Trubleshting Citrix- Published Resurces Cnfiguratin in VMware Identity Manager VMware Identity Manager SEP 2 0 1 8 V 4
Table f Cntents Overview... 1 Supprted Versins f Cmpnents... 1 Prerequisites... 1 Checkpints fr Integratin Brker Setup... 2 Tips fr a Successful Cnfiguratin... 3 Lg Files... 4 Trubleshting... 4
Overview Integrating Citrix-published resurces with VMware Identity Manager enables yu t prvide VMware Wrkspace ONE users access t their entitled Citrix-published applicatins and desktps. This dcument prvides infrmatin abut trubleshting the cnfiguratin f Citrix-published resurces in VMware Identity Manager. It includes infrmatin abut required prerequisites, checkpints that yu can use fr the Integratin Brker setup, and cmmn prblems and slutins. This dcument supplements the Setting up Resurces in VMware Identity Manager guide, lcated at https://www.vmware.cm/supprt/pubs/identitymanager-pubs.html. Additinal infrmatin: VMware Identity Manager dcumentatin Prviding Access t Citrix Published Resurces in Setting up Resurces in VMware Identity Manager Trubleshting VMware Identity Manager Resurce Cnfiguratin in Setting up Resurces in VMware Identity Manager Release Ntes VMware Identity Manager Prduct infrmatin (click Resurces) Knwledge Base articles Supprt Supprted Versins f Cmpnents Verify that yu are using supprted versins f the varius cmpnents. VMware Identity Manager supprts Citrix XenApp 6.0, 6.5, and 7.x, and XenDesktp 7.x. NOTE: Beginning with VMware Identity Manager 3.3, XenApp 5.x is n lnger supprted. T use Citrix NetScaler, Integratin Brker 2.4 r later is required. T use XenApp r XenDesktp 7.x, Integratin Brker 2.6 r later is required. T use the Citrix StreFrnt API fr applicatin launch, Integratin Brker 2.9.1 r later is required. Supprted perating systems fr the Integratin Brker are Windws Server 2008 R2, Windws Server 2012, Windws Server 2012 R2, and Windws Server 2016. A single Integratin Brker instance can supprt multiple XenApp r XenDesktp 6.x and 7.x envirnments. NOTE: Using the latest available versin f VMware Identity Manager and its cmpnents is recmmended. Prerequisites Verify that these prerequisites are met. /1
If yu are using XenApp r XenDesktp 7.x, ensure that Citrix Studi is installed n the Integratin Brker server. Make sure the relevant Citrix SDKs are installed n the Integratin Brker server t enable Citrix PwerShell Remting. Citrix Versin XenApp r XenDesktp 7.x Requirement Citrix Studi XenApp 6.5 Citrix PwerShell SDK 6.5 XenApp 6.0 Citrix PwerShell SDK 6.0 Nte: If the Integratin Brker cnnects t multiple Citrix versins, install the SDKs required fr all the versins. Verify that Micrsft Visual J# 2.0 64-bit Redistributable Package Secnd Editin is installed n the Integratin Brker server. This is nly required if yu are using the Citrix Web Interface SDK fr applicatin launch, instead f the Citrix StreFrnt API. Verify that the Citrix Web Interface SDK is installed n the Integratin Brker, unless yu plan t use the Citrix StreFrnt API fr applicatin launch. Cllect the Citrix XML FQDN and prt details frm the Citrix Delivery Cntrllers. Als cllect the STA server infrmatin, if applicable. Make sure that the Active Directry users and grups entitled t Citrix-published resurces have already been synchrnized t VMware Identity Manager by the separate directry sync prcess. Make sure the Active Directry users and grups have been assigned t the crrect Delivery Grup in Citrix. If yu select settings t restrict users, make sure that yu specify the Active Directry users r grups. Checkpints fr Integratin Brker Setup If the Integratin Brker is nt set up crrectly, it can prevent the sync and launch f Citrix-published resurces. Integratin Brker setup issues are the mst cmmn cause f sync and launch failures. Verify that the fllwing settings are cnfigured crrectly in the Integratin Brker server. Server Rles: Applicatin Server File Server Web IIS Supprt IIS 6 Management Cmpatibility Verify that Micrsft Visual J# 2.0 x64-bit Redistributable Package Secnd Editin is installed n the Integratin Brker server (required nly if yu are using the Citrix Web Interface SDK). Verify that the required Citrix SDKs are installed. IIS settings: Applicatin Pl: Enable 32-bit set t True /2
Identity set t a user that is a dmain user, has the permissins t enable PwerShell Remting n the Integratin Brker server, and is Read-nly administratr n the Citrix servers NET 2.0 selected NOTE: Ensure that these settings are cnfigured n the applicatin pl that is used fr the Integratin Brker, which may be different frm the Default Applicatin Pl. HTTPS Binding Verify Citrix PwerShell Remting is enabled n the Citrix XML Servers. Verify the setup using the Integratin Brker health check REST API: http://lcalhst/ib/api/restserviceimpl.svc/ibhealthcheck Verify the setup using the XenApp Farm REST API (versin 6.5): http://lcalhst/ib/api/restserviceimpl.svc/hznxenapp/admin/xenfarminf?c mputername=xenfarmserverhstname&xenappversin=versin65rlater Verify the setup using the XenApp Farm REST API (versin 7.x): http://lcalhst/ib/api/restserviceimpl.svc/hznxenapp/admin/xenfarminf?c mputername=xenfarmserverhstname&xenappversin=versin7x If the ReST API fails fr XenApp 7.x, install Citrix Studi if it is nt already installed, and try again. Tips fr a Successful Cnfiguratin Use the fllwing tips t avid cmmn prblems. Certificates are nt required fr prf-f-cncept envirnments but strngly recmmended fr prductin envirnments. VMware Identity Manager des nt rtate certificates. Plan yur strategy fr certificate refreshes accrdingly. In XenDesktp and XenApp 7.9, published applicatins are assigned t users differently than in earlier versins. In earlier versins, yu specified an Active Directry grup r user accunt t gain access t a Citrix resurce. Since versin 7.9, all authenticated users have access t all applicatins by default. T restrict users, a new ptin, Limited Visibility Grup, can be used. Yu add users r grups t the Limited Visibility Grup, and nly thse users will be able t see the applicatins. Ensure that if the Limited Visibility Grup ptin is selected, it cntains users r grups. If it des nt cntain any users r grups, sync t VMware Identity Manager will nt wrk. In XenApp 6.x, yu can publish an RDSH Desktp. When users launch a XenApp 6.x published desktp in VMware Identity Manager, they will nt see the Citrix cnnectin bar at the tp f the screen. If users are expecting t see this bar (based n hw it is cnfigured in Citrix), yu can change the cnfiguratin in VMware Identity Manager t frce the bar t be shwn. 1. Lg in t the VMware Identity Manager cnsle as an admin user. 2. Click the arrw n the Catalg tab and select Settings. 3. Select Citrix Published Applicatin > ICA Cnfiguratin. 4. Enter Cnnectinbar=1 in the ICA Launch Prperties text bx, then click Save. 5. Launch the applicatin again. /3
Lg Files View the fllwing lg files t trublesht prblems with the Citrix-published resurces cnfiguratin: Integratin Brker lg: %prgramdata%/vmware/hriznintegratinbrker Trubleshting Use this infrmatin t trublesht prblems with the sync and launch f Citrix-published resurces in VMware Identity Manager. Viewing Launch Errrs in the Dashbard Yu can trublesht Hrizn, Hrizn Clud, and Citrix resurce launch failures by viewing errr messages abut the rt cause and suggested slutins in the VMware Identity Manager cnsle. 1. In the VMware Identity Manager cnsle, select the Dashbard > Reprts tab. 2. Select Audit Events frm the list f reprts. 3. Set the Type as LAUNCH r LAUNCH_ERROR. 4. Select a time frame and click Shw. Launch f Citrix-published Resurces Fails if XML Prt is Set Incrrectly Prblem: Launch f Citrix-published resurces frm a Citrix 7.x r 6.x server farm fails if the XML Prt is set incrrectly in VMware Identity Manager. Slutin: Ensure that the XML prt is set crrectly. In a XenApp 6.x r earlier envirnment, ask the Citrix administratr t run CTXXMLS.EXE t verify the prt r brwse t the fllwing lcatin within the registry n the XenApp Management server: HKLM/SYSTEM/CurrentCntrlSet/Services/CtxHttp TcpPrt= Verify the prt number. By default the prt is set t 80, but it is cmmnly changed t 8080 r 88. Ensure that the crrect prt is set in the VMware Identity Manager Citrix cnfiguratin in the Catalg > Manage Desktp Applicatins > Citrix Published Applicatin page. Fr XenDesktp 7.x, see https://supprt.citrix.cm/article/ctx127945 fr infrmatin n verifying the XML prt. Ensure that the crrect prt is set in the VMware Identity Manager Citrix cnfiguratin, in the Catalg > Manage Desktp Applicatins > Citrix Published Applicatin page. Citrix Resurce Sync Fails if Limited Visibility Grup Des Nt Cntain Any Users r Grups Prblem: In XenDesktp and XenApp 7.9 and later, if the Limited Visibility Grup setting is selected and if it des nt cntain any users r grups, sync t VMware Identity Manager fails. Slutin: If set, the Limited Visibility Grup must cntain users r grups. 1. Find the actual name f the applicatin by running the fllwing PwerShell cmmands: asnp citrix* Get-brkerapplicatin-brwsername nameofcitrixpublishedresurce 2. In the applicatin detail that displays, lk fr the name f the applicatin. 3. In Citrix Studi, find the applicatin with that name, edit the Limited Visibility prperty, and add users and grups t the list. /4
Sync Issues if Published Applicatins r Desktps in a Site D Nt Cntain Valid Users Prblem: All Citrix-published applicatins and desktps in a Site must cntain valid users. If a user r grup is deleted and that user r grup is nt remved frm a Citrix-published resurce, the Citrix applicatin r desktp shws an rphaned SID. This stps the sync t VMware Identity Manager frm wrking. Yu can use the fllwing API t check the issue: http://citrixbrkerfqdn:80/ib/api/restserviceimpl.svc/hznxenapp/admin/entitleme nts?cmputername=ibfqdn&xenappversin=versinnumber&appname=applicatinname The resulting file cntains empty resurces. Example utput: "[{\"IncludedUsers\":\"DmainName\\\\USERNAME:User$S-1-5-21-1097426297- 1557994628-1672037986-53944:Grup\"}]" Slutin: Ensure that all Citrix-published applicatins and desktps within a Site cntain valid users. Entitlements d nt Appear in VMware Identity Manager Prblem: Entitlements t an applicatin r delivery grup are set n the Citrix server but they d nt appear in VMware Identity Manager. Slutin: Ensure that the users and grups are synced t VMware Identity Manager. 1. Lg in t the Citrix Management Cnsle and lcate the applicatin that des nt have any entitlements. 2. Make a nte f the Active Directry users and grups that have permissins t launch the applicatin in the Citrix Management Cnsle. 3. Lg in t the VMware Identity Manager administratin cnsle, click the Users & Grups tab, and verify that the users and grups appear in the list. Yu can als use the search bx in the tp right f the page. 4. If the users and grups appear, sync Citrix resurces again frm the Catalg > Manage Desktp Applicatin > Citrix Published Applicatin page. Nte: The users and grups must exist in VMware Identity Manager befre yu sync Citrix resurces. If they d nt exist, the sync will run but the entitlements will nt be updated. 5. If the users and grups d nt exist in VMware Identity Manager: a. Check where the users and grups exist in Active Directry (using Active Directry Users and Cmputers Snappin). b. In the VMware Identity Manager administratin cnsle, update the AD Sync DNs fr the users and grups in the directry s Sync Settings pages. c. When the users and grups appear in the VMware Identity Manager administratin cnsle, sync Citrix resurces again. When sync cmpletes, the entitlements appear in VMware Identity Manager. Exceptin During Sync if Applicatin Pl Identity is nt Cnfigured Prblem: An exceptin ccurs during the sync f Citrix resurces t VMware Identity Manager because f a cmmn errr in the Integratin Brker setup, where the Identity setting has been cnfigured fr the wrng applicatin pl. During sync, the fllwing exceptin ccurs in the Integratin Brker lg: IntegratinBrkerLgger Errr 1002 2017-04-04 19:10:38,936 (16) HznXenIntegratinBrker.ApplicatinExceptin.ServiceErrrHandler - Cnnecting /5
t remte server failed with the fllwing errr message: The client cannt cnnect t the destinatin specified in the request. Verify that the service n the destinatin is running and is accepting requests. Cnsult the lgs and dcumentatin fr the WS-Management service running n the destinatin, mst cmmnly IIS r WinRM. If the destinatin is the WinRM service, run the fllwing cmmand n the destinatin t analyze and cnfigure the WinRM service: "winrm quickcnfig". Fr mre infrmatin, see the abut_remte_trubleshting Help tpic at System.Management.Autmatin.Runspaces.AsyncResult.EndInvke(). Slutin: Cnfigure the Identity setting fr the applicatin pl t which the Integratin Brker is attached. This may be different frm the Default Applicatin Pl. T verify the crrect applicatin pl: 1. In IIS Manager, click Applicatin Pls in the left pane. 2. Right-click the applicatin pl and select View Applicatins. 3. Verify that the Integratin Brker appears in the list f applicatins. T cnfigure the Identity setting fr the applicatin pl, fllw the instructins in Setting up Resurces fr VMware Identity Manager. ICA File is Nt Created During Citrix Resurce Launch Prblem: When users try t launch a Citrix resurce, the ICA file is nt created and the fllwing exceptin appears in the Integratin Brker lg: IntegratinBrkerLgger Infrmatin 1004 2017-05-02 11:50:42,093 (8) HznXenIntegratinBrker.API.RestServiceImpl - Get ICA file cntents fr AppNameCitrix.MPS.App.XA65Test.Airwatch Ntepad Test, Farm Name: XA65Test, Server Name:serverName, Username: user1 IntegratinBrkerLgger Errr 1002 2017-05-02 11:50:42,093 (8) HznXenIntegratinBrker.ApplicatinExceptin.ServiceErrrHandler - WebPNBuilder implementatin class WebPNImpl!cm.citrix.wing.webpnimpl.WebPNBuilderImpl nt fund at cm.citrix.wing.webpn.webpnbuilder.getinstance() at HznXenIntegratinBrker.XenAppSDK.Impl.XenAppSDKClient.CreateUserCntext(UserPr incipal userprincipal, String appname, Cnfiguratin cnfiguratin) at HznXenIntegratinBrker.XenAppSDK.Impl.XenAppSDKClient.GenerateICAFileCmmn(Us erprincipal userprincipal, String appname, Cnfiguratin cnfiguratin) at HznXenIntegratinBrker.XenAppSDK.Impl.XenAppSDKClient.GenerateICAFile(UserPrin cipal userprincipal, String farmname, String servername, String serverprt, String appname, XMLServiceTransprtPrtcl xmlservicetransprtprtcl, Int32 sslrelayprt) Slutin: Re-install Micrsft Visual J# 2.0 in the Integratin Brker server. Restarting Integratin Brker If the Integratin Brker fails t respnd, restart IIS. 1. Open the Cmmand Prmpt windw as administratr. 2. Type iisreset. Applicatin Launch n Firefx Requires Users t Allw Citrix Receiver Plugin On Firefx, when users launch a Citrix-published applicatin, they are prmpted t allw the Citrix Receiver plugin: Allw https://identitymanagerhstname t run Citrix Receiver? /6
Users must click Allw Nw r Allw and Remember t launch the applicatin. Disabling Feature Flag fr Citrix Applicatin Launch n Chrme Prblem: Users are unable t launch Citrix applicatins r desktps with the Chrme brwser. Descriptin: Citrix uses NPAPI plugins t launch applicatins and desktps. Hwever, NPAPI plugin supprt was disabled in Chrme versin 42 and later. The feature flag rgusennnpapifrcitrixlaunch was added t VMware Identity Manager t match the Citrix applicatin launch behavir n Citrix Strefrnt. If the feature flag is disabled, the brwser dwnlads the ICA file and when the user clicks it, Citrix Receiver launches the applicatin r desktp. If the feature flag is enabled, the brwser launches the Citrix applicatin r desktp directly n Citrix Receiver using the RECEIVER prtcl. By default, the feature flag is enabled. Slutin: Disable the feature flag if users are unable t launch applicatins r desktps n Chrme. After yu disable the feature flag, the brwser will dwnlad the ICA file and users can click it t launch their applicatin r desktp. T disable the feature flag, 1. Use the fllwing REST API: PUT https://fqdn/saas/jersey/manager/api/tenants/settings?tenantid=tenantname { "items":[ {"name":"rgusennnpapifrcitrixlaunch","value": "false"} ] } with the fllwing tw headers: Cntent-Type applicatin/vnd.vmware.hrizn.manager.tenants.tenant.cnfig.list+jsn Authrizatin HZN value_f_hzn_ckie_fr_admin_user 2. Either wait 24 hurs fr the change t take effect r restart the VMware Identity Manager service. T restart the service n Linux, lg in t the virtual appliance and run the fllwing cmmand: service hrizn-wrkspace restart T restart the service n Windws, run the fllwing script: install_dir\usr\lcal\hrizn\scripts\hriznservice.bat restart Entitlements are Nt Synced t VMware Identity Manager r Sme Entitlements are Missing If Citrix entitlements are nt synced t VMware Identity Manager r sme entitlements are missing, fllw these steps t trublesht the entitlements sync: /7
1. Call the fllwing ReST API: Fr a Citrix server farm 7.x applicatin: http://integratinbrkerserverfqdn/ib/api/restserviceimpl.svc/hznx enapp/admin/entitlements?dmainname&username&passwrd&cmputername =XenFarmServerName&appname=applicatinName&xenappversin=Versin7x Fr a Citrix server farm 7.x delivery grup: http://integratinbrkerserverfqdn/ib/api/restserviceimpl.svc/hznx enapp/admin/deliverygrup/entitlements?dmainname&username&passwr d&cmputername=xenfarmservername&deliverygrupname=deliverygrupna me&xenappversin=versin7x Fr a Citrix server farm 6.5 applicatin: http://integratinbrkerserverfqdn/ib/api/restserviceimpl.svc/hznx enapp/admin/entitlements?dmainname&username&passwrd&cmputername =XenFarmServerName&appname=applicatinName&xenappversin=Versin65 rlater Fr example, if yu are trubleshting entitlements fr the NtePad applicatin n a Citrix 7.x server farm, use: http://integratinbrkerserverfqdn/ib/api/restserviceimpl.svc/hznxena pp/admin/entitlements?dmainname&username&passwrd&cmputername=xenfa rmservername&appname=ntepad&xenappversin=versin7x 2. Check whether the entitlements in the API respnse match the entitlements n the Citrix server. 3. Check whether thse users and grups are synced t VMware Identity Manager. In the administratin cnsle, click the Users & Grups tab t view users and grups. 4. If the users and grups are nt synced t VMware Identity Manager, first perfrm a directry sync and then manually sync the Citrix virtual apps cllectin. Additinal Trubleshting Infrmatin Fr additinal trubleshting tpics, see the Trubleshting VMware Identity Manager Resurce Cnfiguratin sectin in Setting up Resurces in VMware Identity Manager.. /8
VMware, Inc. 3401 Hillview Avenue Pal Alt CA 94304 USA Tel 877-486-9273 Fax 650-427-5001 www.vmware.cm Cpyright 2018 VMware, Inc. All rights reserved. This prduct is prtected by U.S. and internatinal cpyright and intellectual prperty laws. VMware prducts are cvered by ne r mre patents listed at http://www.vmware.cm/g/patents. VMware is a registered trademark r trademark f VMware, Inc. in the United States and/r ther jurisdictins. All ther marks and names mentined herein may be trademarks f their respective cmpanies.