Version 1.1.2
Web Self Service Administrator Guide Version 1.1.2 Copyright and Trademark Notice Use of the product documented in this guide is subject to your prior acceptance of the End User License Agreement. A printable copy of the End User License Agreement is included on your product installation media. Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Citrix Systems, Inc. 2011 Citrix Systems, Inc. All rights reserved. Trademark Acknowledgements All trademarks and registered trademarks are the property of their respective owners. 2 Citrix Systems, Inc.
Contents 1. INTRODUCTION TO CITRIX WEB SELF SERVICE 1.1.2... 4 2. UNDERSTANDING THE WORKSPACE... 5 3. MANAGING POOLS... 8 EDITING POOL INFORMATION... 8 ADDING POOLS... 9 4. ADDING USERS... 10 5. MANAGING USERS... 12 6. MANAGING ROLE BASED ACCESS CONTROL... 13 DEFINITIONS OF PERMISSIONS... 14 7. CONFIGURING SETTINGS... 16 8. MANAGING THE APPLIANCE... 18 9. SHARING VMS... 19 10. UNDERSTANDING TAGS... 20 11. TROUBLESHOOTING... 22 TRACKING WEB SELF SERVICE PERFORMANCE USING XENCENTER... 23 12. UPGRADING THE APPLIANCE... 26 3 Citrix Systems, Inc.
1. Introduction to Citrix Web Self Service 1.1.2 XenServer Web Self Service is a Web based virtual machine management console for XenServer 5.6, 5.6 FP1, 5.6 SP2, 6.0 and 6.1 versions. It enables Citrix XenServer administrators to: Delegate access to individual virtual machine guests to end-users. View consolidated virtual machine guests from multiple resource pools. Perform basic life cycle operations such as Start, Stop, Suspend, and Reset on virtual machine guests. Log in remotely (VNC for Linux Guests and RDP for Windows Guests) to the virtual machine guests. XenServer Web Self Service users can view VM consoles, Start, Stop, Suspend and Reset their virtual machines. It also provides a way to meet communication needs between user and administrator to satisfy IT provider objectives. XenServer Web Self Service is packaged as a XenServer Virtual Appliance which can be imported into the XenServer Pool. Web Self Service manages XenServer tags to establish relationship between users and virtual machines in the Citrix XenServer Pool. XenServer tags enable you to identify your resources in new ways. Tags are like keywords or labels, and they allow you to rearrange your view of resources within XenCenter depending on criteria that are important to you, such as application, location, cost center, owner, or lifecycle stage. For more information on tags, refer to Understanding Tags. After importing the Web Self Service appliance, log in to the Web Self Service and follow the three steps to complete the setup process. 1. Add a pool. Refer to Managing Pools. 2. Add users. Refer to Adding Users. 3. Share VMs with user. Refer to Sharing VMs. You may follow the Installation Checklist section of the Admin Homepage. This document assumes that the reader is familiar with Citrix XenServer technology. 4 Citrix Systems, Inc.
2. Understanding the Workspace The workspace page appears when you log in to Web Self Service. It shows thumbnails of all the VMs on XenServer pools added to Web Self Service. You can do all the power operations (Start, Shutdown, Reboot, and Suspend) on these VMs and can interact with the console of the VM through either RDP or Web Console. When an administrator adds a pool to be managed in Web Self Service, it discovers all the virtual machines visible to the pool automatically. The metadata and the thumbnail of each virtual machine are displayed in the workspace page. The virtual machine metadata includes: Memory CPU, NIC Storage Tags Other tags The workspace screen has several screen elements which will allow you to share the VMs, search for VMs by their names and filter names by pool or users. The different screen elements of the workspace page are: 1. Search - You may search for the VM by its name or the OS associated with it. 2. Filter - You can filter VMs in the Workspace by users or/and pools. 5 Citrix Systems, Inc.
3. Share - You may share the VM with other users. 4. VM Interactive Operations - You can start, shutdown, reboot, and suspend VMs. You can also interact with the console of the VM through RDP or Web Console directly from here. The VM should have XenTools installed to display all the IP addresses in the RDP fly out menu. Workspace This is the home page of WSS with all the screen elements. The hidden VMs in XenServer are also visible to the admin user in WSS. Figure 1 - WSS Home Page The left pane provides links to important functions Web Self Service. The left pane has Overview and Manage functions. 6 Citrix Systems, Inc.
Overview The Overview menu provides these links: Manage Workspace - Lists all the available VMs on the XenServer hosts configured in Web Self Service. VM Requests - This shows the pending VM requests of users. The administrator may allocate VMs to them based on their requests. This can be disabled from the Web UI by the administrator. The Manage menu provides these links: Pools - This lists all the XenServer pools added to Web Self Service. Administrators may add new pools, disable or delete existing pools. For more information on adding pools, refer to Managing Pools. Users - This lists the users that are added. You may individually add users or import all the users registered with XenServer Active Directory. For more information on adding users, refer to Adding Users. Install Checklist - Assists you to complete your installation with the statuses and the descriptions of various steps. Task logs - Show the chronological list of the events initiated by users. You may search or filter task logs by user, pool name or status of the event. Settings - You can configure different aspects of the product like workspace page settings. SMTP email and VM request settings Appliance - You can perform different admin related tasks like backing up and restoring DB, collecting logs, configuring static IP address etc. 7 Citrix Systems, Inc.
3. Managing Pools XenServer pools added to the Web Self Service are listed under Pools. If you are using AD authentication, you will need to designate one of the pools as the Authentication Pool. You may later change the Authentication pool. Editing Pool information The following options can be configured for every pool in Web Self Service. Edit - If the pool master IP address has changed, this allows you to provide the new pool master IP address. However, changing the pool master IP address here does not alter anything in the XenServer pool. Scan ISOs - Allows you to scan ISO files placed in the pool storage. Tags - This allows you to create new tags, replace an existing tag and delete tags for all VMs in a pool. Disconnect - Disabling a pool will prevent all users (including the admin user) from viewing consoles of VMs that belong to the pool. The VMs will continue to run in XenCenter. Remove - Deletes the pool from Web Self Service. Users will no longer be able to access VMs on this pool through Web Self Service once the pool is deleted. View Details - Lists the details of the pool like number and the details of the hosts in the pool, ISOs placed in the storage of the pool and so on. View Task Logs - Shows all the tasks performed on the pool. View Diagnostics - Shows the diagnostics information of the pool. Figure 2 - Pool Information 8 Citrix Systems, Inc.
Adding Pools You may add XenServer pools to the XenServer Web Self Service by providing the Pool Master IP address and login credentials. If you are using Web Self Service with more than one pool, only one pool needs to be joined to the domain and designated as the Authentication Pool. Web Self Service will use AD details of only this pool for authentication. 9 Citrix Systems, Inc.
4. Adding Users User authentication is configured either to use the built-in database or through XenServer Active Directory. This is done while setting up XenServer Web Self Service and cannot be changed thereafter. If you choose to use built-in database, you will need to manually create a username and password for every user. If you choose to use the XenServer Active Directory Authentication, you will need to ensure that XenServer is joined to the Active Directory domain. Users can be added in XenServer Web Self Service only if they belong to the Active Directory Users in XenCenter either as a part of a group or an individual user. Figure 3 - XenServer Active Directory XenServer Active Directory You can configure Web Self Service to allow XenServer AD users to automatically login with their AD credentials without having to add each user in Web Self Service. You can enable auto-login from the server settings. 10 Citrix Systems, Inc.
In such a case, the user is automatically created in Web Self Service on first login. If the AD users are not configured to auto-login, the AD usernames should be added manually. 11 Citrix Systems, Inc.
5. Managing Users Once users are added or imported, they will be listed in the Users section of the Web Self Service. You may change the administrator password. Changing the administrator password from here will not change the root password of the appliance. You will need to login to the appliance as root and change it from there using the command password. Figure 4 WSS Configured with AD You may disable or remove users from the users list. If you disable a user, that user will not be able to log in to Web Self Service and the administrator will not be able to share VMs with the user. This user will be listed as Disabled in the Workspace of the administrator. Figure 5 - Enabling and Disabling Users Disabled users You may also view information about the tasks performed by a particular user and the VMs shared with the user. If you are using Active Directory as the authentication mechanism and a user gets deleted in the XenServer AD, you will have to delete that user from the Web Self Service. 12 Citrix Systems, Inc.
6. Managing Role Based Access Control Web Self Service Users acquire Web Self Service permissions through their assigned role in XenServer. Web Self Service leverages XenServer's Role Based Access Control (RBAC) which maps the roles defined for the Active Directory users in XenServer to Web Self Service roles. The following table summarizes the mapping of XenServer roles to WSS roles. XenServer Roles Pool Admin Pool Operator VM Admin VM Operator VM Power Admin Read Only No Role WSS Admin WSS Operator WSS User WSS User WSS Roles Note: The user admin is the local admin who has the WSS Admin role for all the managed pools in WSS. If the user does not have a role assigned in XenServer AD, the user gets the default WSS user role in WSS. The following table summarizes which permissions are available for each role. For details on the operations available for each permission see Definitions of Permissions. 13 Citrix Systems, Inc.
Definitions of Permissions The following table provides additional details about permissions: Permissions Allows Assignee to Pool Management Add pool Delete pool Edit pool user name and password Disconnect pool Reconnect pool User management Add user Delete user Change user password Enable user Disable user View VMs in Workspace View VM configuration details View VM history VM Access Control Share a VM with a user Unshare a VM from a user Change Auth Pool Change the authentication pool of WSS 14 Citrix Systems, Inc.
Logout Active User Sessions View active users logged in to WSS Log out all active user sessions VM Basic Life Cycle Control Operations Start a VM Stop a VM Suspend a VM Resume a VM Reset a VM VM Change CD Media Eject a CD Attach a CD View VM Consoles View VM web console View RDP console View VNC console View thumbnails in workspace View all Task Logs Read all task logs Manage VM Requests Mark a request as Read Mark a request as Unread Control Appliance Networking Configure IP settings for WSS Change the listening NIC of WSS Change the host name of WSS Backup and Restore Take a backup of WSS Restore WSS from a backup Download Support Logs Download support log files Note: If the same user has different roles across multiple pools WSS will honor permissions on the poll based on the roles defined for the pool. The user role can be seen on the on the right corner of the WSS web UI. If you use the built-in database for user creation all the users except the admin user will be allocated the WSS user role. The admin user will have the local admin user role. 15 Citrix Systems, Inc.
7. Configuring Settings The configuration settings are divided into different functions. Server Settings Authentication Mode: Shows the authentication mechanism used for Web Self Service. This is configured at the time of installation and cannot be changed thereafter. Login Session Timeout: You may configure the session timeout for users. Allow Weak Passwords: Allows weak passwords for users. Workspace Page Settings VM Requests Auto Refresh: You can configure the browser refresh rate of the Workspace webpage. Thumbnails: You can disable thumbnails on the workspace page. Disabling thumbnails reduces load on the virtual appliance. Thumbnail Expiry Time: VM thumbnails will expire and will not be displayed after this time interval. A new thumbnail will be fetched only if the user is viewing the workspace. Details Column (Default): You may remove VM details like RAM, network, disk space, IP address etc. from the user homepage. Sharing Column in Workspace for Non Admin: You may show sharing related information from the user homepage. Enable VM Request: This enables users to place VM requests. Disabling this option hides the VM Requests option from their page. Request Template: You can use the default VM request template or you can customize the default template. Enable and Save this setting to edit the default template from the Settings page. Since VM Request template customization is done by editing HTML, ensure that the HTML code change does not compromise on security. Email Notification 16 Citrix Systems, Inc.
Send Email: Admin user will get email notifications when the users place VM requests. SMTP Server: Specify the SMTP server address that will be used for sending mails. SMTP Port: Specify the SMTP port number in the field. SMTP Login: Specify the login ID that will be used to login to the SMTP server. SMTP Password: Specify the password of the login ID that will be used to log in to the SMTP server. Admin's Email Address: Notifications will be sent to this address. 17 Citrix Systems, Inc.
8. Managing the Appliance The Admin tasks are divided into Networking, Backup-Restore, and Support. Server Information Shows the current version of the appliance, time and lists all the user sessions. Networking Listening interface - Default configuration listens on all IP addresses associated with the virtual appliance. You can configure it to listen only on a preferred IP address. Interface - Allows you to configure the Web Self Service virtual appliance IP address as static or DHCP. Hostname - Change hostname for the Virtual Appliance. Backup and Restore Support Backup Database - Allows you to back up the pre-packaged Web Self Service file based database and the security related files at any point in time. Once you have taken a backup, you are advised to download the backup file and archive for future use. Restore Database - Allows you to upload the backup file created in the previous step. This will only restore the database and will not alter the states of XenServer pool or VMs. Support Logs - You can download the logs for the virtual appliance. It also provides information about Database Type, Database Version, Linux Version, Schema Version, WebServer and Diagnostics of the appliance. 18 Citrix Systems, Inc.
9. Sharing VMs VMs can be shared with the users of XenServer Web Self Service by using the Share functionality from the Workspace page. For example, in the figure below, the VM Windows Server 2003 is shared with users Avinash, arun, and Subodh. Figure 6 - User tags The sharing functionality is implemented in Web Self Service through tags in XenCenter. When you share a VM with a user in Web Self Service, a tag with the name of the user is created in XenCenter. In the below given screenshot, the tags ssuser:avinash, ssuser:arun and ssuser:subodh are created in XenCenter when the VM is shared with this user in Web Self Service. Figure 7 - Tags Created in XenCenter If you remove or disable this tag from the VM in XenCenter, the VM is automatically unshared from the Web Self Service as well. 19 Citrix Systems, Inc.
10. Understanding Tags You can create tags and assign them to VMs in XenCenter. These tags are listed in the Details section. Figure 8 - Tags Web Self Service Tags Web Self Service uses tagging functionality in XenCenter to to indicate sharing of VMs to users in XenServer Web Self Service. XenServer Web Self Service automatically creates three types of tags in XenCenter. ssuser:<user> (e.g. ssuser:mark) - This tag indicates that the VM is shared to the specified user. If you remove this tag in XenCenter, the VM will no longer be shared to the user in Web Self Service. You may create tags for VMs in XenCenter with this format even if the user is not added to the Web Self Service. If this tag exists, the VMs are shared with the users when they are added. Dormant Users If the VM has a ssuser:<user> tag and <user> has not been added to in Web Self Service, this is shown as a Dormant user in Workspace. If you later add the user in Web Self Service, this tag will take effect and result in the VM being immediately shared to the user. In the screenshot below, the VM is tagged with ssuser:anil but anil is not added as a user in Web Self Service. So anil appears as a dormant user for that VM. The admin may add anil as a user in Web Self Service and the VM gets shared to this user automatically. 20 Citrix Systems, Inc.
Figure 9 - Dormant Tag ssattrib:hide This tag indicates that the VM should be completely hidden in Web Self Service. This VM will not be shown in the Workspace even to the admin. ssattrib:disable - This tag indicates that the VM should be hidden from endusers in Web Self Service. This tag is added to the VM if the admin disables the VM in the Workspace. If you remove this tag in XenCenter, the VM will be enabled in Web Self Service. This feature allows the admin user to remove VMs from the Workspace of non-admin users for maintenance activities like installing patches or recovering from virus attacks. 21 Citrix Systems, Inc.
11. Troubleshooting The following tools and information help you to diagnose and troubleshoot possible Web Self Service issues. Collecting Log Files 1. Login to the Web Self Service Web UI as admin. 2. Go to the appliance. 3. Click Download under the Support > Support Logs section 4. Save the file XenServer Web Self Service_logs_YYYYMMDDHHMMSS.gz. Alternatively, you may also login to the Web Self Service appliance console from XenCenter, then zip the contents of: /var/log/sse directory, /root/ssedata directory. Diagnostics information Diagnostic information provides details about Appliance Memory Free/Used Memory, List of processes running in the VM (top output) and the page average response time for the last 5 mins. 22 Citrix Systems, Inc.
1. In the Web Self Service Web UI, go to Appliance. 2. Click on View under the Support > Diagnostics section. Tracking Web Self Service Performance using XenCenter Figure 10 Performance Tab in XenCenter Pool Diagnostics information Click on Pool > <select pool> > View Diagnostics from the flyout of pool name. This information in the Web Self Service Web UI is useful to understand: 23 Citrix Systems, Inc.
When network connection is lost and when it was recovered Change is Pool Master IP address Change in credentials When was the pool disabled and enabled? Other intermittent errors Figure 11 - Pool Diagnostics Task Log Information This information in the Web Self Service Web UI is useful to understand: Lists down various admin/user initiated tasks and its statuses. If the task resulted in error, and if it is interpretable by WebSS, then a valid message is given. Else, the Error code returned by XenServer is displayed. Figure 12 - Task Log Screen WSS keeps the sharing information in the Virtual Machine of the XenServer Resource pool itself. There are two ways you can re-use the configuration details of an old WSS appliance into 24 Citrix Systems, Inc.
new WSS appliance. Automated steps 1. Log in to the old WSS appliance portal. 2. Back up the database from the old appliance (Appliance > Backup). 3. Save the file. 4. Import the new WSS appliance into a XenServer 5. Take a snapshot of the new WSS appliance, to quickly revert to the original state in case of upgrade process failure. 6. Log in to new appliance. 7. Go to Appliance > Restore, give the saved file. The new appliance is rebooted and the old configuration details are restored into the new appliance. Note: The configuration details include the pools, users, audit log entries. And it does not include the IP settings, host name of the appliance. For some reasons, if the new appliance is not brought up successfully, then revert to the original state as taken in step 5. and proceed with manual steps. Manual Steps If your existing WSS is AD based authentication, then 1. Import the WSS 1.1.2 appliance. 2. Ensure that this appliance is a unique IP. 3. Add every pool you added in WSS 1.0. 4. Import users accordingly. If your existing WSS is built-in based authentication, then 1. Import the 1.1.2 appliance. 2. Ensure that this appliance is a unique IP. 3. Add every pool you added in WSS 1.0. 4. Create users accordingly. 25 Citrix Systems, Inc.
12. Upgrading the Appliance To upgrade the Web Self Service appliance from version 1.1 to 1.1.2, you will need to import the new appliance into your XenServer pool and migrate the configuration settings of the old appliance to the new one. There are two ways you can migrate the configuration settings of the Web Self Service appliance to the new one. Automated Method 1. Log in to the old WSS appliance portal. 2. Back up the database from the old appliance (Appliance > Backup). 3. Save the file. 4. Import the new WSS appliance into a XenServer. 5. Take a snapshot of the new WSS appliance, to quickly revert to the original state in case of upgrade process failure. 6. Log in to the new appliance. 7. Go to Appliance > Restore, point to the saved file. Now, the new appliance is rebooted and the old configuration details are restored into the new appliance Note: The configuration details include the pools, users, and audit log entries. They do not include the IP settings and host name of the appliance. For some reasons, if the new appliance is not brought up successfully, then revert to the original state as taken in step 5, and proceed with manual steps. Manual Method If your existing Web Self Service uses AD based authentication, then 1. Import the Web Self Service 1.1.2 appliance. 2. Ensure that this appliance gets a unique IP address 3. Add every pool you that was added in Web Self Service 1.0 to the newly imported appliance. 4. Import users accordingly. If your existing WSS uses built-in authentication, then 26 Citrix Systems, Inc.
1. Import the 1.1.2 appliance. 2. Ensure that this appliance gets a unique IP address. 3. Add every pool you that was added in Web Self Service 1.0 to the newly imported appliance. 4. Create users accordingly. 27 Citrix Systems, Inc.