AppController :28:18 UTC Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement

Transcription

1 AppController :28:18 UTC 2013 Citrix Systems, Inc. All rights reserved. Terms of Use Trademarks Privacy Statement

2 Contents AppController About This Release Introduction Key Features Compatibility with Citrix Receiver Known Issues System Requirements Plan AppController Pre-Installation Checklist Deploy Deploying AppController in Your Network Deploying AppController in a High Availability Configuration Install and Setup Downloading the Virtual Image for AppController Installing AppController on XenServer Installing AppController by Using VMware ESXi Setting the AppController IP Address Configuring AppController by Using the Setup Wizard Configuring the Master User List Configuring AppController High Availability How AppController High Availability Works Configuring High Availability To configure high availability in AppController Setting the SSL Handshake Between Two AppController VMs Licensing Obtaining Your License Files Upgrade To upgrade AppController To install service packs

3 To shutdown or restart the AppController server Manage Application Connector Library List of SSO Connectors from A to L List of SSO Connectors from M to Z Table of Application Connector Types To install a connector Adding Applications Configuring SSO By Using AppConnectors Activating SSO Applications Providing Connector Information Configuring Provisioning Connectors To configure a provisioning connector List of Provisioning Connector Parameters from A to L 81 List of Provisioning Connector Parameters from M to Z 91 Parameters for Provisioning Connectors Adding Generic SAML Connectors Configuring Advanced Settings for a SAML Connector 108 Adding HTTP Federation (Formfill) Connectors Editing Application Details To configure SharePoint 2007 in AppController Managing Application Categories To remove users from an application Application Workflow Configuring a Workflow Template Mapping Titles to Employees Configuring Organization and Company Hierarchy Titles 121 Creating the Workflow Template Configuring Workflow Association for a Template Configuring Workflow Association for Network and Application Users To associate a workflow with applications Adding Authorizers to a Workflow Template Viewing Users in AppController Viewing Reconciled User Accounts for Network Servers Viewing Reconciled User Accounts for Applications Managing Users in the Manage Users Portal To create a user account in the Manage Users portal

4 Requesting a New User Account Searching for an Employee in the Manage Users Portal To search for users in authoritative lists To add a user to an authoritative list Modifying User Information Modifying User Account Details for an Application To enable user accounts To delete user accounts in the Manage Users portal To disable user accounts Scheduling Accounts to Be Enabled or Disabled To enable multiple users in an application simultaneously To reconcile one or more user accounts in an application Mapping Profiles Managing Users and Groups To create a group To add multiple users to one or more groups To add or remove a user from a group Removing Users from a Group To view or delete a group Working with Roles in AppController Creating or Deleting a Role To map an application to a role Working with Tasks To search for a task To view a scheduled task Viewing Delegated Tasks Performing and Completing Tasks To open a task To request authorization to perform a task Rejecting, Closing, and Deleting Tasks Configuring the Vendor Portal To register in the vendor portal To access the vendor portal To open an application in the vendor portal Working with Passwords in the Vendor Portal To update vendor profiles Updating Application Information

5 Managing Vendor Accounts by Using the Inbox Maintain Configuring Certificates Backing Up Certificates in AppController To delete an existing certificate To install a certificate and associate it with an application To install a certificate to access the AppController configuration utility 181 To create a Certificate Signing Request in AppController Creating a Certificate by Using Windows Server Viewing Certificates in AppController Configuring Authentication in AppController Configuring Active Directory as an Authentication Server Configuring Kerberos on Active Directory To create a user account for Kerberos To test Kerberos authentication Generating or Editing a Keytab File Configuring the RADIUS Server To edit the RADIUS client To delete a RADIUS client Configuring Authentication Options for Users Storing User Passwords to an External Database To store user passwords to an external database To add an authentication server to AppController To change settings for an authentication server Configuring Administrator Access in AppController To add an administrator to AppController To edit administrator settings To delete an administrator Associating an AppController Adminstrator to a User Managing Users by Using Fine-Grained Privileges Configuring a DNS Server Entry Configuring the IDM Broker Backing Up the AppController Database Changing the AppController Database Backup Schedule Connect Users Making Applications Available in MyWebApps Sending AppController Application Lists to Citrix Receiver

6 To create an authentication server for Citrix Receiver Storefront To create an AppController Store in Receiver Storefront Configuring Application Requests for Citrix Receiver Configuring Receiver Storefront for User Account Requests To add the workflow adapter to web.config To add a user to a Receiver Storefront group Configuring Application Resource Properties To download and modify the login.conf file To download and modify the web.xml file Customize Configuring Authoritative Lists To select a connector for an authoritative list To create an authoritative list from Active Directory or LDAP Setting Up an Application for User Provisioning Creating Active Directory Groups To create an authoritative list from a Microsoft Excel.csv file To create an authoritative list from an Excel.csv file on an NIS or NFS file share... To create an authoritative list from an Excel.csv file on a Windows or Samba file share... To create an authoritative list from Oracle To create an authoritative list from Oracle EBS-HR To create an authoritative list from SAP-HR Configuring Employee Attributes To encrypt user information Adding Additional Fields Changing the Status of Employees To synchronize group attributes Setting the Synchronization Time for Applications To add users to an authoritative list To synchronize users in an authoritative list Provisioning User Accounts in Different Applications for a User To edit an authoritative list To delete an authoritative list Viewing the Employee List Consolidating and Reconciling Network and Application Users Configuring Advanced Rules for Identity Reconciliation Creating User IDs from User Names

7 Creating Password Rules To save password rules by using a template To set the time passwords are valid Disabling User Accounts Configuring Notifications Selecting User Account Scripts for Identity Management To add user account scripts to an authoritative list To add user account scripts to applications Reconciling Network and Application Users To reconcile network or application users Monitor Viewing and Creating Reports Viewing Reports in the Dashboard Viewing Application Access and License Utilization on the Dashboard 274 Viewing Reports in the Manage Users Portal Viewing Changes in User Roles Viewing Provisioned User Log Reports Viewing Application Reports Viewing Identity Reports Viewing Network IDs and Applications Viewing Compliance Reports Scheduling Compliance Reports Viewing License Reports Viewing Group Member Reports Viewing Modifications to Groups Viewing Workflow Reports Viewing Workflow Instances Viewing Log Reports Setting the Log Level Creating a RADIUS Server Log Report Creating AppController Reports Creating Custom Reports Saving and Printing Reports Managing and Troubleshooting AppController To upload a file to AppController To download files from AppController To upload a challenge question file

8 To upload a profile file To create a support bundle in AppController

9 AppController 1.0 AppController delivers an enterprise solution that lets you extend an enterprise identity to any Web application (internal or external), and offers seamless SSO to Web applications, as well as to Internet-based SaaS applications. AppController also provides a central platform from which you can manage user accounts. The AppController virtual machine (VM) is a virtual appliance that runs on Citrix XenServer and is managed with Citrix XenCenter. You can also install AppController on VMware ESXi and manage it with vsphere. In This Section This section of edocs introduces AppController 1.0 and discusses how to configure AppController. About This Release System Requirements Plan Deploy Install and Setup Licensing Upgrade Manage Contains information about this release, including AppController features, components, what's new, and known issues. Provides system requirements for AppController. Provides information for evaluating and planning your installation of AppController. Provides the AppController Pre-Installation Checklist. Provides deployment information for AppController. Provides information about how to install AppController on XenServer and VMware ESXi. Includes information about configuring the AppController IP address and running the Setup Wizard to configure settings. Describes how licensing works in AppController. Provides instructions on upgrading AppController. Provides information for configuring connectors, applications, users, and settings in AppController. 9

10 AppController 1.0 Maintain Connect Users Customize Monitor Discusses how to configure certificates, authentication, a DNS server entry, and how to back up the AppController database. Provides information about connecting users to applications in AppController. Discusses how to consolidate and reconcile network and application users. Provides reports for monitoring AppController and how to use the Debug Window. 10

11 About This Release Citrix AppController provides new features and functionality for configuring applications for single sign-on (SSO). Within the console, you can configure the following: AppController applications AppController roles SAML-based federation HTTP forms-based federation Applications for federated sign-on Applications for account provisioning This section introduces AppController, compatibility between AppController and Citrix Receiver, and known issues for CloudGateway Enterprise. 11

12 Introduction In your network, you might have multiple applications that your users need to access. The applications can run on various platforms. You can host the applications within your network, on an Infrastructure as a Service (IaaS) platform, or you can configure a Software as a Service (SaaS) application. Managing user accounts, along with passwords for applications to which users have access, requires a single unified framework. The framework needs to offer a consistent view to enable you to securely manage the life cycle of user accounts for these applications. In addition to easier management of user accounts, applications need to be available to users on demand and the solution should offer single sign-on (SSO) capabilities for applications and users. When users log on to Citrix Receiver, they receive the Citrix Store, where they can select the applications they need to use. After users add applications, they can then start the application from within Citrix Receiver. The following diagram shows a typical deployment of CloudGateway Enterprise: Figure 1. CloudGateway Enterprise Deployment You can deploy AppController in the following scenarios: For SSO Only. You can deploy AppController for SSO only, if users have accounts for multiple applications that include SaaS and Web applications. When you deploy AppController, when users try to access an application, AppController prompts the user with a credentials logon page. After AppController authenticates users, they are granted access to the application. When users subsequently try to access the application, AppController identifies the user and grants access to the application without prompting for application credentials 12

13 Introduction For identity provisioning and SSO. When you deploy AppController for identity provisioning and SSO, a user who does not have an account in the application can request an account. Users can create the account through an optimal workflow, which runs in the background. Upon approval, user accounts can be automatically created in the application. When users try to access the application on which the account was provisioned, AppController identifies the user accessing the application and then initiates SSO, which allows users to log on one time. For SSO and identity management. You can deploy AppController for SSO and identity management when users may need access to multiple SaaS and Web applications. When you deploy AppController using this scenario, the first time users open an application, they enter their credentials in the logon page. When users are authenticated, the application opens. When users subsequently open the application, AppController log users on automatically. 13

14 Key Features AppController is easy to deploy and simple to administer. The most typical deployment configuration is to locate AppController in the secure network. You can install two AppController virtual machines (VMs) for a high availability deployment. When you install AppController, you can use the Console tab in XenCenter or the vsphere Console to configure the basic settings that are specific to your internal network, such as the IP address, subnet mask, and default gateway IP address. After you complete configuration of the basic network settings, you then configure the settings specific to AppController, such as Active Directory, applications, roles, and connectors. The key features of AppController are: Web application federated single sign-on (SSO) Centralized management of user accounts Ability to monitor license utilization Delegated user and application management When you use AppController with Receiver Storefront, you receive the following benefits: Applications that users can access from any device, anywhere Seamless applicaton access from any platform Single window access to all applications with self-service account requests created by workflows in AppController 14

15 Compatibility with Citrix Receiver AppController supports Receiver for Windows 3.1. Users can connect from the internal network or from an external network by using an Access Gateway connection. When users connect by using Receiver for Windows 3.1 and access an application for which the user does not have an account, AppController can create a workflow request to create a new user account for the application. For more information, see Configuring Workflows for User Account Management. 15

16 Known Issues Important Notes 1. For users running Citrix Receiver on an ipad, iphone, or Android device, AppController application lists do not appear on the mobile device. 2. User account requests by using the workflow template with the AppController workflow feature is not supported for users who connect with the Web Receiver. 3. User account requests by using the subscription workflow template with the AppController workflow feature is not supported on Receiver for Mac The internal URL redirection feature in which Receiver checks a keyword to determine if the URL requires a connection with the Access Gateway Plug-in is not available with Web Receiver. The feature is supported only with Receiver for Windows Users can change their passwords in AppController by using MyWebApps or the vendor portal only. Users cannot change their password by using Web Receiver or Receiver for Windows. 6. Upgrades are not supported from AppController Technical Preview build 209 to build 215. Finding Documentation All product documentation is located in the Citrix edocs library. New Features in This Release Chrome support for Kerberos AppController supports Google Chrome browser for the Kerberos function in AppController. Dashboard The AppController Dashboard displays a summary of application access and license utilization in AppController. Delivery Services and Citrix Receiver AppController is compatible with Receiver Storefront and Citrix Receiver. Enhanced pre/post processing framework With this release, you can choose multiple pre/post processors while managing provisioning applications. 16

17 Known Issues External Password Store You can configure AppController to use an external database to store single sign-on user (SSO) credentials. You can use MySQL or Microsoft SQL Server. File Editor You can use the AppController File Editor to edit the properties, XML files, or text files that are part of AppController. Keytab Validation In AppController, you can validate the keytab file and test whether you have uploaded a correct keytab file in the User Authentication section. Master User List This feature allows you to manage Active Directory in AppController. You can retrieve the user list from Active Directory and then reconcile user accounts that are in AppController. Reports Extensive reports pertaining to license and application usage are introduced in AppController. Secure LDAP AppController supports secure LDAP protocol for Active Directory user authentication. SSO Credential Validations The SSO Credential Validations feature validates the SSO credentials before storing them in AppController or the External Password Store. Support Bundle If you have a problem with AppController, you can create a support bundle to send to technical support staff. Vendor Portal The Vendor Portal is a customizable web interface for vendors to access their SSO and enterprise applications, and enables vendors to perform self-service operations. Installing AppController The Citrix AppController virtual machine (VM) runs on Citrix XenServer or VMware ESXi. You can install AppController by using XenCenter or vsphere, both of which you must install on a separate computer than XenServer or VMware ESXi. Before installing AppController, you must first do the following: Install XenServer or VMware ESXi on a computer with adequate hardware resources. 17

18 Known Issues Install XenCenter or vsphere on a separate computer. The computer that hosts XenCenter or vsphere connects to XenServer or VMware ESXi host through the network. If you install AppController on XenServer, create virtual hardware components on XenServer and allocate them to AppController by using XenCenter You can download the virtual image from My Citrix. You can get the virtual image from My Citrix after you have purchased CloudGateway Enterprise. The virtual image contains the package that you need in order to install AppController on XenServer or VMware. For the XenServer installation, the virtual image is a file with the file name extension of.xva. For the VMware installation, the virtual image is a file with the file name extension of.ova. For more information about installing AppController, see Installing AppController

19 Known Issues Known Issues in This Release 1. Tooltip messages for Subscribed Apps does not appear in Citrix Web Receiver. [#9375] 2. In the Add Application dialog box for SAML, when you click Download certificate, the "oca certificate" downloads instead of the "AppController certificate." [#10445] 3. When users log on by using SSO with domain authentication, the OCAJSESSIONID cookie is set in the browser. [#10462] 4. The TAB key does not work for the radio button options in the File Editor page in the AppController configuration utility. [#10503] 5. In the Credential Capture page, the password users provide during a failed logon attempt appears when you use the TAB key to navigate to the Password field. [#10591] 6. When you use Internet Explorer 8 to connect to AppController, the Security Certificate warning prompt appears two times when you click Debug Window in System Overview. [#10620] 7. Single sign-on is not working for the Google Health application. [#10807] 8. When you initiate a task from Citrix Receiver, two workflow initiation notifications are sent to the workflow requestor. [#10826] 9. If users initiate a task for the second time after an approver rejects the request, the tracking history in Task Details displays incorrect information. [#10827] 10. Current SSO Users reports are not created for SAML applications. [#10910] 11. If you use NTLM authentication to log on to MyWebApps with Google Chrome, you receive the error message No Application Found. [#10915] 12. Single sign-on does not work for the Twitter application with the Formfill handler type. [#10928] 13. If you configure the WFS adapter in the AppController Store and the web.conf file in Citrix StoreFront, applications do not appear in the Web Receiver home page. [#11003] 14. If users log off from Citrix Receiver when an application request approval is in a pending state, and then log on again, the requested application does not appear in the Citrix Receiver home page. [#11012] 15. The application icon does not appear correctly in Citrix Receiver for Windows 3.1 if the application is built by using an HTTP Federation Connector. [#11015] 16. When you save the Master User List, AppController removes additional authorizers configured in the workflow template. The minimum number of approvals remains the same. To prevent this from occurring, when you create or edit the Master User List, make sure you click Update to save the information. [#11034] 17. If you retrieve Oracle users by using an IP address in the Fetch Users dialog box, in the application details dialog box, the Application Login URL of the Oracle application is replaced with an IP address. [#11038] 19

20 Known Issues 18. When employees log on to the Vendor Portal, the Language field value appears as Enabled in the Update Profile Details page. [#11055] 19. The Application Login URL label appears as ACS URL in the Managed SAML Applications page. [#11057] 20. The Master User List feature does not work if you use the Service Account with the format <domainname>/<admin user account>; for example, if you use mycompany.com/admin. [#11059] 21. When you modify a category name, application label description, manage a new application, remove a map from a role, or map a new application to a role in AppController, the changes do not appear in Web Receiver. [#11065] 22. The description of application category managed in AppController does not appear in Receiver. [#11068] 23. You must use the.ico format images to display application icons of managed applications that are built by using the HTTP Federation connector. [#11069] 24. The Request button does not appear in Citrix Receiver if you modify the enumerated application description in AppController 1.0. [#11079] 25. When you configure advanced settings for a SAML application, if you select Single Logout, when users log off from MyWebApps, this feature does not work and users do not log out of the SAML application at the same time. [#11525] 26. In the License over utilization report, the number of user licenses that AppController calculates for each application is not correct if users reset their credentials with different user accounts. [#11526] 27. If you set the minimum and maximum threshold for license utilization for an application to zero (0), AppController will not generate a license utilization report. [#11531] 28. When users access the Epocrates application through single sign-on for the first time from a Safari 5.1 browser, a Cookies error page appears. [#11534] 29. If you create user accounts in AppController when the External Password database is unavailable, single sign-on may not work for those users. [#11536] 30. If the number of challenges specified on the Authentication Options tab does not match the number of questions entered in the Challenge Question tab, a warning message does not appear. If you try to create a new user account in the Vendor Portal, AppController fails on the challenge question tab and a JavaScript error appears. [#262586] 31. If you configure LDAP authentication in AppController and then attempt to synchronize users for provisioned applications, a message appears stating that the service is not available. [#266630] 32. If you add Active Directory as an authoritative list to AppController and then fetch users, in the Fetch Users dialog box, under Fetch Users, in Select User List, Active Directory does not appear. The only option is the SSACUserList. This occurs in Internet Explorer 9 and Firefox. [#266837] 20

21 Known Issues 33. If users attempt to log on to Office 365, SSO does not work and users receive an empty page. In Advanced Settings in Office 365, you can change the redirect URL to instead of Also, in the HOSTS file on user devices, add the AppController IP address and <appcfqdn>.login.microsoftonline.com. [#267460] 34. If you configure the keyword feature for client choices in Access Gateway Enterprise Edition, when users try to open an application from Receiver and enter their credentials, users receive notification that the connection is successful even though the connection from the Access Gateway Plug-in fails. The Web page for the application does not open. [#273654] 35. When you view the AppController configuration utility in Internet Explorer 9, the mouse pointer does not appear when you move the pointer over icons, like Add or Open. [#273760] 36. After AppController saves log reports to an external syslog server initially, AppController does not save subsequent log reports to the server. [#273818] 37. If you change the logon URL for an application in the AppController configuration utility, the change to the Web address does not appear in MyWebApps for the bugzilla connector. When users click the application name, the URL redirects to the previous Web address. [#274052] 38. If you delete an application in the configuration utility, the SSO credentials that users saved for the application are not deleted entirely. If you add the application again, when you view the user accounts for the application, the user details from the earlier configuration appear. [#274061] 39. When users access My Citrix, authentication fails if they enter their credentials by using the format domain\user name in the Save Credentials dialog box. Users receive the error message "invalid user name." Some users are required to provide a domain name to access My Citrix. [#274339] 40. If you add a SAML application for with identity provider-initiated SSO for the Salesforce application, the SAML 1.1 connector is not available by default. You need to use the SAML connector builder to create the connector. [#274347] 41. When users log off from Citrix Receiver and the store only contains data from AppController and not XenApp or XenDesktop, the following error appears: Could not exit active applications. Please exit applications manually. [#274378] 42. After you configure an SAML_SP-based application for GoogleApps, you must edit the application details to change "www" to "mail" in the Application Login URL field, and then click OK. [#275361] 43. When you configure high availability and if the primary virtual machine (VM) fails and the secondary VM takes over, the data indicating the applications under categories does not synchronize and the new primary VM does not list the applications under categories in MyWebApps. [#275534] 44. In a high availability configuration, when the primary virtual machine (VM) fails, users experience a lack of connection for longer than one minute while the secondary VM takes over. [#275536] 21

22 AppController System Requirements You can install AppController on XenServer 5.6 with Service Pack 1 and VMware ESXi 5.0. XenServer and VMware ESXi must provide adequate virtual computing resources to AppController as listed in the following table. Table 1. Virtual Computing Resources for AppController Memory Virtual CPU (VCPU) Virtual Network Interfaces 1 4 GB 2 VCPUs 22

23 Planning Your AppController Deployment Before you install Citrix AppController, you should collect and record configuration information in order to complete a successful installation. This section includes a checklist listing the information you need on user devices, network connectivity, Active Directory settings, and application settings for configuring single sign-on (SSO). The checklist also lists the tasks you should follow on opening ports to allow communication with AppController and for configuring two VMs for high availability. 23

24 AppController Pre-Installation Checklist This document contains a checklist of the tasks and planning information you should complete before you install AppController. The checklist notes the configuration values that you need when you install and configure AppController. You should make note of these values before you install and configure the virtual machine. Citrix recommends that you print and complete this checklist. The checklist has an extra column that you can use to check off each task as you complete it. For instructions about installing and configuring AppController, see Installing AppController 1.0. User Devices 1 Create a list of user devices that connect to AppController. AppController Basic Network Connectivity 2 AppController host name. Configure one DNS entry. 3 IP address. Reserve one IP address if you install one instance of AppController. Reserve three IP addresses if you configure AppController for high availability. 4 Network Time Protocol (NTP) Server The IP address for the NTP server. 5 If your deployment supports remote access to AppController, note the following: One public IP address One external DNS entry for AppController 24

25 AppController Pre-Installation Checklist Communication AppController requires communication with the following: Active Directory Users Administrators Open the following ports to allow communication with AppController. 6 Active Directory port 389. Open port 636 if you use secure LDAP. 7 If you allow connections to AppController from external users, open TCP port 443 in your firewall. 8 Open the following ports to allow administrator access: 22, 443, 8443, and 9443 Active Directory Settings You can use Active Directory to obtain users for the Master User List and to provision user accounts. 9 Active Directory Version 10 Active Directory Administrator 11 Active Directory IP Address 12 Active Directory fully qualified domain name (FQDN) 13 Base DN. DN (or directory level) under which users are located; for example, ou=users, dc=ace, dc=com. 14 Synchronization period. You can schedule how often AppController synchronizes with Active Directory to obtain changes to the Master User List. 15 Active Directory service account. The service account that AppController uses to query Active Directory. 25

26 AppController Pre-Installation Checklist 16 Account Creation Rule. The rules used to create Active Directory Accounts. 17 Active Directory attribute. The attribute that contains SAML user names. 18 Certificate. If you configure AppController to communicate using port 636, install a root certificate issued by a Certificate Authority (CA). 19 Test user account. This is an Active Directory account that you can use to test SSO to MyWebApps. Application Information You can configure single sign-on (SSO) to applications in AppController. Use this section to note the application and application settings. 20 Names of SAML applications. 21 Names of Formfill applications. 22 Logon Web address of applications. 23 Test credentials to test SSO to applications. 24 Total number of users accessing applications. 25 Application Owner. The individuals in your organization who can make application configuration changes. 26 Application license information. The number of licenses available for each application. High Availability You can configure two AppController virtual machines (VMs) for high availability. If the primary AppController fails, the secondary AppController can accept user connections. Each AppController VM must be in the same subnet. 26

27 AppController Pre-Installation Checklist 27 Identify the primary AppController IP address and subnet. 28 Identify the secondary AppController IP address and subnet. 29 Configure a virtual IP address on the primary AppController. 30 Configure the SSL handshake between AppController VMs. 27

28 Deploying AppController Citrix AppController identifies the users who are accessing an application and performs single sign-on (SSO) to the application, thus providing seamless application access for users. The following sequence of events describes how AppController provides SSO for users: 1. A user who logs on to the domain types a Web address in the Web browser. 2. AppController identifies the domain user. 3. AppController issues a redirect request through the browser. 4. AppController performs SSO and forwards the session to the browser, along with the appropriate cookies. 5. The user continues to access the application by using the established session. This section illustrates how you can deploy the AppController virtual machine (VM) on XenServer or VMware ESXi in your internal network, as well as how to deploy two VMs in a high availability pair. 28

29 Deploying AppController in Your Network You can deploy the AppController virtual machine (VM) on XenServer or VMware ESXi that are located in your internal network. Users can connect to AppController from an external connection (the Internet) or from the internal network. The following diagram shows how you can deploy AppController in an enterprise network. Figure 1. App Controller Network Deployment 29

30 Deploying AppController in a High Availability Configuration You can deploy two AppController virtual machines (VM) in a high availablity pair. A high availability configuration prevents downtime and ensures that the services provided by AppController remain available, even if one AppController is not working. The following illustration show a high availability deployment where one AppController VM is not receiving connections. Figure 1. AppController High Availability Deployment 30

31 Installing AppController 1.0 The Citrix AppController virtual machine (VM) runs on Citrix XenServer or VMware ESXi. You can install AppController by using XenCenter or vsphere, both of which you must install on a separate computer than XenServer or VMware ESXi. Before installing AppController, you must first do the following: Install XenServer or VMware ESXi on a computer with adequate hardware resources. Install XenCenter or vsphere on a separate computer. The computer that hosts XenCenter or vsphere connects to XenServer or VMware ESXi host through the network. If you install AppController on XenServer, create virtual hardware components on XenServer and allocate them to AppController by using XenCenter. This section details the following steps for installing AppController on XenServer or VMware: Downloading the virtual image. Installing the VM on XenServer and setting the properties for AppController in XenCenter. Installing AppController on VMware ESXi and use vsphere to allocate virtual hardware components to AppController. Configuring the IP address for AppController. Using the Setup Wizard to configure the initial settings in AppController. Configuring the Master User List and adding the user list in Active Directory. Deploying two AppController VMs in a high availability configuration. 31

32 Downloading the Virtual Image for AppController You can download the virtual image from My Citrix. You can get the virtual image from My Citrix after you have purchased CloudGateway Enterprise. The virtual image contains the package that you need in order to install AppController on XenServer or VMware. For the XenServer installation, the virtual image is a file with the file name extension of.xva. For the VMware installation, the virtual image is a file with the file name extension of.ova. To download the virtual image 1. Log on to My Citrix and then click Downloads. 2. Under Search Downloads by Product, select CloudGateway. 3. Under Results for CloudGateway, click CloudGateway Enterprise. 4. Under Recommended Downloads, in AppController virtual appliance for XenServer, click Download and then save the image to your computer. After the image downloads to your computer, you then install the image on XenServer or VMware. After installation, set the properties for AppController in XenCenter. 32

33 Installing AppController on XenServer After you download the virtual image (VM) from My Citrix, install the VM on XenServer. After installation, set the properties for AppController in XenCenter. To install the AppController software 1. Start XenCenter on your computer. 2. In the navigation pane, click the name of the XenServer on which you want to install AppController. 3. On the File menu, click Import. 4. In the Import wizard, in Import file name, browse to the location to which you saved the.xva image file and then click Open. 5. Follow the instructions in the wizard to import the AppController image. After you click Finish in the wizard, you can click the Logs tab to view the status of the import process. When importing the VM is complete, you then need to set the AppController properties. To set the properties for AppController 1. In XenCenter, select the imported VM, and in the right pane, click Properties. 2. In the App Controller import Properties page, click CPU and Memory. 3. In the left pane, in Number of VCPUs, select In VM Memory, select In the left pane, click Startup Options. 6. In the right pane, click Auto-start on server boot. 7. In Boot from, select HD and then click OK. 33

34 Installing AppController by Using VMware ESXi To install AppController on VMware ESXi, you must first install VMware on a computer with adequate hardware resources. To perform the AppController installation, you use vsphere, which you must install on a remote computer that can connect to the VMware host through the network. After you install AppController, you can create virtual hardware components on VMware and then use vsphere to allocate them to AppController. To import the virtual image file to the vsphere Client 1. Click Start > VMware > Vsphere Client. 2. Log on using your vsphere credentials. 3. Click File and then click Deploy OVF Template. The Deploy OVF Wizard opens. 4. In Source, select Deploy from file, browse to the.ova file on your computer, select the file and then click Next. 5. In OVF Template Details, click Next. 6. In the Name and Location page, in Name, type a name for the template, such as Citrix AppController and then click Next. 7. In the Resource Pool, select the the resource pool in which to import AppController image and then click Next. 8. In the Datastore page, select the datastore in which you want to store the VM image and click Next. 9. In the Disk Format, select the format to store the virtual disks and then click Next. 10. In Ready to Complete, confirm the deployment settings, such as the host and cluster name, datastore, and network mapping and then click Finish. 34

35 Installing AppController by Using VMware ESXi To set AppController Properties in vsphere 1. In vsphere, in the left pane select the server on which you installed AppController. 2. In the right pane, select the Configuration tab. 3. In the right pane, under Software, click Virtual Machine Startup/Shutdown. 4. In the right pane, click Properties in the upper-right corner. 5. Select Allow virtual Machines to start and stop automatically with the system. 6. In Startup Order, select the AppController VM. 7. Click the move up button until AppController appears under Automatic Startup and then click OK. 8. In vsphere, select the imported AppController VM and in the right pane, click Edit Settings. 9. In the App Controller import Virtual Machine Properties page, in the left pane, click Memory. 10. In the right pane, in Memory Size, select In the left pane, select CPUs. 12. In the right pane, in Number of VCPUs, select 2 and then click OK. 35

36 Setting the AppController IP Address After importing the AppController image, you then need to configure the IP address. You can access the AppController command-line interface through the XenCenter console to specify an IP address, subnet mask, and default gateway. The default IP address for AppController is The IP address is the management address at which you can access AppController through a Web browser or by using a Secure Shell (SSH) client, such as PuTTY. To change the IP address for AppController 1. At the console logon prompt, enter the administrator credentials. The default user name is admin and the default password is password. 2. At a command prompt, type configsys and then press Enter. The default IP address of AppController appears. If you choose to change the IP address, you are asked to set an IP address, subnet mask, and default gateway. After you enter the information, the network interface restarts, and you can access the configuration utility by using the new IP address. 36

37 Configuring AppController by Using the Setup Wizard After you install the Citrix AppController virtual machine (VM), you can use the Setup Wizard to configure the initial settings in AppController. The first time you log on to the configuration utility by using a Web browser, the Setup Wizard starts automatically. In the Setup Wizard, you configure the following settings: Host name of AppController Primary and secondary DNS IP address for AppController Time zone and a Network Time Protocol (NTP) server Active Directory domain as the authentication service LDAP as the authentication service in place of Active Directory Keytab file If you choose to use LDAP as the authentication server, make sure you configure AppController to use secure LDAP. If you use secure LDAP, use port 636. If you want to use Kerberos authentication, you can select this option in the wizard. To start the Setup Wizard 1. In a Web browser, enter the AppController Web address. The Setup Wizard starts. 2. Follow the instructions in the Setup Wizard. When you complete the Setup Wizard, AppController restarts. After you complete the initial settings, you then want to configure authentication, applications, and users for SSO. You can use the following guidelines: Obtain the Master User List from Active Directory or another database that contains all of the users in your organization. Add applications to AppController for SSO by using either Formfill or SAML federation, for automatic user account provisioning, or both. Create user accounts automatically based on Active Directory group membership. Map which Active Directory group gets access to the application. 37

38 Configuring AppController by Using the Setup Wizard Assign users to applications based on their role within the organization. Connect AppController with StoreFront services, so the various Receivers can see the application list, subscribe to applications, and access them seamlessly. You can check the Citrix Web site for the latest connector library and service packs. For information about how to install a connector library or service pack, see To install service packs. 38

39 Configuring the Master User List The Master User List contains all of the users in your organization who have access to Web and SaaS applications that you configure in AppController. Typically, you use Active Directory as the Master User List. When you provide your Active Directory information, you can retrieve and reconcile users in your Active Directory groups with AppController. The Master User List creates an authoritative list and the network users list. You do not need to add or configure these separately. When you configure the Master User List in AppController, you add the user list in Active Directory to AppController and manage the Master User List as an authoritative list with default values. After Active Directory is configured in the Master User List, AppController performs the following tasks: Manages Active Directory as an authoritative list. Retrieves the user list from Active Directory. Reconciles users in the users list with the following default rule, IF0 = FD2. Configures the default pre/post process scripts. Assigns a default password rule with the following parameters: Minimum characters 8 Maximum characters 16 At least one numeric character 39

40 Configuring the Master User List To configure the Master User List 1. In the configuration utility, expand Users & Applications and then click Master User List. 2. In the details pane, in Master User List, the details of the Active Directory that you added in User Authentication appears. 3. Click Edit and then enter the following information: Active Directory IP address Port number Domain name Base DN Service account ID Password 4. Click Save. 40

41 Configuring AppController High Availability If you deploy two AppController virtual machines (VM), you can deploy them in a high availability configuration. The AppController VM on which you first configure high availability configuration is called the primary, and the other VM is called the secondary. In this deployment, the primary AppController VM listens for requests, serves user requests, and synchronizes its data with the data on the secondary AppController VM. The two VMs work as an active-passive pair, in which only one VM is active at a time. If the primary AppController VM stops responding for any reason, the secondary AppController VM takes over, becomes the active VM, and begins to service user requests and provide single sign-on (SSO) services. As the active VM, the secondary AppController VM also synchronizes system and database information by using a client-server mechanism. A client on the active AppController VM shares the necessary information to a virtual server on the passive AppController VM as a series of requests. The virtual server parses the requests and performs the necessary action. You configure each instance of AppController with an individual IP address. Each AppController in the pair is also assigned with a well-known IP address, which is used by the active AppController. Users connect to the primary AppController VM by using a fully qualified domain name (FQDN) that resolves to the well-known IP address. 41

42 How AppController High Availability Works Each VM in an AppController high availability pair generates a heartbeat request one time every minute. A diagnostics script on each VM generates health-status information. The heartbeat service running on the two VMs monitors the health of each AppController system and the health of the high availability pair. If the primary AppController VM fails for any reason, the secondary VM immediately begins to service user requests and provide SSO functionality. As the active VM, it also synchronizes system and database information with the other VM. If the passive VM does not respond to a heartbeat request or reports a failure, the active VM marks the passive VM as failed and is sent automatically to you. If the active VM does not respond or reports a failure, the passive VM acquires the public IP address, becomes active, and an is automatically sent to you. When the failed VM comes back online, the active VM updates the other VM with differential data and updates its status from failed to passive. 42

43 Configuring High Availability Before you configure a high availability pair, do the following: Install the same build version for each AppController VM. Install any hotfixes on both VMs. Install both VMs in the same network subnet. Assign IP addresses from the same subnet to each VM in the pair. Assign a well-known IP address to the primary VM in the pair. When you configure high availability, the primary device IP address is automatically assigned as the well-known IP address for the pair. You must set aside one more IP address to assign to the primary VM. Install a certificate for the SSL handshake between the two AppController VMs. For more information about how to install a certificate SSL handshake between two AppController VMs, see Setting the SSL Handshake Between Two AppController VMs. When you configure high availability, the following settings are automatically completed for you: Well-known IP address Subnet mask Default Gateway addresses 43