F5 Logo MyF5
Search
  1. MyF5 Home
  2. Knowledge Centers
  3. BIG-IP APM
  4. BIG-IP Access Policy Manager: Third-Party Integration Implementations
  5. Integrating APM with a Citrix Web Interface Site
Manual Chapter : Integrating APM with a Citrix Web Interface Site

Applies To:

Show Versions Show Versions

BIG-IP APM

  • 11.5.1
Manual Chapter
Table of Contents | << Previous Chapter | Next Chapter >>

Overview: Integrating APM with Citrix Web Interface sites

In this implementation, Access Policy Manager performs authentication while integrating with a Citrix Web Interface site. The Web Interface site communicates with the XenApp server, renders the user interface, and displays the applications to the client.

Traffic flow in an APM and Citrix web interface configuration APM Citrix Web Interface integration with SmartAccess support

The preceding figure shows a configuration with one virtual server that communicates with clients and the Web Interface site.

  1. A user (client browser or Citrix Receiver) requests access to applications or features.
  2. The external virtual server starts an access policy that performs authentication and sets SmartAccess filters.
  3. The external virtual server sends the authenticated request and filters to the Citrix Web Interface site. The Citrix Web Interface site, in turn, forwards the information to the XML broker (XenApp server).
  4. The XML Broker returns a list of allowed applications to the Citrix Web Interface site.
  5. The Citrix Web Interface site renders and displays the UI to the user.

In cases where the Web Interface site cannot communicate with an external virtual server, you must configure an additional, internal, virtual server to manage requests from the Citrix Web Interface as part of Smart Access and SSO. You need an internal virtual server, for example, when the Web Interface site is behind a firewall, uses HTTP in the Authentication URL, or uses a different SSL CA certificate for establishing trust with APM than the one used by client devices.

Traffic flow in APM and Citris web interface integration Internal virtual server for requests from Web Interface site

Supported clients

This implementation supports web clients and Citrix Receiver (iOS, Android, Mac, Windows, and Linux) clients.

Supported authentication

For Citrix Receiver Windows and Linux clients: only Active Directory authentication is supported.

For Citrix Receiver clients for iOS, Android, and Mac: Active Directory, or both RSA and Active Directory authentication is supported.

For web clients, you are not restricted in the type of authentication you use.

Task summary for APM integration with Citrix Web Interface sites

Ensure that you configure the Citrix components in the Citrix environment, in addition to configuring the BIG-IP system to integrate with Citrix Web Interface sites.

Perform these tasks on the BIG-IP system to integrate Access Policy Manager with a Citrix Web Interface site.

Task list

Creating an access policy for Citrix SSO

Before you can create an access policy for Citrix single sign-on (SSO), you must meet these requirements:
  • Configure the appropriate AAA servers to use for authentication.
    Note: An Active Directory AAA server must include the IP address of the domain controller and the FQDN of the Windows domain name. If anonymous binding to Active Directory is not allowed in your environment, you must provide the admin name and password for the Active Directory AAA server.
  • Create an access profile using default settings.
Configure an access policy to authenticate a user and enable single sign-on (SSO) to Citrix published resources.
Note: APM supports different types of authentication depending on the client type. This access policy shows how to use both RSA SecurID and AD Auth authentication (supported for Citrix Receiver for iOS, Mac, and Android) or AD Auth only (supported for Citrix Receiver for Windows and Linux). Use the type of authentication for the client that you need to support.
  1. On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
  2. In the Access Policy column, click the Edit link for the access profile you want to configure. The visual policy editor opens the access policy in a separate screen.
  3. Click the (+) icon anywhere in the access policy to add a new action item. A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
  4. From the Logon Page tab, select Logon Page, and click Add Item. A properties screen displays.
  5. Configure the Logon Page properties:
    • To support Active Directory authentication only, click Save.
    • To support both Active Directory and RSA SecurID authentication, configure the Logon Page to accept an RSA token and an AD password and click Save.
    In this example, Logon Page Input Field #2 accepts the RSA Token code into the session.logon.last.password variable (from which authentication agents read it). Logging Page Input Field #3 saves the AD password into the session.logon.last.password1 variable. Logon Page properties screen The properties screen closes.
  6. Optional: To add RSA SecurID authentication, click the plus (+) icon between Logon Page and Deny:
    1. From the Authentication tab, select RSA SecurID, and click Add Item.
    2. In the properties screen from the Server list, select the AAA server that you created previously and click Save. The properties screen closes.
    3. After the RSA SecurID action, add a Variable Assign action. Use the Variable Assign action to move the AD password into the session.logon.last.password variable.
    4. Click Add new entry. An empty entry appears in the Assignment table.
    5. Click the change link next to the empty entry. A dialog box appears, where you can enter a variable and an expression.
    6. From the left-side list, select Custom Variable (the default), and type session.logon.last.password.
    7. From the right-side list, select Custom Expression (the default), and type expr { "[mcget -secure session.logon.last.password1] }". Variable Assign add entry screenshot The AD password is now available for use in Active Directory authentication.
    8. Click Finished to save the variable and expression, and return to the Variable Assign action screen.
  7. Add the AD Auth action after one of these actions:
    • Variable Assign - This action is present only if you added RSA SecurID authentication.
    • Logon Page - Add here if you did not add RSA SecurID authentication.
    A properties screen for the AD Auth action opens.
  8. Configure the properties for the AD Auth action:
    1. From the AAA Server list, select the AAA server that you created previously.
    2. To support Citrix Receiver clients, you must set Max Logon Attempts to 1.
    3. Configure the rest of the properties as applicable to your configuration and click Save.
  9. Click the Add Item (+) icon between AD Auth and Deny.
    1. From the Assignment tab, select SSO Credential Mapping, and click Add Item.
    2. Click Save.
    The SSO Credential Mapping makes the information from the session.logon.last.password variable available (for Citrix SSO).
  10. Add a Variable Assign action after the SSO Credential Mapping action. Use the Variable Assign action to pass the domain name for the Citrix Web Interface site so that a user is not repeatedly queried for it.
    1. Click Add new entry. An empty entry appears in the Assignment table.
    2. Click the change link next to the empty entry. A dialog box appears, where you can enter a variable and an expression.
    3. From the left-side list, select Custom Variable (the default), and type session.logon.last.domain.
    4. From the right-side list, select Custom Expression (the default), and type an expression expr {"DEMO.LON"}, to assign the domain name for the Citrix Web Interface site (where DEMO.LON is the domain name of the Citrix Web Interface site). Custom Variable session.logon.last.domain = Custom Expression expr{"DEMO.LON"}
    5. Click Finished to save the variable and expression, and return to the Variable Assign action screen.
  11. On the fallback path between the last action and Deny, click Deny, and then click Allow and Save.
  12. Click Close.

You should have an access policy that resembles either of these examples:

Example policy with an AD Auth action Example access policy with AD authentication, credential mapping, and Web Interface site domain assignment
Example policy with RSA Auth and AD Auth actions Configuring RSA SecurID authentication before AD authentication

Adding Citrix Smart Access actions to an access policy

To perform this task, first select the access profile you created previously, and open the associated access policy for edit.
You can set one or more filters per Citrix Smart Access action. If you include multiple Citrix Smart Access actions in an access policy, Access Policy Manager accumulates the SmartAccess filters that are set throughout the access policy operation.
  1. Click the( +) icon anywhere in your access profile to which you want to add the Citrix Smart Access action item. The Add Item screen opens.
  2. From General Purpose, select Citrix Smart Access and click Add Item. The Variable Assign: Citrix Smart Access properties screen opens.
  3. Type the name of a Citrix SmartAccess filter in the open row under Assignment. A filter can be any string. Filters are not hardcoded, but must match filters that are configured in the XenApp server for application access control or a user policy.
    Note: In the XenApp server, you must specify APM as the Access Gateway farm when you configure filters.
  4. To add another filter, click Add entry and type the name of a Citrix filter in the open row under Assignment.
  5. When you are done adding filters, click Save to return to the Access Policy.
You now need to save the access policy and assign it to a virtual server.

Example access policy with Citrix SmartAccess filters

Here is a typical example access policy that uses Citrix SmartAccess filters to restrict access to published applications based on the result of client inspection. Client inspection can be as simple as IP Geolocation Match or Antivirus. The figure shows an access policy being configured with a Citrix Smart Access action to set a filter to antivirus after an antivirus check is successful.

Variable Assign:Citrix Smart Access is set to antivirus in this example. Example access policy with Citrix SmartAccess action and an antivirus check

Creating a pool of Citrix Web Interface servers

Create a pool of Citrix Web Interface servers for high availability.
  1. On the Main tab, click Local Traffic > Pools. The Pool List screen opens.
  2. Click Create. The New Pool screen opens.
  3. In the Name field, type a unique name for the pool.
  4. In the Resources area, using the New Members setting, add each resource that you want to include in the pool:
    1. Type an IP address in the Address field, or select Node List and select an address from the list of available addresses.
    2. If access to the Web Interface site is through SSL, in the Service Port field type 443; otherwise, type 80.
    3. Click Add.
  5. Click Finished.
The new pool appears in the Pools list.

Adding a connectivity profile

Create a connectivity profile to configure client connections for Citrix remote access.
Note: A Citrix client bundle provides an installable Citrix Receiver client. The default parent connectivity profile includes a default Citrix client bundle.
  1. On the Main tab, click Access Policy > Secure Connectivity. A list of connectivity profiles displays.
  2. Click Add. The Create New Connectivity Profile popup screen opens and displays General Settings.
  3. Type a Profile Name for the connectivity profile.
  4. From the Parent Profile list, select the default profile, connectivity.
  5. To use a Citrix bundle that you have configured, select Citrix Client Settings from the left pane and select the bundle from the Citrix Client Bundle list in the right pane. The default Citrix client bundle is included if you do not perform this step.
  6. Click OK. The popup screen closes, and the Connectivity Profile List displays.
The connectivity profile appears in the Connectivity Profile List.

Creating a custom HTTP profile

An HTTP profile defines the way that you want the BIG-IP system to manage HTTP traffic.
  1. On the Main tab, click Local Traffic > Profiles > Services > HTTP. The HTTP profile list screen opens.
  2. Click Create. The New HTTP Profile screen opens.
  3. In the Name field, type a unique name for the profile.
  4. From the Parent Profile list, select http.
  5. Select the Custom check box.
  6. From the Redirect Rewrite list, select All.
  7. Click Finished.
The custom HTTP profile now appears in the HTTP profile list screen.

Configuring the external virtual server

Create a virtual server to support Citrix traffic and respond to client requests.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Host and in the Address field, type the IP address for the virtual server. If you plan to configure only one virtual server to integrate with Citrix Web Interface sites, then the authentication URL of the Web Interface site must match the IP address of this virtual server.
  5. In the Service Port field, type 443 or select HTTPS from the list.
  6. From the Configuration list, select Advanced.
  7. Optional: For the SSL Profile (Client) setting, select an SSL profile with an SSL certificate that is trusted by clients.
  8. If you use SSL to access the Web Interface site, add an SSL profile to the SSL Profile (Server) field.
  9. From the HTTP Profile list, select the custom http profile that you created previously. The HTTP profile must have Redirect Rewrite set to All.
  10. From the Source Address Translation list, select Auto Map.
  11. In the Access Policy area, from the Access Profile list, select the access profile.
  12. In the Access Policy area, from the Connectivity Profile list, select the connectivity profile.
  13. Select the VDI & Java Support check box.
  14. In the Resources area, from the Default Pool list, select the name of the pool that you created previously.
  15. Click Finished.
The access policy is now associated with the virtual server.

Creating a data group to support a nonstandard Citrix service site

By default, APM recognizes /Citrix/PNAgent/config.xml as the default URL that Citrix Receiver clients request. If your Citrix Receiver clients use a value that is different from /Citrix/PNAgent/config.xml, you must configure a data group so that APM can recognize it.
  1. On the Main tab, click Local Traffic > iRules > Data Group List. The Data Group List screen opens, displaying a list of data groups on the system.
  2. Click Create. The New Data Group screen opens.
  3. In the Name field, type APM_Citrix_ConfigXML. Type the name exactly as shown.
  4. From the Type list, select String.
  5. In the Records area, create a string record.
    1. In the String field, type the FQDN of the external virtual server (using lowercase characters only). For example, type apps.mycompany.com.
    2. In the Value field, type the value that you use instead of Citrix/PNAgent/config.xml. For example, type /Connect/config.xml.
    3. Click Add.
  6. Click Finished. The new data group appears in the list of data groups.

Configuring an internal virtual server

Before you start this task, configure an access profile with default settings.
Configure an internal virtual server to handle requests from the Citrix Web Interface site when it is behind a firewall, using HTTP, or otherwise unable to communicate with an external virtual server.
  1. On the Main tab, click Local Traffic > Virtual Servers. The Virtual Server List screen opens.
  2. Click the Create button. The New Virtual Server screen opens.
  3. In the Name field, type a unique name for the virtual server.
  4. For the Destination setting, select Host and in the Address field, type the IP address for the virtual server. When you configure an internal virtual server, the authentication URL of the Web Interface site must match the IP address of this virtual server.
  5. For the Service Port setting, select HTTP or HTTPS. The protocol you select must match the protocol you used to configure the authentication service URL on the Web Interface site.
  6. If you are encrypting traffic between the APM and the Citrix Web Interface, for the SSL Profile (Client) setting, select an SSL profile that has an SSL certificate trusted by the Citrix Web Interface.
  7. From the HTTP Profile list, select http.
  8. In the Access Policy area, from the Access Profile list, select the access profile.
  9. In the Access Policy area, from the Connectivity Profile list, select the connectivity profile.
  10. Select the VDI & Java Support check box.
  11. Click Finished.
The access policy is now associated with the virtual server.
Table of Contents | << Previous Chapter | Next Chapter >>
Contact Support Contact Support

Have a Question?

Support and Sales >

About F5

Education

F5 Sites

Support Tasks




©2023 F5 Networks, Inc. All rights reserved.


Trademarks Policies Privacy California Privacy Do Not Sell My Personal Information