Category Archives: Mobile Application Management

XenApp 7.5 XenDesktop 7.5

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenApp 7.5, XenDesktop 7.5 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENAPPP – xac
FLEXCAST MANAGEMENT ARCHITECTURE – fma
INFRASTRUCTURE-AS-A-SERVICE – IaaS
XENDESKTOP – xd
XENAPP/XENDESKTOP – xad
INDEPENDENT MANAGEMENT ARCHITECTURE – ima
STOREFRONT – sf
HOSTED SHARED DESKTOPS – hsd
VIRTUAL DESKTOP INFRASTRUCTURE – vdi
HOSTED SHARED PUBLISHED WINDOWS APPS – hspwa
RECEIVER FOR WEB – rfw
REMOTE ACCESS – r/a

XenApp 7.5 XenDesktop 7.5 Announcement
Citrix have recently announced XenApp 7.5 which is built upon Flexcast Management Architecture (FMA) and has been available within XenDesktop 7.0, 7.1 within the App Edition license tier. The least releases also brings with it XA hybrid cloud provisioning meaning that SysAdmins now are able to extend there private cloud to IaaS hosted cloud providers (ISP’s) provided they leverage Citrix CloudPlatform which will enable quick scalability and elasticity and without having to learn the ISP’s chosen design, build, provision and management consoles to provision your environment as it’s all integrated into Studio. The announcement can be found at – http://www.citrix.com/news/announcements/jan-2014/citrix-xenapp-7-5-simplifies-windows-app-delivery-for-the-mobile.html and it’s also worth reading up on about the benefits and features of Flexcast technology for XA at – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenapp-datasheet.pdf?accessmode=direct.

What’s New & Different in XenApp 7.5 from XenApp 6.5?
0: Check out – http://support.citrix.com/proddocs/topic/xenapp-xendesktop-75/cds-previous-xa-admins.html#previous-xa-admins.

What’s New & Highlights of XenApp/XenDesktop (XAD) 7.5
1: The platform architecture is now powered by FMA and not Independent Management Architecture (IMA) anymore thus providing enhanced scalability and ease of management through two consoles Studio which is used for deign, building, assigning polices and resources to users and Director which is used for management of user support & troubleshooting.
2: StoreFront 2.5 is included within XenApp and XenDesktop 7.5 app binaries and includes a number of new enhancements including an updated HTML5 Receiver, SDK to apply organisational logic if required and much more.
3: Support for Web Interface (WiF) 5.4 on supported Windows Server OSes.
4: AppDNA is included in Platinum edition.
5: Virtual Graphical Processing Unit (vGPU) and GPU support for supported Windows Desktop & Server OSes.
6: Support for Windows Server 2012 R2 and Windows 8.1 in addition to current supported OSes in XenDesktop 7.0, 7.1.
7: The Citrix Profile management 5.0 is installed silently by default on master images when the Virtual Delivery Agent is installed (Note: You do not have to use Citrix profile management solution).
8: Support for IPv4, IPv6 or dual-stack (IPv4/IPv6) environments from clients to core components.
9: MCS support for Microsoft Key Management System (KMS) activation.
10: For a complete list please check out – http://support.citrix.com/proddocs/topic/xenapp-xendesktop-75/cds-75-about-whats-new.html and also review the XA 7.5 data sheet at – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/xenapp-datasheet.pdf.

Synergy SYN405: Best Practices for Implementing Administering and Troubleshooting Xendesktop 7.5

Pre-requisites, Understanding & How-to Install XenApp 7.5 and enable R/A for your PoC or Custer Demo Environment (DRAFT & MAY CONTAIN ERROR(S))
Coming soon!

ShareFile StorageZone Controller 2.2

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test ShareFile StorageZone Controller 2.2 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
STORAGEZONE CONTROLLER – szc
CERTIFICATE SIGNING REQUEST – csr
SHAREFILE – sf
FULLY QUALIFIED DOMAIN NAME – fqdn
SECURE LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL – (s)ldap
CERTIFICATE – cert
COMMON INTERNET FILE SYSTEM – cifs
XENMOBILE APPCONTROLLER – xac

What’s New
1:This release coupled with prior versions now integrates both the Storage Center and Controller server software packages into one unified software package now called the “ShareFile StorageZone Controller 2.2”.
2: Access your organisations trusted existing or new network CIFS shares and SharePoint sites via a ShareFile On-Prem SZC which always users to securely connect via a FQDN over 443 (HTTPS) this ensuring secure and encrypted communication between the users device and the On-Prem SZC. It is worth mentioning that your organisations datasets do not traverse the ShareFile Control Plane in any way ref – http://support.citrixonline.com/en_US/ShareFile/all_files/SF090015.
3: ShareFile also introduced an EMEA Control Plane for organisations to meet local, regional and geo requirements and or restrictions one basic example could be Safe Harbor – http://export.gov/safeharbor/ as well as preferring to have localised data centre’s within the EU to manage and handle user requests and more. Note this feature was already widely available prior to this WordPress post/blog entry.
4: For information regarding what else is new please check out – http://support.citrix.com/proddocs/topic/sharefile-storagezones-22/sf-storagezones-about-22.html.

ShareFile Security Whitepaper PDF
http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/sharefile-enterprise-security-whitepaper.pdf

Synergy SYN310: Deep Dive into ShareFile Enterprise Functionality

Deploying an On-Prem SZC (DRAFT & MAY CONTAIN ERROR(S))
1: Initially would suggest that your read/review the following CTX Article – http://support.citrix.com/article/CTX138041 and http://blogs.citrix.com/2012/03/19/saml-authentication-with-sharefile-using-ad-fs-2-0/ which covers numerous technical FAQ and may answer a number of your questions.
2: Setup a ShareFile Enterprise Account and request that On-Prem SZC be enabled against your account when setting up your account or if you already have one request that SZC be enabled by sending a email to ShareFile support – http://www.sharefile.com/company/contact-us.aspx and online help & support including videos is available at – http://support.citrixonline.com/sharefile. Verify that StorageZones are available under the Admin tab when you sign into your ShareFile sub-domain e.g xendc.sharefile.eu or axendatacentre.sharefile.com prior to continuing with the installation and configuration.
3: Prepare a Windows Server 2008 R2 and install IIS (include dependencies ASP, Basic Authentication if you want to connect to existing network shares for a PoC).
4: Setup and configure your external DNS A record e.g sharefile.axendacentre.com or sf.thedurbannatal-sharks.co.za and ensure that you can successful connect to the default IIS page on TCP Port 80.
5: Generate a CSR on the intended ShareFile On-Prem SZC for your FQDN and sign it with an external CA e.g http://www.verisign.co.uk or http://www.thawte.com e.t.c. Your are required to use an external CA as IIS self-signed or Enterprise CA certificates are not permitted and will not work with the ShareFile Control Plane. Download and install the cert response from your chosen external CA and Complete The Certificate Response in IIS.
6: Once the cert is successfully imported bind it to HTTPS (443) and the restart IIS and navigate to the FQDN via HTTPS externally to ensure that you can connect to it without any SSL cert mismatches, errors e.t.c
7: * Create a ShareFile service account within and assign full r/w access it to the intended On-Prem SZ folder located either on the local disk or secondary disk of the VM or remotely. Please do the same for your PoC Shared Area that you intend to access as an existing network share.
8: *Install the ShareFile Storage Zone Controller 2.2 software package and leave the checkbox to launch the Configuration Web Page. Once the page launches sign in with your Super Admin ShareFile Admin access details.
9: Follow the onscreen instructions which are fairly self explanatory however should you require any further help & support re the exact requirements please navigate to – http://support.citrix.com/proddocs/topic/sharefile-storagezones-22/sf-install-storagezones.html and http://support.citrix.com/proddocs/topic/sharefile-storagezones-22/sf-manage-connectors.html.
10: Please stop and ensure that you safely backup the SCKeys.txt file within the root of On-Prem SZ CIFS share to a alternative and secure location that is also backed up.
11: Provision a test user that resides within your domain and has also been created within the ShareFile Control Plane. For help with setting up users please take a look at – .
12: Ensure that your test user has permission to your intended CIFS Shared Area e.g your SZC that you setup and configured within the ShareFile Control Plane.
13: Now that you have successfully setup and configured your On-Prem SZ and SZC proceed to download a ShareFile mobile app from e.g iTunes – iPad https://itunes.apple.com/gb/app/sharefile-for-ipad-by-citrix/id440596621?mt=8, iPhone https://itunes.apple.com/gb/app/sharefile-mobile-by-citrix/id434391375?mt=8 or Google Play – https://play.google.com/store/apps/developer?id=ShareFile+by+Citrix&hl=en_GB. Once downloaded enter in your test users account details and test uploading and downloading a picture taken from within the ShareFile iOS app as an example.
14: Once you test that your On-Prem SZ

SZ Controller Management
This eDocs node will help you to proactively manage your On-Prem SZ Controller environment covering on to add/remove controllers for H/A as well as how-to promote, demote and disable SZ Controller – http://support.citrix.com/proddocs/topic/sharefile-storagezones-22/sf-manage-storagezone-controller.html. These eDoc articles are essential for the ongoing management and routine scheduled maintenance task(s).

Two-Step Verification = Stronger Security
http://support.citrixonline.com/en_US/sharefile/help_files/SF060010?title=Two-Step+Verification

Mobile Device, Application and Information Management

Leave a Reply

The following content is a brief and unofficial article about Mobile Device, Application and Information Management. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
MOBILE DEVICE MANAGEMENT – mdm
MOBILE APPLICATION MANAGEMENT – mam
MOBILE INFORMATION MANAGEMENT – mim
MOBILE APPLICATION PERFORMANCE MANAGEMENT – mapn
ACTIVE DIRECTORY – ad

What is MDM?
It’s the capability to restrict the services and mobile applications provided by a mobile platform only e.g disabling of Siri on iOS, Chrome on Android via MDM API’s provided by the mobile OS. To achieve these capabilities and many more a MDM server e.g XenMobile Device Manager will request a mobile device to securely authenticate via a agent installed on the mobile OS e.g Citrix Enrol with a users organisational access details which will then present or rather enable the user to proceed with the MDM enrolment process i.e securely
downloading (HTTPS) and installing a secure organisation profile and MDM policies enforced by IT which effectively will restrict the devices capabilities to access mobile applications of the mobile OS or disable services e.g Disable Siri from been available when a iPhone or iPad is locked but when the user of the iOS device safely unlocks the iPhone or iPad with a pin code they can use Siri.

What is MAM?
It allows and enables your organisation to deliver safe and secure applications from your organisations data centre. This applications can be native mobile apps (iOS, Android), SaaS and Windows published applications which can now be repurposed with the Windows Mobile SDK – https://www.citrix.com/go/mobile-sdk-for-windows-apps.html and http://www.citrix.com/mobilitysdk/docs/videos/RapidStarts.htm to improve the users experience on a mobile device (iOS). As these are logical resources published or delivered and installed on an mobile device you can only lock the resources, perform a selective wipe or perform an erase of the data within the mobile apps (Published apps you simple disable that surest access via AD).

What is MApM?
It’s an acronym for essentially describing the ability to provide intelligent reporting against mobile apps via an agent on smart devices.

What is MIM?
It provides organisations the ability to take their trusted data held within internally only accessed Shared Areas, SharePoint sites e.t.c and allows organisational employees or 3rd parties i.e contractors the ability to download and potential edit office based documents, watch videos on corporate issued or BYO devices on or offline in a safe and secured environment with the ability to perform a wipe, lock or configure a poison pill against the organisational trusted data that is stored on the users device(s).

XenDesktop 7

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenDesktop 7 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
REMOTE DESKTOP SERVICES – rds
VIRTUAL DESKTOP INFRASTRUCTURE – vdi
VIRTUAL DELIVERY CONTROLLER – vda
VIRTUAL GRAPHICS PROCESSING UNIT – vgpu
SERVICE LOCATION – srv

What is and does it do?
Citrix XenDesktop 7 allows you to deliver Remote Desktop Services (RDS), Virtual Desktop Infrastructure (VDI) workloads and secure remote access to an existing PC estate by installing the Virtual Delivery Agent (VDA) into those existing PC’s. All this capability is enabled from one single common architecture – FlexCast Management Architecture (FMA). If you are a Citrix XenApp 5.0, 6.5 Administrator I would encourage you to read through the following Citrix eDoc article – http://support.citrix.com/proddocs/topic/xendesktop-7/cds-overview-info-previous-xa-customers.html and follow on with this free Citrix 2 hour long course covering XenDesktop 7 weather your sales, pre-sales, sysadmin or engineer its useful in getting your mindset ready for XenDesktop 7 – http://training.citrix.com/mod/ctxcatalog/course.php?id=595.

Citrix TV & YouTube Videos To Watch
SYN320: XenDesktop 7: What You Should Know About FlexCast Management and XenApp Migration
– http://www.citrix.com/tv/#videos/8493.
Citrix XenDesktop 7 3D Pro Demonstration – http://www.citrix.com/tv/#videos/9008.
XenDesktop 7 Masterclass – http://www.youtube.com/watch?v=XSFJ0xx7ztY.

XenDesktop 7 Handbook
Check out the blog article announcement – http://blogs.citrix.com/2013/10/10/new-xendesktop-7-handbook-published. You download the XenDesktop 7 Handbook directly at – http://support.citrix.com/article/CTX139331 and the XenDesktop 5.x Handbook at – http://support.citrix.com/article/CTX136546.

Components of XenDesktop 7 Explained
1: Studio is allows you to design and build your RDS, VDI workloads.
2: Director allows you to support and monitor your organisations XenDesktop 7 virtual machines, user sessions via MS RemoteAssistance, historical trending & metrics, network analytic’s if you have a NetScaler.
3: Delivery Controller is responsible for brokering the connections to your servers (ICA/RDS), virtual machines (VDI) or existing workstation PC’s.
4: Citrix Licensing Server is responsible for checking in/out of your FlexCast licenses. XenDesktop 7 requires CLS 11.11.
5: StoreFront provides users with a self-serve AppStore to tab to click to add your Windows hosted apps, hosted shared desktops (Windows Server 2008 R2) or VDI desktops (Windows 7,8).
6: Machine Creation Services (MCS) is built into XenDesktop 7 which enables as allows you to provision virtual machines from your master VM images. All you need to do to configure it is to input either XenServer, Hyper-V (Requires SCVMM) or ESX (Remember to trust the root certificate) hypervisor FQDN and the access details.
7: Provisioning Services (PVS)
8: User Profile Manager 5 (UPM) is built into XenDesktop 7 and provide Citrix’s profile management solution.
9: MS SQL is required to store configuration information and details about your XenDesktop 7 site. MS SQL express, standard, enterprise and data center* editions are supported and for H/A configuration options please visit this eDocs article at – *http://support.citrix.com/proddocs/topic/xendesktop-7/cds-sys-requirements.html.
10: Virtual Delivery Agent (VDA) is responsible for delivering a hosted shared desktop, windows hosted app and VDI desktop to users brokered via the Delivery Controller.

What Editions Are Available? VDI, App (XenApp capabilities e.g delivery of RDS workloads) , Enterprise and Platinum. To compare the feature sets of edition please check out – http://www.citrix.com/go/products/xendesktop/feature-matrix.html. At the time of writing this post you are required to login to Citrix.com with your access details.

Setup & Configure nVidia GRID VIRTUAL GPU (vGPU) on Citrix XenDesktop 7.1
To learn how-to setup and configure a test demo or PoC environment to leverage the vGPU capabilities of XenServer 6.2 and XenDesktop 7.1 Tech Preview check out – http://www.nvidia.co.uk/object/grid-virtual-gpus-uk.html. You can download the XenDesktop 7.1 Tech Preview at – and the system requirements can be found at – http://support.citrix.com/proddocs/topic/xendesktop/cds-xendesktop-71-landing-page.htm and the HDX system requirements please check out – http://support.citrix.com/proddocs/topic/xendesktop-71/hdx-enhance-ux-xd.html.

NVidia Resources
XenApp 6.5 GPU Sharing – http://www.nvidia.co.uk/object/grid-xenapp-uk.html.
XenDesktop vGPU – http://www.nvidia.co.uk/object/grid-xen-desktop-uk.html.

Multi-Site Configurations & High Availability
Coming soon! I will cover multiple data centres and sites and how-to enable and ensure H/A access to your published resources if you lost/lose communication with your XenDesktop 7 delivery controller(s) and the pitfalls. I would strongly recommend your environment is N+1 and with VM’s common these days setting and configuring an N+1 environment should be best practise for H/A, business continuity and DR.

How-to Enable Local App Access
Coming soon! However in the mean time please refer to http://support.citrix.com/proddocs/topic/xendesktop-7/laa-configure-enable.html#laa-enable.dita.

XenDesktop Introduction Training Course CXD-102
Citrix training offers a 2 hour introduction course to XenDesktop 7 for free. The course is available at – http://training.citrix.com/mod/ctxcatalog/course.php?id=595.

Howto Configure Email Based Discovery& Why It’s Important
Configuration of email based discovery using SRV records is simple and greatly enhances the users login experiences as they all know there email addr and domain password much like logging into Facebook, Twitter e.t.c so offering the same login user experience weather users are in or outside or the organisation means they don’t need to remember logging in with the following format domain\username and domain password they can simple use there corporate email addr and domain password.

There is a great Citrix blog article that covers covers configuration of e-mail based discovery in and outside of your organisation leveraging a NetScaler Gateway check out – http://blogs.citrix.com/2013/04/01/configuring-email-based-account-discovery-for-citrix-receiver/.

The process below is for configuration of SRV records within a trusted corporate environment. If you would like to know more about what else you can configure in terms of SRV records check out – http://en.wikipedia.org/wiki/SRV_record, http://technet.microsoft.com/en-us/library/cc961719.aspx (A Windows 2000 article but will get you thinking if your new to SRV records) and howto add other resources records into your organisations DNS – http://technet.microsoft.com/en-us/library/cc772362.aspx.

1: Launch your Microsoft DNS management console
2: Right click on your organisations Forward Lookup Zone that contains the StoreFront FQDN
3: Click “Other New Records”
4: Scroll down and select “Service Locaiton (SRV)” and click “Create Record”
5: Your organisations domain should already be pre-populated e.g citrix.lab or axendatacentre.com
6: Type in “_citrixreceiver” in the Service feild
7: Type in “_tcp” in the Protocol field
8: Type in “443” in the Port number field or 80 if you don’t use 443 internally
9: Type in “storefront.domain” in the Hosting offering this service e.g storefront.axendatacentre.com or storefront.axendc.local
10: Save/Commit the changes and close the current active window in DNS
11: Navigate to physical or virtual machine install and launch Citrix Receiver when prompted enter in your email addr and password when prompted.

Troubleshooting
Open up a Windows Command prompt and execute these two commands below and for more information in validating your SRV records check out – http://support.microsoft.com/kb/816587.

1: Type in “ipconfig /flushdns”
2: Type in “nslookup”
3: Type in “set type=srv”
4: Type in “_citrixreceiver._tcp.domain” e.g _citrixreceiver._tcp.axendatacentre.com

Microsoft Windows Server 2012 R2 & Windows 8 Support
http://blogs.citrix.com/2013/10/08/citrix-xendesktop-with-flexcast-management-architecture-adds-support-for-windows-server-2012-r2-and-windows-8-1/.

More coming soon!
In the mean time check out https://www.citrix.com/products/xendesktop/overview.html and Design Guide: Mobilising Windows Apps (Requires Form Input From Citrix)

XenMobile Device Manager 8.5

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile Device Manager 8.5 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE DEVICE MANAGER – xdm
CERTIFICATE SIGNING REQUEST – csr
APPLE PUSH NOTIFICATION SERVICE – apns
FULLY QUALIFIED DOMAIN NAME – fqdn
LIGHTWEIGHT DIRECTORY ACCESS PROTOCOL – ldap
CERTIFICATE – cert
STORAGEZONE CONNECTOR – szc
XENMOBILE APPCONTROLLER – xac

Apple iOS 7 Support
You will need to apply Citrix’s iOS7 patch for XenMobile Device Manager 8.5 otherwise users attempting to enroll there BYO or Corporate iOS devices will receive the following Server ErrorCould Not Connect 500 reference – http://support.citrix.com/article/CTX139106. The patch and how-to apply it can be downloaded at – http://support.citrix.com/article/CTX139052.

Apple APNS
1: If you do not have a Apple ID for your organisation click here to create one – Apple ID https://appleid.apple.com/cgi-bin/WebObjects/MyAppleId.woa/wa/createAppleId?localang=en_US. I would suggest creating an external e-mail addr that is bound to the XenMobile or XDM domain service so that multiple SysAdmins within your organisation have access to the APNS portal to issue and or renew your APNS certificates which expire annually upon the date that they where issued. I would also suggest that if your ticketing system support auto generation of a support ticket annually to utilise this feature to generate a new ticket annually to notify support and have the ticket assigned to be actioned to eventually be renewed and uploaded to the XDM web ui console at http://FQDN/zdm.
2: Once you have created your Apple ID generate a CSR on the intended XDM server via IIS
3: Submit to Citrix to sign and they will return a *.plist file as a response.
3: Login with your newly created Apple ID to Apple APNS Portal – https://identity.apple.com/pushcert/.
4: Upload your signed CSR from Citrix (*.plist response) which then generate a *.pem certificate file.
5: Import the *.pem certificate response from APNS into IIS using complete certificate request then export from IIS filling in the password fields.
6: Delete the certificate in IIS.
7: Remove the IIS role and restart your XDM. The XDM installation installs Tomcat which clashes with IIS which is why we uninstall the IIS role prior to the XDM installation.

TCP Ports
1: The following TCP ports are required to enable the XDM to achieve device enrollment, retrieve mobile apps from external App Stores e.g Apple iTunes – https://itunes.apple.com/gb/genre/ios/id36?mt=8, Google Play Store – https://play.google.com/store?hl=en_GB and Samsung Apps – http://apps.samsung.com/venus/main/getMain.as?COUNTRY_CODE=GBR and much more.

80 – HTTP
443 – HTTPS
8443 – Secure
2159 – Apple APNS
2156 – Apple APNS
5223 – Apple Over the air WiFi enrollment
2: Troubleshooting Apple APNS – http://support.apple.com/kb/TS4264, http://support.apple.com/kb/HT3576

FQDN or Public Static IP Address
1: When installing the XDM which is the better option to use? A FQDN e.g http://axendatacentre.com/zdm or an IP addr: http://127.0.0.1/zdm? A FQDN provides the flexibility to move the XDM server between ISP’s as you always lose your IP addr range when moving from one ISP to another as all you need to do is adjust the DNS records to point to the new IP addr provided by your new ISP and the Tomcat CA remains unaffected and can still issue device certificates during enrollment.
2: If you did choose an IP addr over an FQDN and you moved the XDM to another static IP addr you would need to reinstall the XDM as the Tomcat CA would no longer be valid and able to issue device certificates.

Adding An iOS Public App
1: Search for iTunes WordPress as an example
2: Click on the first link in your search results which will typically direct you to the iTunes web page preview of the iOS mobile app e.g – https://itunes.apple.com/gb/app/wordpress/id335703880?mt=8.
3: Now make sure it’s that mobile app that you wish to add to the XDM software repository and copy the link.
TIP: You know the URL is valid as it always ends in ?mt=8
4: Login to the XDM admin console e.g https://FQDN/zdm and click the Applications tab.
5: Click new External iOS app
6: Copy and paste the URL and click GO thereafter it will contact the iTunes web page and collect an image, product name and description.
7: Select or Deselect any of the available check boxes , then click Create.
8: Navigate to the Deployment tab
9: Click the iOS base package or create an apps package for external apps give it a name, select the users then under resources select push apps and select WordPress now click finish.
10: You can click to deploy that updated deployment package or wait for iOS devices to connect back to the XDM whereby they will be notified of an update to external app package and imitate the trigger to prompt the user to download the WordPress iOS mobile app from iTunes (Remember the user will put in there iTunes password prior to it downloading).

Configuring An External Enterprise CA
Coming soon! In the meantime check out – http://support.citrix.com/proddocs/topic/xmob-dm-85/xmob-dm-manage-securityid-configcert-ssl-tsk.html

XenMobile 8.5 Support Articles
General Support – http://support.citrix.com/product/xm/v8.5/
XenMobile Device Manager 8.5 Release Notes – http://support.citrix.com/article/CTX138116
XenMobile Device Manager 8.5.0 Patch for iOS 7 Compatibility – http://support.citrix.com/article/CTX139052
FAQ – Worx Home for Mobile Devices and MicroVPN Technology – http://support.citrix.com/article/CTX136914
Device Manager Web Services – http://support.citrix.com/article/CTX138803
XenMobile Enterprise Reference Architecture for XDM8.5, XAC2.8, SCZ 2.0 – http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/reference-architecture-for-mobile-device-and-app-management.pdf

More coming soon!
In the mean time check out the Admin Guide at – http://support.citrix.com/proddocs/topic/xmob-dm-85/xmob-dm-intro-wrapper-con-85.html and download the software package at – http://www.citrix.com/downloads/xenmobile/product-software/xenmobile-85-mdm-edition.html

StoreFront 2.0

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test StoreFront 2.0 prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
STOREFRONT SERVICES – SFS
FULLY QUALIFIED DOMAIN NAME – fqdn
NETSCALER ACCESS GATEWAY – nsag
NETSCALER GATEWAY – nsg
CERTIFICATE – cert

Certificates
1: What type of certificate do you require for your SFS deployment depends upon weather the server is (a) internal only (b) deployed in-line with the AppController internally (c) deployed in the DMZ (d) deployed in-line with the AppController fronted by a nsg.
2:Another important consideration re what certificate to use includes weather you have an Enterprise CA with in your organisation to sign your CSRs or do you use self-signed certificates or do you generate and publicly sign your certificates (standalone or wildcard) externally?

StoreFront 2.0 Overview
1: StoreFront is replacing Web Interface 2015 ref Bitly link to Citrix EOL web page indicating WIF EoL. Why? StoreFront is the next generation platform which provides a great and seamless user experience across any type device supporting Citrix Receiver. StoreFront aggregates Windows & Mobile Apps*, Desktop, Web-links, SaaS and can with a single click can propagate configurations changes between all the StoreFront servers within your environment.
2: No more MS SQL database requirements with the SFS 2.0 release.
3: Improved login performance.
4: Bind your SSL certificate within IIS prior to installing or configuring SFS 2.0 and remove HTTP unless required to OS harden your SFS server. By binding the SSL cert prior to configuration of SFS it will ensure that the configuration wizard uses HTTPS over HTTP. In addition where possible use your organisations Enterprise CA to sign your StoreFront servers CSR instead of using the self-assigned SSL certificate option to generate a SSL cert in IIS as this will causes secure (SSL) communication issues between SFS and the delivery controller(s) if using HTTPS and when you attempt to access published resources from the configured delivery controller the resources will not be available as the servers cannot successful communicate with one another over HTTPS.
5: Beacons enable Citrix Receiver to understand intelligently wether a user is connecting to your organisations Citrix resources is internally or externally, by attempting to access the internal or external SFS FQDN’s within the StoreFront MMC snap in e.g storefront.axendatacentre.local (Internal) or sfs.axendatacentre.com (External and resolvable).
###
* Worx Home is now responsible for the delivery or mobile apps delivered via the XenMobile AppController 2.8
###
6: This Citrix blog article sums up the Receiver for HTML 5 – http://blogs.citrix.com/2012/08/31/receiver-for-html5-is-now-available/ and you can learn how-to install and configure it at – http://support.citrix.com/proddocs/topic/receiver-html5-11/receiver-html5-install.html.

Subscription Database Where Is It?
The release of Citrix StoreFront 2.0 from 1.2 brought with it a change in where and how follow-me apps subscription data is stored. Historically this was stored in an MS SQL database in 1.2 now this data is actually stored in a EDB file check out. – http://support.citrix.com/article/CTX139037 which is automatically replicated if a SFS cluster. You can also adjust the subscription synchronising period by following this eDocs article which requires some PoSH cmdlets – http://support.citrix.com/proddocs/topic/dws-storefront-20/dws-configure-ha-sync.html.

Customising Receiver for Web
This blog article goes into great detail about to customise Receiver for Web from the logos, background image, connecting from IP addr of the user to adding in additional elements e.g click here to contact your IT Helpdesk. Check it out at – http://blogs.citrix.com/2013/06/26/customizing-receiver-for-web-in-storefront-2-0/.

HTML 5 Receiver Configuration & Support
Coming Soon!

Citrix StoreFront 2.0 – Implementation Guide
http://support.citrix.com/article/CTX133185

XenMobile AppController 2.8

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test XenMobile AppController 2.8 ( Previously Cloud Gateway) part of Citrix XenMobile Enterprise prior to deploying in a PoC, Pilot or Production environment by the author of this entry.

Shortened Names
XENMOBILE APPCONTROLLER – xac
FULLY QUALIFIED DOMAIN – fqdn
CLOUD GATEWAY – cg

XenMobile Is Federal Information Processing Standard (FIPS) 140 Compliant
Check out – http://support.citrix.com/proddocs/topic/apppreptool/clg-appwrap-fips-con.html.

Certificates
1: By default the following two types of self-assigned certificates are issued to your XenMobile AppController upon initial deployment which are a Server, SAML certificates issued to the FQDN AppController.example.com.
2: It is safe to perform the initial xac with the default certificates thereafter I would recommend generating a CSR and signing with your Enterprise CA vs. self-assigned to the host name.

Self Assigned Certificate
1: To create a self assigned certificate directly on XenMobile AppController login to the admin console at – https://FQDN:4443 using your access details and once authenticated
2: Click Settings
3: Click Certificates
4: Click New and complete onscreen input fields the primary fields are to select certificate cipher encryption strength to be 2048 nothing less, then enter in the common name for cert e.g appcontroller.yourorganisation.net or xac.natal-sharks.local and select the correct country.
5: Click Save
6: Next the Certificate Signing Request will appear click Close
7: Click to highlight the certificate with common name entered in above
8: Click Self-Signed
9: Enter in a value for which the certificate will be valid in number of days e.g 365 for a full calendar year and click Save.
10: Your CSR has now been self assigned.
11: Click to highlight it again and click Make Active
12: Click Yes and the newly self-assigned certificate will be bound to HTTPS and log you out which is normal.
13: Clear your internet browsers cache on IE as an example and restart the browser and navigate back to xac admin console and you should notice that there is no SSL certificate errors and the lock icon has a blue background. You have successfully created and bound a self assigned certificate to your xac.
14: For further information please read the following – eDocs Certificate Signing Request for the XenMobile AppController 2.8 .

Enterprise CA signed Certificate
1: Complete steps 1 through 5 under the self-assigned certificates.
2: When the Certificate Signing Request box appear’s copy the CSR response generated into a text file and save to your desktop and click Close.
3: Navigate to your Enterprise CA’s FQDN and follow the onscreen instructions and complete the CSR and ensure that you download the certificate response in Base64 format.
4: Navigate back to the XAC Click Import and select Server (.pem) and select your certificate and Click import.
5: If your certificate has a public and private key (*.pfx12) enter in the password in the password fields or leave blank and the Click Ok.
6: Your signed certificate is now imported successfully.
7: Click to highlight your newly import server certificates and click Make Active.
12: Click Yes and the newly signed certificate will be bound to HTTPS and you be logged out which is normal.
13: Clear your internet browsers cache on IE as an example and restart the browser and navigate back to xac admin console and you should notice that there is no SSL certificate errors and the lock icon has a blue background. You have successfully created and bound a self assigned certificate to your xac.

XenMobile AppController 2.8
1: Download the virtual appliance for your platform at – https://www.citrix.com/downloads/xenmobile.html .The supported hypervisors include XenServer, Hyper-V, ESXi
2: Designate and document a FQDN (Optionally create either an Internal or External), IP address, subnet netmask, default gateway, DNS, NTP, AD including a domain services account + e-mail address and strong admin password.
3: Deploy the xac virtual appliance and access the xac console and login using the default access details which are username: admin and password: password.
4: Click 0 and press return/enter to enter the Express Setup mode and complete the required configuration steps onscreen and then Click 5 and press return/enter to reboot the xac.
6: Once the xac reboots open up your internet browser and navigate to the designated https://FQDN:4443 and login using default access details mentioned above.
7: Upon login complete the onscreen wizard. Please note that some of the configuration options will already be prep-populated from your entries entered in at the xac console in Step 4 above. Once completed you will be logged out which is normal.
8: Relogin to the xac and complete either the self-assigned or Enterprise CA signed certificate process.

Multi-Domain Support
Currently the XenMobile AppController 2.8 doesn’t support multi-domain domains e.g multiple LDAP(S) bindings to more than one domain. The following Citrix Blog article is however quiet a useful when leveraging a NetScaler Gateway “Implementing cascading LDAP policies along with universal domain groups” Text in brackets credit of the author of the Citrix Blog Entry –

XenMobile Enterprise (XAC 2.8, XDM 8.5, SCZ 2.0) Reference Architecture
http://www.citrix.com/content/dam/citrix/en_us/documents/products-solutions/reference-architecture-for-mobile-device-and-app-management.pdf

Coming soon!
In the mean time check out the eDocs supporting documentation re XenMobile
AppController 2.8 edocs.citrix.com, WorxMail and WorxWeb.

Citrix MDX Technologies

Leave a Reply

The following content is a brief and unofficial article about Citrix’s MDX Technology. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE APPCONTROLLER – xac
FULLY QUALIFIED DOMAIN NAME – fqdn
XENMOBILE DEVICE MANAGER – xdm

What is and does Citrix MDX mean for wrapped iOS, Android mobile apps

Digital Signing (Wrapping) *.IPA, *.APK App Binaries To Become MDX Enabled
Coming soon! In the mean time check out Signing Android mobile apps – http://support.citrix.com/proddocs/topic/apppreptool/clg-appwrap-android-wrap-app-tsk.html, iOS mobile apps – http://support.citrix.com/proddocs/topic/apppreptool/clg-appwrap-ios-wrap-app-tsk.html.

MDX Vault
The MDX Vault technology essential provides a logical safe and secure sandboxed container within an iOS, Android platform on a device.

MDX InterApp
The MDX InterApp technology essential allows or denies other public delivered mobile apps (iTunes, Google Play) on a device access to communicate with a MDX digitally signed mobile only if allowed e.g communication for the signed MDX mobile app is set to unrestricted. How if the MDX mobile
app delivered from the XenMobile AppController is set to restricted the SysAdmin or MobilityAdmin would need to specific what mobile apps the MDX mobile app is able to communicate and share information with on the mobile device.

MDX Access
The MDX Access technology essential provides safe, secure access to internal intranet resources within your trusted network from any where in the world connected via optionally 3G, 4G & Edge mobile or wired/wireless public and untrusted networks. The technology requires a Citrix NetScaler Gateway if want to know how it works check out – http://www.citrix.com/products/netscaler-gateway/how-it-works.html. You can easily deploy a NetScaler Gateway solution utilising release 10.1+ which includes wizards – http://blogs.citrix.com/2013/07/03/citrix-netscaler-gateway-10-1-118-7-quick-configuration-wizard/.

XenMobile FIPS 140 Compliance
http://support.citrix.com/proddocs/topic/apppreptool/nl/ru/clg-appwrap-fips-con.html?locale=en

XenMobile AppController 2.6

Leave a Reply

The following content is a brief and unofficial prerequisites guide to setup, configure and test AppController 2.6 (Previously Cloud Gateway) part of the Mobile Solutions Bundle prior to deploying in a PoC, Pilot or Production environment by the author of this entry. The views, opinions and concepts expressed are those by the author of this entry only and do not necessary conform to industry descriptions or best practises.

Shortened Names
XENMOBILE APPCONTROLLER – xac
FULLY QUALIFIED DOMAIN NAME – fqdn
ACTIVE DIRECTORY – ad
STOREFRONT SERVER – sfs
HIGHLY-AVAILABLE – h/a
XENAPP – xa
XENDESKTOP -xd
NETSCALER GATEWAY – nsg
SOFTWARE-AS-A-SERVICE – SaaS
REMOTE ACCESS – r/a

Apple iOS Developer Account
1: Register for an Apple Enterprise iOS Developer Account and NOT Standard – bit.ly link to https://developer.apple.com/programs/ios/enterprise/. Why your probably asking? The enterprise account is designed to allow you to deliver your digitally signed wrapped apps e.g Worx Home, WorxWeb and WorxMail to an unlimited number of iOS devices from your enterprise app store e.g XAC. The standard account is designed for you to develop and then test your app to a fair number of iOS devices (iPad mini, iPhone) and then publish your app to the iTune’s AppStore.
2: Download the Citrix App Preparation Tool for iOS – http://www.citrix.com/downloads/
3: Prior to continuing please review review the following Citrix eDocs article – http://support.citrix.com/proddocs/topic/cloudgateway/clg-appwrap-landing-page-con.html
4: Following the instructions for digitally signing your iOS app using the Citrix App Preparation Tool for iOS

Certificates
1: By default the following two types of self-assigned certificates are issued to your XenMobile AppController upon initial deployment which are a Server, SAML certificates issued to the FQDN AppController.example.com.
2: It is safe to perform the initial xac with the default certificates thereafter I would recommend generating a CSR and signing with your Enterprise CA vs. self-assigned to the host name.

Uploading & Configuring Wrapped iOS Apps
1: Once the app has been digitally signed with your iOS Enterprise developer account please navigate to your AppControllers Mgmt. FQDN e.g yourdomain.co.uk:4443 and login with your administrative credentials.
2: Navigate to Apps & Docs tab select iOS then upload and locate the signed iOS app and follow the onscreen instructions – http://support.citrix.com/proddocs/topic/appcontroller-26/clg-appc-mobile-apps-wrapper-d-con.html.
3: To configure any of the MDX policies i.e MDX Access, InterApp, Vault for your iOS app – http://support.citrix.com/proddocs/topic/appcontroller-26/clg-appc-mobile-apps-policies-d-con.html
4: The iOS app is now available and ready to be selected and downloaded onto the users end-point mobile device via StoreFront.

Deployment Modes
1: There are two types of deployment modes for the XenMobile AppController which is either direct or integrated. It is important to understand that this is NOT h/a.
2: Direct mode is where users connect directly to the XenMobile AppController bypassing StoreFront. In this deployment scenario the xac can only service and deliver Mobile apps, SaaS and web links to users. If you would like to test this mode deploy and configure your xac with mobile apps, web links within your environment and connect to the xac’s https://FQDN/ either internal or external using a internet browser on an iOS device as an example and it will redirect you to https://FQDN/Citrix/StoreWeb where you will be able to login using your AD credentials thereafter you’ll be able to select and launch a web link or click and install a Mobile app.
4: Integrated mode is where all the requests for mobile apps, SaaS, web links are aggregated through to the sfs over a HTTPS connection. ( xac <-- HTTPS 443 -->sfs ). The xac is setup as a delivery controller within StoreFront must the same a XA, XD. TIP: Prior to setting this configuration connect to the xac admin console from the sfs to ensure there is no SSL mismatch issues or errors with the certificate (Using IE you’ll receive a blue bar + background around the lock icon). If you would like to test this mode deploy and configure your xac with mobile apps, web links and configure the trust setting to point to your sfs e.g. https://sfs.local/ from the xac. Now attempt to connect to the xac’s https://FQDN/ either internal or external using a internet browser on an iOS device as an example and it will redirect you to https://FQDN/Citrix/StoreWeb but you will NOT be able to complete the request! Why? The xac disables its local StoreWeb as another trust setting has been configured i.e https://sfs.local. Now connect to your sfs FQDN and login using your AD credentials thereafter you’ll be able to select and launch a web link, published windows application e.g Notepad, Windows 7 desktop and select and click to install a Mobile app. How? As long as you have a setup the following delivery controllers servers in StoreFront xac, xa, xd and published the resources you can tap to select and launch any of the described resources. TIP: Allows ensure that if you have configured your delivery controllers to use HTTPS (443) there are no SSL mismatch errors with the FQDN as this is the most common error causing SysAdmins alot of headaches in troubleshooting where the issue lies.

Users
1: Users are provisioned using your organisations AD but first ensure that all users you attempt to provision have a first, last name and email fields populated even if you don’t have a mail server within your domain populate the e-mail address field as are a mandatory requirement for the xac.

Troubleshooting Tips
1: Setup a reoccurring calendar invite using your support ticketing system or group exchange invite to renew your iOS Enterprise Developer Account which expires annually and needs to be renewed.
2: Use a Enterprise CA to sign your CSR’s for your xac, sfs instead of using self-assigned certificates but use a publicly signed SSL certificate for R/A using a NetScaler Gateway.
3: Read through the Citrix Reference Architecture for MDM and MAM.