About This Release. Understanding Services Manager Deployment Citrix Systems, Inc. All rights reserved. p.1

Transcription

1 About This Release Updated: The CloudPortal Services Manager is data-center installed software that enables you to host, sell, and resell hosted applications and related infrastructure. Managed through a web browser, the control panel is a scalable environment for service providers and resellers who provision and manage customer solutions. Service providers can: Create their own Customers and Reseller Customers Configure, provision, and assign Services to Customers and Resellers Customers of Service Providers can assign provisioned Services to Users. Reseller Customers can: Create Customers Assign provisioned Services to Customers Manage Users View reports Customers of Resellers can: Create and manage Users Assign provisioned Services to Users View reports A Customer is a container that can consist of: An Administrator who can manage Users, and provision and manage Services Services that can be made available (that is, provisioned) to Users Users who consume one or more Services assigned to them Other Customers (known as Resellers or tenants) who can provision Services to Users When you create a Customer, you specify the customer location (that is, customer domain) and any advanced properties. Advanced properties can include password expiry rules, optional Active Directory organizational structure, and service security roles. You can select one or more security roles to enable the customer to administer available services. Understanding Services Manager Deployment A CloudPortal Services Manager deployment includes the following core components (server roles) that you install and configure: The Web Server hosts the control panel s web interface and API services. The control panel is the primary user interface for service providers, resellers and end-customer users. The customer administrator can manage the organization s users and associated services within the same system. Users can perform administrative and self-service tasks that have been delegated to them. Provisioning requests are sent from the Web Server to the Provisioning Engine through a Microsoft Message Queue. The main system databases are the Microsoft SQL Server repositories for user, customer, and configuration information. Several system databases are automatically created when you install and configure the server roles. The Services Manager Reporting Service uses Microsoft SQL Server Reporting Services Citrix Systems, Inc. All rights reserved. p.1

2 The Provisioning Engine performs all provisioning tasks. It expedites requests from the Web Server and automates managed services and resources. The Directory Web Service provides the Web Server with function calls related to Active Directory, such as user authentication, user account status inquiries, user enabling and disabling, and security group management. The Data Warehouse performs scheduled storage of historical data from the main system database, and manages the creation and sending of usage and billing reports. The Report Mailer gathers anonymous usage data and s usage reports to the Citrix license monitor. Customer and user information is not transferred, only the number of customers and users-per-service. Deployment begins with preparing your environment. Next, install and configure the server roles. Then install, configure, and provision the Services Manager web services, such as Exchange, SharePoint, Virtual Machine, BlackBerry, and IIS Citrix Systems, Inc. All rights reserved. p.2

3 Known Issues Concerning CloudPortal Services Manager 10.0 Updated: To enable reseller and customer administrators to create brands: 1. Open Configuration > Security > Page Manager. 2. Change Page Type to Pages. 3. Select /CortexDotNet/Administration/Brands/EditBrand.aspx. 4. On the right pane scroll down to Security Roles. 5. Select Customer Administrator, Reseller Full Administrator, and Reseller Partial Administrator accounts so they have permissions to create brands. [#158610] In an environment where the Exchange location is set to Exchange 2010 /Hosting, creating the first customer might be unsuccessful if hosting plans have not yet been created. Before creating the first customer in this environment, ensure a new service plan has been created. Also, ensure the hosting program, hosting offer, and hosting allocation have been configured. [#259658] When configuring Services Manager server roles, do not configure the databases and location together. Run the Configuration Tool separately for the databases and the location. [#259761] After importing a service package, to apply the changes, restart the Provisioning Engine. [#259782] When you first configure a location using the graphical interface, you cannot specify a display name for the Customer OU. Workaround: after the location is created, to specify the domain name, update from the control panel or install using the command line interface. [#259793] When you use the Configuration Tool to create the first administrator for a location, the username for that administrator is cspadmin_tsp. [#260111] For the Citrix Service, the Terminal services file server setting does not appear at the Active Directory level. Workaround: Expand the setting at the top level and change the Hierarchy Permission from Hidden to Modify. [#260733] When installing Services Manager, some functions for expiring demo customer accounts might not be installed successfully. To ensure these functions are present in the Services Manager environment, schedule tasks on the Provisioning server to run the following files: DemoExpiredCustomersRequest.bat. This file deprovisions and deletes demo customer accounts. DemoExpiryRequest.bat. This file sends a notification to the demo customer that the account will expire. Schedule both tasks to run daily during off-peak hours using the Cortex_DirMon_Svc account. [#260825] After installing the Windows Web Hosting service, you must manually create a user account in Active Directory in the CortexSystem OU, and add the user to the CortexWSUsers security group. [#263209] When using the Configuration Tool to enter service provider details for a location, specify only one UPN suffix. You can configure additional UPN suffixes later from the control panel. [#263735] After installing the SharePoint 2010 web service, you must manually change the IIS authentication settings for the site and application levels, enabling both Windows and integrated authentication. [#264802] Citrix Systems, Inc. All rights reserved. p.3

4 Importing a large service package resets the connection to the Services Manager. This occurs with package files that include DLL files which are copied to the Bin directory during the import process. To continue configuring the service, log in to the Services Manager. [#267325] For the Citrix web service to work correctly with supported XenApp versions earlier than XenApp 6, edit the [INSTALLDIR]ServicesCitrixweb.config file and add: <add key="citrixinstall" value="metaframe"/> [#270896] After using the graphical interface to install server roles, the Deploy CloudPortal Services Manager page displays. Click anywhere on that page to bring it into focus. [#272092] On some SQL Server installations, the server role Configuration Tool graphical interface will not launch. Workaround: launch CortexConfig.msi from [INSTALLDIR]Configuration. [#272653] Citrix Systems, Inc. All rights reserved. p.4

5 System Requirements Deploying the CloudPortal Systems Manager includes installing the core components (server roles), and then installing the web services. For system requirements information, see: System Requirements for Server Roles System Requirements for Web Services Citrix Systems, Inc. All rights reserved. p.5

6 System Requirements for Server Roles Updated: The sections in this topic describe supported platforms, required software, and other information that will be used when you install and configure the core components (server roles) that comprise the Services Manager platform. The Services Manager server role installer (Setup Tool) handles many of the prerequisites, such as installing.net Framework 4.0, enabling web server roles, and enabling MSMQ features. (The.NET software is also available in the Support folder of the Services Manager installation media.) See Installing and Configuring Roles and Locations for additional preparation information. Active Directory and Exchange This release of Services Manager supports Active Directory Domain Services on the following platforms: Windows Server 2008 R2 Windows Server 2008 Windows Server 2003 At a minimum, the domain functional level must be Windows Server Before the Services Manager platform can be deployed, the Active Directory schema must be extended to include the standard Exchange attributes. To do this, use one of the following methods: Use the Schema Prep tool from the Microsoft Exchange installation media. Use this method if you do not plan to deploy Exchange and you do not intend to deploy the Exchange web service. In general, to deploy the Schema Prep tool, you execute the following command on the directory where the Exchange installation media resides: setup /p /on:organizationname Deploy Exchange. Use this method if you plan on installing the Exchange web service in your Services Manager deployment. Extending the Active Directory schema is part of the Exchange deployment process. The domain user account used to extend the Active Directory schema or install the Services Manager platform components must belong to the following groups: Group Name Required f or Services Manager platf orm installation Required f or extending Active Directory schema Domain Admins Yes Yes Enterprise Schema No Yes Schema Admins No Yes If any server (including DNS) is not in the domain, the same user account should be set up as a local user on that server with the same password, as a member of the local Administrators group. DNS Server Services Manager uses DNS aliases to locate and reference the component servers during the platform install and configuration process, and during provisioning operations. To ensure successful deployment and operation of Services Citrix Systems, Inc. All rights reserved. p.6

7 Manager, create the following CNAME records for each of these components. Point the CNAME records to each server's fully qualified domain name. Platform component Database server Alias CORTEXSQL Provisioning server CORTEXPROVISIONING Web server CORTEXWEB Reporting Services CORTEXREPORTS Database Server Hardware configuration Two or more server-class processors, 2.0 GHz or higher Minimum 4 GB RAM recommended Minimum 10 GB free disk space available for file growth Operating system User Account Control (UAC) Database server Authentication Windows Server 2008 R2 Standard, Enterprise, or Datacenter editions, with all recommended updates installed. Disabled. Microsoft SQL Server 2008 R2, with all recommended updates installed. Mixed mode (SQL and Windows Authentication) SQL connection types Installation account Firewall Local and remote connections enabled. Configure the account to be used during installation with the SysAdmin role. If you cannot do this in SQL, you can use an account with SysAdmin rights. You can remove this account after the installation finishes. Allow inbound TCP connections through the database instance port. For a default SQL instance, this is port When you install SQL Server, make note of the instance name and port. You will need this information when you configure the server for use with Services Manager. During platform installation, the following databases are installed: OLM - core database for customer and user information Citrix Systems, Inc. All rights reserved. p.7

8 OLMReports - stores legacy reporting data and some system settings OLMReporting - stores reporting data ExchangeLogs - stores Exchange information The following SQL accounts are created for accessing the databases: CortexProp OLMUser OLMReportsUser OLMReportingUser ExchangeLogsUser Two SQL jobs are installed on the database server: Gather Daily Stats Data and Gather Monthly Stats Data. SQL Reporting Services Hardware configuration Two or more server-class processors, 2.0 GHz or higher Minimum 4 GB RAM recommended Minimum 10 GB free disk space available for file growth Operating system User Account Control (UAC) Database server Service account SQL connection types Windows Server 2008 R2 Standard, Enterprise, or Datacenter editions, with all recommended updates installed. Disabled. Microsoft SQL Server 2008 R2, with all recommended updates installed. Set the SQL Reporting Services service account to Network Service. Local and remote connections enabled. Firewall Allow inbound TCP connections through the reporting port. The default port is 80. Authentication Administrator account Verify that the Report Server configuration file (C:Program FilesMicrosoft SQL ServerMSRS10.MSSQLSERVERReporting ServicesReportServerrsreportserver.config) contains the entry "<AuthenticationTypes><RSWindowsNTLM /> <RSWindowsNegotiate /> </AuthenticationTypes>". In Reporting Services, create a dedicated user with the System Administrator role; domain administrator rights are not required. You will need this user information when configuring Reporting in the Services Manager configuration tool. Provisioning Server Citrix Systems, Inc. All rights reserved. p.8

9 Hardware configuration Two or more server-class processors, 2.0 GHz or higher Minimum 4 GB RAM recommended Minimum 10 GB free disk space available for file growth Operating system User Account Control (UAC).NET Version Windows Server 2008 R2 Standard, Enterprise, or Datacenter editions, with all recommended updates installed. Disabled..NET Framework 4.0 (Full) installed. Firewall Allow inbound TCP connections through port Windows Server features (installed by the Setup Tool, if not enabled) Enable the following features: Message Queuing > Message Queuing Services > Message Queuing Server Message Queuing > Message Queuing Services > HTTP Support (only if the server is not in the domain) Telnet client Windows PowerShell SQL Server Management Objects (installed by the Setup Tool, if not present) SMTP server Domain membership and privileges Install the 64-bit variant of the Microsoft SQL Server 2008 Shared Management Objects (SMO). This is available in the Support folder of the Services Manager installation media. Required for sending notifications through Services Manager. Depending on the notification, the Provisioning server also needs a temporary directory for assembling the . As an SMTP server is also required for the Report Mailer, the same SMTP server can be used for both the Provisioning server and the Report Mailer. For both roles, you supply the SMTP server details when you configure each server role. Server must be a member of the domain Service account must have full domain administrator privileges If you are installing the Provisioning server on a domain controller, give the ProvisioningUsers security group logon locally permission. However, for security reasons, Citrix recommends installing the Provisioning server on a server other than a domain controller. Web Server The Services Manager uses the DNS alias CortexWeb to refer to the server hosting the Web Server. Hardware configuration Two or more server-class processors, 2.0 GHz or higher Citrix Systems, Inc. All rights reserved. p.9

10 Minimum 4 GB RAM recommended Minimum 10 GB free disk space available for file growth Operating system User Account Control (UAC) Windows Server 2008 R2 Standard, Enterprise, or Datacenter editions, with all recommended updates installed. Disabled..NET version.net Framework 4.0 (Full) installed. Firewall Allow outbound connections to SQL Reporting Services on port 80. Report Viewer version Microsoft Report Viewer 2008 SP1 Windows Server roles Enable the following roles: Web Server > Application Development > ASP.NET Web Server > Security > Basic Authentication Web Server > Security > Windows Authentication Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools SQL Server Management Objects (installed by the Setup Tool, if not present) Domain membership and privileges Install the 32-bit variant of the Microsoft SQL Server 2008 Shared Management Objects (SMO). This is available in the Support folder of the Services Manager installation media. Server must be a member of the domain Service must have full domain administrator privileges During platform configuration, you will need to know the host header required for the web site. This is the URL used to access the control panel. The Configuration Tool refers to this as the external address. When you install the Web Server role, the following items are installed: CortexMgmt Application Pool - used to run the Management Site. Cortex Management Site - contains the following web applications: CortexDotNet - main management portal CortexAPI - XML-based web service used to automate management The Web Server role supports: Internet Explorer 8 and 9 Firefox 3.x and 4.x Chrome 12.x Safari 5.x The Web Server role supports client operating system access from: Windows XP SP Citrix Systems, Inc. All rights reserved. p.10

11 Windows 7 SP1 Windows Server 2008 Mac OS X 10.x The Autologin tool supports Windows XP SP3, Windows 7 SP1, and Windows Server Directory Web Service If you are installing the Directory Web Service on a domain controller, give the CortexWSUsers and the Proxy Users groups logon locally permission. However, for security reasons, Citrix recommends installing this role on a server other than a domain controller. Enable the following roles and features: Web Server > Application Development > ASP.NET Web Server > Security > Basic Authentication Web Server > Security > Windows Authentication Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools PowerShell 2.0 Data Warehouse (Reporting) Operating system User Account Control (UAC) Windows Server 2008 R2 Standard, Enterprise, or Datacenter editions, with all recommended updates installed. Disabled..NET version.net Framework 4.0 (Full) installed. Firewall Allow outbound connections to the database server on port Database server SQL Server 2008 R2 Database server authentication Mixed mode (SQL and Windows Authentication) Reporting SQL Server Reporting Services 2008 R2 SQL Server Management Objects (installed by the Setup Tool, if not present) Installation account Services Manager installs this component automatically when the Data Warehouse role is deployed. This is available in the Support folder of the Services Manager installation media. Ensure the account used for installing this role is a SysAdmin on the server. RSReportServer modifications In RsReportServer.config, under <RSWindowsNTLM/>, enable <RSWindowsNegotiate/> Citrix Systems, Inc. All rights reserved. p.11

12 SMTP server Because the Provisioning server also requires a SMTP server, you can specify the same SMTP server when you deploy each server role. The SMTP server must allow relays from the Reporting server. Additional requirements: If you will be using the OCS Monitoring service, install and enable the OCS Monitoring Service on the OCS 2007 server. If you will be using the SharePoint 3 service, most headers for all sites must be resolvable on the SharePoint 3 server where the SharePoint service is installed and used by the data collection. Firewall Configuration The following table lists the default connectivity configuration between the Services Manager roles. Configure these before installing the roles. Traf f ic/port From To Purpose TCP 8095 Web Server Provisioning Engine Authenticate users and read-time Active Directory lookups MSMQ*, HTTP, or HTTPS Web Server Provisioning Engine Provisioning request TCP 1433** Provisioning SQL Server Access to provisioning rules, write statistics Engine TCP 1433** Web Server SQL Server Access to customer and user information TCP 80 Web Server SQL Reporting Services server Access to SQL Reporting Services * MSMQ comprises several ports, as specified by Microsoft. ** The supported SQL versions use TCP 1433 only for the default instance; other named instances use a dynamically assigned port. If your installation is not the default instance and a firewall separates the SQL server from the other Services Manager roles, you must override the dynamic behavior by allocating a specific port Citrix Systems, Inc. All rights reserved. p.12

13 System Requirements for Web Services Updated: This topic lists supported platforms and requirements for the Services Manager web services. Group Policy requirements If you are installing a web service on a domain controller, give the CortexWSUsers group logon locally permission. Additionally, Proxy Users need logon locally permission if you install the Directory Web Service on the domain controller. BlackBerry The following table lists the supported BlackBerry and Microsoft Exchange versions. If your environment includes BlackBerry 4, complete the following requirements before installing the Services Manager BlackBerry service. If your environment comprises only BlackBerry 5, you do not need to install a Services Manager BlackBerry service after completing the following requirements. Version Exchange 2003 Exchange 2007 Exchange 2010 Exchange 2010 Hosting BlackBerry 4 X X X BlackBerry 5 SP1 X X BlackBerry 5 SP2 X X Configure your environment according to the BlackBerry installation guidelines. The following requirements assume you have installed the BlackBerry Enterprise Server software, the latest security updates, and the appropriate service pack for your deployment. Requirements for all BlackBerry deployments (all supported versions): The Services Manager requires the credentials that are used to run the BlackBerry service, in order to access the BlackBerry Server MAPI profile. This account must be a member of the Exchange View Only Administrators group. Additionally, the BlackBerry service account (or the Exchange View Only Administrators group) must have Open Address List permission on the Default Global Address List. Requirements for BlackBerry 4 (in addition to requirements for all deployments): Enable the following IIS 7+ roles: Web Server > Application Development > ASP.NET Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility Install Microsoft.NET Framework 4.0 Install the BlackBerry Enterprise Server Resource Kit. When you install the Services Manager BlackBerry web service, you will need the credentials created for the resource kit. Citrix XenApp for Windows Citrix Systems, Inc. All rights reserved. p.13

14 Supported XenApp versions: Citrix Presentation Server 4.5 for Windows Server 2003 Citrix XenApp 5.0 for Windows Server 2008 Citrix XenApp 6.0 for Windows Server 2008 R2 Citrix XenApp 6.5 for Windows Server 2008 R2 Requirements: Operating system: supported platforms for the XenApp version. Install all recommended operating system patches. Enable Remote Desktop Services. Install.NET Framework 4.0. Installation requires that the Cortex Domain Logon account and the DomainCortexWSUsers account have full administration rights on the XenApp farm. For Presentation Server 4.5 for Windows Server 2003: Apply SP2 to the Windows Server From Add or Remove Programs, select Add/Remove Windows Components. Then select Application Server and click Details. Ensure that ASP.NET is enabled and that Internet Information Service (IIS) is enabled and default settings are accepted. For XenApp 5 for Windows Server 2008, XenApp 6, and XenApp 6.5: Disable UAC. Enable the following roles: Web Server > Application Development > ASP.NET Web Server > Security > Windows Authentication Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools Management Tools > IIS 6 Management Capability > IIS 6 Metabase Compatibility The Citrix web service uses port 8095 by default. CRM 2011 Ensure that the CRM 2011 installation is configured with claims-based authentication and an Internet-facing deployment. For help configuring an Internet Facing Domain (IFD) CRM 2011 environment, see v=t9jzixdtsbw. For authentication to succeed, give the ADFS service user account (which is usually the Network Service) read access to the customer's OU. Exchange The following table lists the supported platforms and Microsoft Exchange versions. Version Windows Server 2003 R2 Windows Server 2008 Windows Server 2008 R2 SP1 Exchange 2003 X Exchange 2007 SP2 X Exchange 2010 SP1 - Enterprise X Citrix Systems, Inc. All rights reserved. p.14

15 Exchange Version 2010 SP1 - /Hosting Windows Server 2003 Windows Server XWindows Server 2008 R2 R SP1 Exchange 2010 SP2 X Note: Although Exchange 2010 SP1 is included as a supported version in this release of Services Manager, Citrix recommends service providers use Exchange 2010 SP2 instead for new Services Manager deployments. Exchange 2010 SP2 includes improvements that enable service providers to offer a richer feature set to their customers. For more information and guidance about SP2, refer to the article, "Multi-Tenant Support" on the Microsoft TechNet Web site. For environments that already include Exchange 2010 SP1 in a hosting mode (i.e., using the /hosting switch), ensure it is installed in a separate domain forest from any other Exchange implementation. Exchange 2010 SP1 installed in a hosting mode sets different permissions on the organization's OUs. Follow the guidance in the Microsoft documentation for preparing and installing Exchange. The information in this section assumes you have installed the Exchange software. Requirements: Install all recommended operating system patches. Enable Remote Desktop Services. Disable UAC. Enable the following IIS 6 and 7+ roles: Web Server > Application Development > ASP.NET Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools Management Tools > IIS 6 Management Compatibility > IIS 6 Metabase Compatibility Install.NET Framework 4.0. If you are using Exchange 2010, install Microsoft Exchange 2010 SP1 Management Tools. Services Manager service installation requires that the Cortex Domain Logon account have full administration rights to Microsoft Exchange. Exchange User Level Packages are used as templates for Exchange mailboxes. Packages define which protocols are enabled, plus mailbox limits and data storage. The installation process creates one package, which is used to test the installation. This package specifies the mail databases to use (Server / Storage Group). One or more storage groups are created when Exchange is installed; select one to use for the installation test. By default, the Exchange web service uses port 8095 to communicate with the Provisioning and Web servers. Configuring Permissions for Exchange 2007 and Exchange 2010 Use the following steps to configure permissions in an environment that includes only an Exchange 2007 SP2 or Exchange 2010 SP1 deployment. These steps are not required for Exchange 2010 SP2 or mixed Exchange deployments. 1. Launch ADSledit.msc on a server in the domain. 2. Right-click ADSI Edit, select Connect to, and then select the Configuration naming context. 3. Expand CN=Configuration,DC=CustomerDomainPrefix,DC=CustomerDomainSuffix. 4. Enable the List Object permission in the directory. 1. Expand CN=Services > CN=Windows NT. 2. Right-click CN=Directory Service and select Properties. 3. Set the dsheuristics attribute to Disable the Default -Address policy. (By default, this policy applies to all users and gives all users the primary Citrix Systems, Inc. All rights reserved. p.15

16 address 1. Expand CN=Services > CN=Microsoft Exchange > CN=ExchangeOrganization > CN=Recipient Policies. 2. From the middle pane, right-click CN=Default Policy and select Properties. 3. Edit the following properties: msexchlastappliedrecipientfilter: Alias -eq 'NoSuch ' msexchpurportedsearchui: Microsoft.PropertyWell_QueryString=(mailNickname=NoSuch ) (replace current entry) msexchqueryfilter: Alias -eq 'NoSuch ' purportedsearch : (&(objectclass=publicfolder)(!(extensionattribute15=*))) 6. Lock down default global address lists. 1. Expand CN=Services > CN=Microsoft Exchange > CN=ExchangeOrganization > CN=Address Lists Container > CN=All Global Address Lists. 2. Right-click CN=Default Global Address List and select Properties. 3. On the Security tab, click Advanced. 4. Clear the Include inheritable permissions from this object's parent check box, and then click Add. 5. Click Apply and then click Yes for each warning that appears. 6. Sort the permissions by name and remove the entries for Authenticated Users except the Deny entry that applies to msexchavailabilityaddressspace objects. Click OK to close the dialog box. 7. On the Security tab, select the Everyone group and click Remove. Click OK to close the dialog box. 7. Lock down address lists. 1. Expand CN=Services > CN=Microsoft Exchange > CN=ExchangeOrganization > CN=Address Lists Container > All Address Lists. 2. Right-click CN=All Users and select Properties. 3. On the Security tab, click Advanced. Clear the Include inheritable permissions from this object's parent check box and then click Add. 4. Click OK and then click Yes for each warning that appears. 5. Remove the Everyone and Authenticated Users groups. 6. Add the Proxy USERS group and deny the Read permission. (If the Services Manager roles have not yet been installed, or if this group does not exist, create a domain local group in Active Directory called Proxy USERS.) 7. Repeat Steps b-f for the All Contacts, All Groups, All Rooms, and Public Folders containers. 8. Lock down the All Address Lists container. 1. Expand CN=Services > CN=Microsoft Exchange > CN=ExchangeOrganization > CN=Address Lists Container. 2. Right-click CN=All Address Lists and select Properties. 3. On the Security tab, click Advanced and then add the Proxy USERS group with the following settings: Apply to: This object only List Contents: Deny List Object: Allow 9. Delete the default offline address list. 1. Expand CN=Services > CN=Microsoft Exchange > CN=ExchangeOrganization > CN=Address Lists Container > CN=Offline Address Lists. 2. In Offline Address Lists, delete CN=Default Offline Address List. 10. Set permissions at the Exchange organization level. 1. Expand CN=Services > CN=Microsoft Exchange. 2. Right-click CN=ExchangeOrganization and select Properties. 3. On the Security tab, add the group Proxy USERS and allow the Read permission. 4. Click Advanced and select the Proxy USERS group. Click Edit and configure the following settings: Citrix Systems, Inc. All rights reserved. p.16

17 Apply to: This object only List contents: Allow List object: Allow Read all properties: Allow Read permissions: Allow Configuring Services Manager for a Mixed Exchange 2010 Environment When using Exchange 2010 Enterprise with Exchange 2007 or 2003, to ensure correct operations, copy the globaladdresslist attribute into the globaladdresslist2 attribute. The globaladdresslist2 attribute was introduced in Windows Server 2008 R2. In an environment that includes Exchange 2010, an address list must be populated into the attribute to ensure correct operation. Exchange 2010 manages the globaladdresslist2 attribute automatically, but Exchange 2007 and 2003 do not. To populate globaladdresslist2 with all entries from globaladdresslist, run the following PowerShell script. $configroot = ([adsi]"ldap://rootdse").configurationnamingcontext $MSEXOU = [adsi]("ldap://cn=microsoft Exchange,CN=Services,$configroot") [array]$gal = $null foreach ($dn in get-globaladdresslist) { $gal += ($dn.distinguishedname)} $gal = '@("' + ([string]::join('","', $gal)) + '")' $MSEXOU.putEx(2, 'globaladdresslist2', (invoke-expression "$gal")) $MSEXOU.setinfo() After running this script, any systems that interact with globaladdresslist must now use globaladdresslist2; otherwise, Exchange will not detect them. Lync Enterprise and Lync 2010 f or Hosting The following assumes you have deployed the Lync Enterprise 2010 topology. Requirements Install.NET Framework 4.0. Install Lync Server Management Shell. Add or enable the following roles and features: IIS 6.0 (minimum) Remote Server Administration Tools > Role Administration Tools > AD DS and AD LDS Tools PowerShell 2.0 MySQL Requirements: Install MySQL version 5.0 or 5.1. Run MySQL on the default port On the MySQL server: Allow local and remote connections Open the firewall to allow connections to the MySQL server on port Open port The Services Manager requires login access to administer databases and users. If you are using multiple SQL servers, use Citrix Systems, Inc. All rights reserved. p.17

18 the same account for all of them (suggested name: CortexMySQLHosting). This account must have DBA (grant all) global privileges. SharePoint The following table lists the SharePoint and IIS version support. Version IIS 6 IIS 7 IIS 7.5 SharePoint 3 X X SharePoint Enterprise 2010 X X SharePoint Foundation 2010 X X Follow the guidance in the Microsoft documentation for hosting SharePoint. The following assumes you have installed the SharePoint software. Requirements for SharePoint 2010 Services deployments: Operating system: Windows Server 2008 (minimum), with all recommended operating system patches. Enable Remote Desktop. Disable UAC. Add the service account used for the Services Manager SharePoint 2010 web service deployment and configurations to the farm. Use cmdlet Get-SPShellAdmin to look up the account name. Set the SharePoint 2010 web service to the same application pool identity as the SharePoint Central Administration site. Identify the application (front-end) server in the farm where the SharePoint 2010 web service is to be deployed. Install and configure Services Manager IIS Web Service (used for Windows Web Hosting Services) on the same SharePoint 2010 server used for managing the site host headers. Install the Services Manager DNS Service to use the full functionality of SharePoint 2010 site DNS management. Open ports and 5985 from the server hosting the SharePoint 2010 and IIS web services to the Services Manager Web Server and provisioning server. Enable the following roles: Web Server > Application Development > ASP.NET Web Server > Security > Windows Authentication Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools Make the SharePoint 2010 service account a member of the local administrators group on the server hosting the SharePoint 2010 web service and the CortexAdmins group in Active Directory. Configure the following local policies: Enable the Allow CredSSP Authentication option under Computer ConfigurationAdministrative templatewindows ComponentsWindows Remote Management (WinRM)WinRM Service. Enable the Allow CredSSP Authentication option under Computer ConfigurationAdministrative templatewindows ComponentsWindows Remote Management (WinRM)WinRM Client. Enable the Allow Fresh Credentials with NTLM-only Server Authentication option under Computer ConfigurationAdministrative TemplatesSystemCredentials Delegation. Verify that it is enabled and configured with an SPN appropriate for the target computer (select Show next to Add servers to the list). For example, for a target computer name "myserver.domain.com" the SPN can be one of the following: WSMAN/myserver.domain.com or Citrix Systems, Inc. All rights reserved. p.18

19 WSMAN/*.domain.com. Enable the Allow Delegating Fresh Credentials option under Computer ConfigurationAdministrative TemplatesSystemCredentials DelegationAllow Delegating Fresh Credentials. Verify that it is enabled and configured with an SPN appropriate for the target computer (click Show next to Add servers to the list). For example, for a target computer name "myserver.domain.com", the SPN can be one of the following: WSMAN/myserver.domain.com or WSMAN/*.domain.com. Disable loopback check: 1. From the Registry Editor, select the following registry key: HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlLsa 2. Right-click Lsa, point to New, and select DWORD Value. 3. Type DisableLoopbackCheck. 4. Right-click DisableLoppbackCheck, then select Modify. 5. In the Value field, type Restart the server. Allow WinRM to listen for requests: 1. Run the following command at the command prompt on the SharePoint 2010 server: winrm e winrm/config/listener 2. If the command prompt does not show anything, running the following command: winrm quickconfig 3. At the prompt Make these changes?, type y. For more information, refer to Increase the memory allocated for PowerShell by running the command: Set-item WSMan:localhostShellMaxMemoryPerShellMB Requirements for SharePoint 3 Services deployments: Operating system: Windows Server 2003 Service Pack 2 (minimum) Enable Remote Desktop. Set the SharePoint 3 web service to the same application pool identity as the SharePoint Central Administration site. This should be the service account used by Services Manager for SharePoint 3 web service provisioning. Identify the application (front-end) server in the farm where the SharePoint 3 web service is to be deployed. Make sure the SharePoint 3 web service farm is installed using Domain Account Mode instead of Active Directory Account Creation Mode. Install and configure Services Manager IIS Web Service (used for Windows Web Hosting Services) on the same SharePoint 3 server used for managing the site host headers. Open ports from the server hosting the SharePoint 3 web service and IIS web services to the Services Manager Web Server and provisioning server. If the application server is on Windows 2008, enable the following roles: Web Server > Application Development > ASP.NET Web Server > Security > Windows Authentication Management Tools > IIS Management Console Management Tools > IIS Management Scripts and Tools Make the SharePoint 3 web service account a member of the local administrators group on the server hosting the SharePoint 3 web service and the CortexAdmins group in Active Directory. Virtual Machine Supported: System Center Virtual Machine Manager 2008 R2 SP1 Hyper-V Server 2008 R Citrix Systems, Inc. All rights reserved. p.19

20 Requirements: Enable the following roles: Web Server > Application Development > ASP.NET Web Server > Security > Windows Authentication Install Microsoft.NET 4.0. System Center Virtual Machine Manager 2008 R2 Administrator Console For each Hyper-V host, use SCVMM to set up network access: Configure network adaptors. Configure VLAN ranges for VLAN trunking. Hyper-V hosts can be stand-alone or clustered. Services Manager supports Cluster Shared Volumes for provisioning highly available VMs. For each Hyper-V host Services Manager is to manage, refer to Steps Required to Add a New Hyper-V Host. Open inbound TCP port 8095 in the Windows firewall. Open the following firewall ports, by role: Role Port Description SCVMM servers 8100 VMM - Administrator Console to VMM server As installed RDP - self-service portal website port If using a remote VMM database 1433 TDS - SQL Server Virtual server 5900 VMRC - VMRC connection to virtual server host Hyper-V hosts 80 WinRM - VMM server to VMM agent on Windows Server-based host (control) 443 BITS - Library server > hosts 445 SMB - VMM server to VMM agent on Windows Server-based host (data) 2179 RDP - VMConnect to Hyper-V hosts 5900 VMRC - connection to virtual server host Virtual machines 3389 RDP - Remote desktop to VMs An Active Directory security group is added to Hyper-V servers to enable remote connections. Your environment must allow security groups to be added to the host from the domain containing the Services Manager components. Remove the following folders or executables from real-time scanning by security software: The default virtual machine configuration folder (for example, C:ProgramDataMicrosoftWindowsHyper-V) and any Citrix Systems, Inc. All rights reserved. p.20

21 custom virtual machine configuration folders The default virtual machine hard disk drive folder (for example, C:UsersPublicDocumentsHyper-VVirtual Hard Disks) and any custom virtual machine hard disk drive folders Snapshot folders VMMS.EXE - Virtual Machine Management Service VMWP.EXE - Virtual Machine Worker Process If you use Hyper-V Live Migration with Cluster Shared Volumes, remove the Cluster Storage folder (for example, C:Clusterstorage) and all subfolders. Windows Web Hosting The following table lists the supported Internet Information Services (IIS) versions and platforms. Version Windows Server Windows Server Windows Server 2008 Windows Server 2008 R2 SP R R2 SP1 Web Edition IIS 6 X IIS 7 X IIS 7.5 X X Requirements Hardware: Processors: server class, one or more 2.0 GHz (minimum) Memory: 2 GB (minimum) recommended Disk space: 10 GB (minimum) free space Install all recommended operating system patches. Enable the following roles: File Service > File Server IIS > Application Development > ASP.NET IIS > Application Development >.NET Extensibility IIS > Application Development > CGI (required only if PHP support is required) IIS > Application Development > ISAPI Extensions IIS > Application Development > ISAPI Filters IIS > Security > Basic Authentication IIS > Security > Windows Authentication IIS > Management Tools > IIS Management Console IIS > Management Tools > IIS Management Scripts and Tools IIS > Management Tools > Management Service Ensure that the IIS FTP Server Role is not enabled. For IIS 7.0 and higher: Set up the web server with any server certificates needed for secure site browsing and with a network file share to store site files and documents (typically, C:WebHosting). Install.NET Framework 4.0. Configure the Web Management Service (WMSvc) to run automatically at startup. By default, it is set to Manual. Enable Remote Desktop Services Citrix Systems, Inc. All rights reserved. p.21

22 The Network Service account must be able to read the configuration files in the directory C:WindowsSystem32inetsrvconfig. When provisioning the customer site, the Services Manager sets permissions for the customer's Active Directory groups on the site/folder. Additionally, the AppPool identity for the site is also a domain account under that customer's OU. Therefore, the web hosting server must either be a member of the domain or have a trust relationship with that domain, so that groups and accounts are accessible and have rights on the server. Other Services Service Domain Name System (DNS) Requirement/Supported Version BIND version 9.x DNS Server File Sharing Manager Supported on Windows Server 2003, Windows Server 2008, Windows Server 2008 R2 Hosted Apps and Desktops Citrix App Studio 1.0 Office Communication Server Microsoft Office Communications Server 2007 R2 For information about the Directory Web Service, see System Requirements for Server Roles Citrix Systems, Inc. All rights reserved. p.22

23 Install Deploying the CloudPortal Services Manager comprises installing and configuring the core components (server roles) and then installing the Web services. For details, see: Installing and Configuring Roles and Locations Installing Web Services Citrix Systems, Inc. All rights reserved. p.23

24 Install Roles and Locations Updated: Deploying the CloudPortal Services Manager (Services Manager) first comprises installing and configuring core components (server roles) and locations. The Setup Tool manages prerequisites and installs server roles. The Configuration Tool configures server roles and locations. Both tools offer a graphical wizard-driven interface and a command-line interface. For the graphical interface, see Installing Server Roles from the Graphical Interface and Configuring Server Roles and Locations from the Graphical Interface. For the command-line interface, see To install server roles from the command line and Configure server roles and locations from the command line. After you install the server roles, and configure the roles and locations, you install and configure the web services. See Installing Web Services for details. Role installation and configuration summary An initial server role deployment includes the following tasks: 1. Perf orm environment readiness checks You can verify the extended Active Directory schema and DNS aliases. This procedure is available in the graphical interface; you can also perform the verifications manually. You can run this task from anywhere in the domain. 2. Create system databases - Microsoft SQL Server databases serve as repositories for user and service configurations in a Services Manager deployment. All databases should be backed up and synchronized daily. In the graphical interface, you specify database information before you install the server roles. In the command line interface, you specify database information when you configure the server roles and location. You run this task from the server where Microsoft SQL Server is installed. 3. Install server roles - Web Server, Provisioning Engine, Directory Web Service, Data Warehouse, and Report Mailer. 4. Conf igure server roles and locations Specifies configuration settings for the installed roles, and settings for primary and remote locations. An XML configuration file is used to maintain context across the Services Manager deployment. As you configure the server roles, information is read and written to the configuration file. For example, the Provisioning Engine writes its own configuration information and reads where to reach the database. When you configure the primary location, the configuration file will already have information needed about the provisioning server. A location is the main unit of isolation between tenants, and usually corresponds to an Active Directory domain or forest. Customers are provisioned into a location. Configuring a server role makes that role operational, while configuring the location ties the components together and makes the system operational. There is one configuration file per location, although all locations can share a single database server. You configure the primary location first, then optionally, remote locations. For example, a new customer with an existing infrastructure and domain might be integrated as a remote location in the control panel. When you configure remote locations, you specify connection details, which are used to generate a new configuration file. After that, configuring a remote location is similar to configuring the primary location. You configure locations from the server hosting the Provisioning Engine or the Web Server. Preparing to install and configure server roles Citrix Systems, Inc. All rights reserved. p.24

25 See System Requirements for Server Roles for supported platforms, required software, and preparation tasks. Plan where you will install the server roles. Typically, the Directory Web Service is installed on the same server as the Provisioning Engine. Install Microsoft SQL Server (minimum SQL Server 2008 R2) and SQL Server Reporting Services on the server that you will configure as the main system (OLM) database. Typically, this is a separate server from the server on which you install other Services Manager roles. In larger deployments, you can install SQL Server Reporting Services on a separate server from the SQL Server database. You can use a separate SQL server to host the reporting database (OLMReporting) and billing, or you can use the main system database for those functions. Using a separate reporting database avoids taxing the primary database, and is recommended for larger deployments. For best practice, install the Web role on a separate server. This server will likely have enhanced security. Whether you use the graphical interface or the command line to configure installed roles, review the information in the topic Configuring Server Roles and Locations from the Graphical Interface before you start the configuration. It describes the information you will need to provide. Note: During configuration, you must specify license reporting information by configuring the Report Mailer. General conventions: You can specify server addresses as an IP address, in the form server.domain.local, by environment variables, or by DNS alias. In the graphical interface, you can check the aliases by selecting the Perform Readiness Checks task. If you use the command-line interface, verify the aliases before using them when installing Services Manager roles. Role configuration includes specifying credentials for several Active Directory user accounts. In most cases, you can either specify the user name and password, or select the option that instructs the Configuration Tool to generate the credentials. This option is generally disabled by default. Some user account specifications also provide an option that instructs the Configuration Tool to create the user account if the account does not already exist. This option is generally enabled by default. In the command line interface, enclose option values that contain spaces in quotation marks (for example, /LocationName:"Southeast Hub") Citrix Systems, Inc. All rights reserved. p.25

26 Installing Server Roles from the Graphical Interface Installing Services Manager server roles using the graphical interface comprises three procedures: Perform readiness checks Create system databases Deploy (install) server roles To perf orm readiness checks Typically, environment readiness checks are done infrequently. 1. From the Autorun folder on the installation media, double-click Autorun.exe. 2. On the Select Deployment Task page, select Perform Readiness Checks. 3. On the Prepare Environment page: Select Extend Active Directory Schema. This verification queries Active Directory to determine if the schema has the expected custom extension attributes. If you plan to install the Exchange Web Service later, you can perform this verification at that time. If the verification cannot be completed, a message is provided (such as, the computer is not in a domain, the current user is not a domain user or does not have permission to query the schema). Select Create DNS Aliases. The control panel uses DNS aliases to locate the servers where its components will be deployed. This verification ensures the aliases have been configured. CORTEXSQL - the database server hosting the system databases CORTEXPROVISIONING - the computer where the Provisioning server role will be installed CORTEXWEB - the computer where the Web server role will be installed To create system databases This procedure assumes you have already installed the Microsoft SQL Server database software (minimum SQL Server 2008 R2) and SQL Server Reporting Services. 1. Double-click Setup.exe. 2. On the Select Deployment Task page, select Deploy CloudPortal Services Manager. 3. On the Deploy CloudPortal Services Manager page, select Create System Databases. 4. On the Create Deployment Configuration File page, browse to the directory where you want to store the XML deployment configuration file, then enter a file name. 5. On the Create Primary Databases page, configure the following information about the SQL Server that will store system configuration information: Specify the server address. Specify the port number. Default = 1433 Select the authentication mode: Windows or SQL. Default = Windows Specify login credentials. (Optional if using Windows authentication and integrated security) Select the Auto-create SQL logins checkbox if you want the SQL Server user accounts on the next page to be created. You can test the connection to the database. 6. Enter passwords for the SQL Server logins required to ensure cross-domain access to the databases: OLM, OLMReports, CortexProp, and ExchangeLogs. This is optional if you selected the Auto-create SQL logins checkbox on the previous page Citrix Systems, Inc. All rights reserved. p.26