to XML Brokers requires SSL, then for the SSL Profile (Server) setting, select an SSL profile.
From the
Source Address Translation
list, select
Auto Map
.
In the Access Policy area, from the
Access Profile
list, select the access profile that you configured earlier.
In the Access Policy area, from the
Connectivity Profile
list, select the connectivity profile.
From the
VDI Profile
list, select a VDI profile.You can select the default profile,
vdi
.
Click
Finished
.

Updating the handshake timeout in a Client SSL profile

On the Main tab, click
Local Traffic
>
Profiles
>
SSL
>
Client
.The Client profile list screen opens.
In the Name column, click the name of the profile you want to modify.
From the
Configuration
list, select
Advanced
.
Scroll down to
Handshake Timeout
and select the
Custom
check box.Additional settings become available.
To limit the timeout to a number of seconds, select
Specify
from the list, and type the desired number in the
seconds
field.In the list, the value
Indefinite
specifies that the system continue trying to establish a connection for an unlimited time. If you select
Indefinite
, the
seconds
field is no longer available.
Click
Update
.