TechZone: Poc Guides

Citrix Federated Authentication Service

Fri, 28 Feb 2025 13:31:00 +0000

Overview

Citrix Federated Authentication Service (FAS) is a privileged component designed to integrate with Active Directory Certificate Services. It dynamically issues certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card.

This allows StoreFront to use a broader range of authentication options, such as Security Assertion Markup Language (SAML) assertions. SAML is commonly used as an alternative to traditional Windows user accounts on the Internet.

This proof-of-concept guide outlines the steps to install and configure Citrix Federated Authentication Service. The following concepts are covered in this guide:

Installation of Citrix Federated Authentication Service
StoreFront and Delivery Controller configuration
Group Policy Configuration
Citrix Federated Authentication Service configuration

Prerequisites

The following prerequisites are required for this proof-of-concept deployment:

Windows Server 2022 Standard or Datacenter, or later
A Microsoft Enterprise Certificate Authority or other validated Certificate Authority is required within your domain environment.
Citrix Virtual Apps and Desktops components (Delivery Controllers, Virtual Delivery Agents, and StoreFront) must all be on supported versions.
Citrix Virtual Apps and Desktops ISO or standalone Citrix Federated Authentication Service MSI installer.

Install Citrix Federated Authentication Service

Connect to the Windows Server dedicated to Citrix Federated Authentication Service and mount the Citrix Virtual Apps and Desktops ISO.
Double-click AutoSelect.

Click Start for Virtual Apps and Desktops.

Click Federated Authentication Service.

Select "I have read, understand, and accept the terms of the license agreement, click Next.

Click Next.

Verify Automatically is selected and click Next.

Review the summary page, click Install.

When the installation is completed successfully, click Finish.

Configure StoreFront and Delivery Controller

Citrix StoreFront and the Citrix Delivery Controller require additional configuration if you deploy Citrix Federated Authentication Service with Citrix Virtual Apps and Desktops. These steps are unnecessary if you are deploying Citrix FAS with Citrix Cloud.

Connect to your StoreFront server, open PowerShell, and run the following:

$store = Get-STFStoreService -VirtualPath [e.g. /Citrix/store]

$auth = Get-STFAuthenticationService -StoreService $store

Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"

Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"

Run this command to ensure that if FAS fails users can sign on to the VDA by entering their credentials:

$storeService = Get-STFStoreService -VirtualPath [VirtualPath]

Set-STFStoreLaunchOptions $storeService -FederatedAuthenticationServiceFailover $True

Connect to your Delivery Controller, and run the following PowerShell command to enable a trust between your Delivery Controller and StoreFront servers:

Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true

Configure Group Policy

Connect to your Citrix Federated Authentication Service server and open the following location in File Explorer: C:\Program Files\Citrix\Federated Authentication Service\PolicyDefinitions

Copy the contents of this folder and paste them into your Domain Controllers C:\Windows\PolicyDefinitions and en-US subfolder.

Connect to your Active Directory server and open Group Policy Management Editor.

Right-click on Default Domain Policy and select Edit.

Navigate to the Federated Authentication Service policy in Computer Configuration/Policies/Administrative Templates/Citrix Components/Authentication and open the Federated Authentication Server policy.

Select Enabled and click Show.

Enter the FQDN of your Citrix Federated Authentication Service server and click OK.

Click OK.

The Federated Authentication Service policy should now be enabled.

Open the In-session Behavior policy.

Select Enabled, per-process in the Prompt Scope drop-down menu, enter 30 in Consent timeout, select Disconnect on lock, then click OK.

The In-session Behavior policy is now Enabled.

Exit the Group Policy Management Editor

Configure FAS Server

Connect to your Citrix Federated Authentication Service server.
Launch Citrix Federated Authentication Services from the Windows Start menu.

Click Deploy.

Review the Deploy Certificate Templates message and click OK.

Click Publish.

Validate that your Certificate Authority is listed, click OK.

Click Authorize.

Validate that your Certificate Authority is listed, click OK.

The request is sent to the Certificate Authority.

Connect to your Certificate Authority server and open the Certificate Authority Console.

Select Pending Requests. The request from the Citrix Federated Authentication Service is visible.

Right-click on the request and select All Tasks > Issue.

Return to your Citrix Federated Authentication Service server. If the request has been authorized, the Reauthorize button will appear.

Click Create.

Leave Create the default rule (recommended) selected, and click Next.

Select Citrix_SmartcardLogon (recommended) and Filter templates (recommended), click Next.

Select your Certificate Authority and Only show CAs publishing Citrix_SmartcardLogon, click Next.

(Optional) Select Allow in-session use, and click Next.

Click Manage StoreFront access permissions.

Add your StoreFront server, unselect Deny, select Allow, and click OK.

Click Next.

Click Next.

Review the Summary page and click Create.

The Citrix Federated Authentication Service configuration is now complete.

Validation

Connect to your Citrix Federated Authentication Service server and open a PowerShell window.
Add the Federated Authentication Service snap-in.

Add-PSSnapin Citrix.Authentication.FederatedAuthenticationService.V1

Check the Federated Authentication Service server connectivity.

Get-FasServer

Check the certificate template status.

Get-FasCertificateDefinition -Address

Test the user certificate process.

New-FASUserCertificate -Address -UserPrincipalName -CertificateDefinition _definition -rule

Citrix Federated Authentication Service is working properly.

Summary

This POC Guide outlines the steps to install and configure the Citrix Federated Authentication Service, verify server connectivity, check the certificate template status, and test the user certificate process.

For additional information, optional settings, and FAQs, reference the Citrix Federated Authentication Service product documentation.

Citrix Image Portability Service - Usage with PowerShell, .NET, and REST-API

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Citrix developed the Citrix Image Portability Service (IPS) to simplify moving workloads between different resource locations and hypervisor platforms. With IPS you can even move your workloads between on-premises and public cloud environments.

Citrix Image Portability Service provides Citrix administrators with a simple workflow to manage workloads between on-premises and public cloud platforms like:

Microsoft Azure
Google Cloud Platform (GCP)
AWS (AWS)
VMware vSphere
Citrix XenServer
Nutanix

Developed using App Layering cross-platform technology, the Citrix Image Portability Service uses Citrix DaaS REST-APIs to migrate on-premises Machine Creation or Provisioning Services Images.

The Image Portability workflow is the framework for a migration of an Image from your on-premises location to your public cloud subscription.

After exporting your Image, Image Portability Service helps you transfer the Image to your public cloud subscription and prepare it to run.

Finally, Citrix Provisioning or Machine Creation Services provisions the Image in your public cloud subscription.

The product documentation can be found at https://docs.citrix.com/en-us/citrix-daas/migrate-workloads.html.

Scope

In this guide, we show how to migrate workflows from on-premises (VMware vSphere 8) to public cloud (Microsoft Azure and AWS).

We use three methods:

Pure API calls using Postman
PowerShell (PoSH)
A self-written Windows application that encapsulates all necessary API calls and PowerShell scripts into a GUI

Quote

Important Note:

The self-written .NET application only shows examples how to implement the API calls and PowerShell scripts into an application.

No warranty, no liability, and no support of any kind are given for the application.

Conceptual architecture

The Citrix Image Portability Service (IPS) is a REST-API with all the semantics and requirements of other Citrix DaaS and Virtual Apps and Desktops APIs.

The headers and authentication work the same as the other Citrix APIs do.

Citrix IPS relies on the Connector Appliance for Cloud Services to communicate with Citrix Cloud. IPS uses provisioning technology to create and manage resources in the resource location where the Connector Appliance is installed. More info: https://docs.citrix.com/en-us/tech-zone/learn/tech-briefs/Image-portability-service.html.

Image Portability Service components

Citrix Cloud services
Citrix Credential Wallet
Citrix Connector Appliance
Compositing Engine VM
PowerShell modules

Citrix Cloud services

The Citrix Cloud Services API is a REST-API service that interacts with the Image Portability Service. Using the REST-API service, you can create and monitor Image Portability jobs.

For example, you make an API call to start an Image Portability job, such as to export a disk, and then make calls to get the status of the job.

Citrix Credential Wallet

The Citrix Credential Wallet service securely manages system credentials, allowing the Image Portability Service to interact with your assets.

For example, when exporting a disk from vSphere to an SMB share, the Image Portability Service requires credentials to open a connection to vSphere and to the SMB share to write the disk. The credentials are stored in the Credential Wallet and the Image Portability Service can retrieve and use those credentials. Create all necessary credentials in the right format before use IPS.

This service gives you the ability to fully manage your credentials. The Cloud Services API acts as an access point, giving you the ability to create, update, and delete credentials.

Compositing Engine

The Compositing Engine is the workhorse of the Image Portability Service. The Compositing Engine (CE) is a single VM created at the start of an Image Portability job. The CE is created in the jobs target hypervisor/hyperscaler.

For example, when exporting a disk from vSphere, the job creates the CE on the vSphere server. When a prepare job runs in Azure, AWS, or Google Cloud, it creates the CE in Azure, AWS, or Google respectively. The CE mounts your disk to itself, and then does the necessary manipulations to the disk. Upon completion of the preparation or export job, the CE VM and all of its components are deleted.

Connector Appliance

The Connector Appliance runs in your environment and acts as a controller for individual jobs. It receives job instructions from the Cloud service, and creates and manages the Compositing Engine VMs.

The Connector Appliance VM acts as a single, secure point of communication between the Citrix Cloud services. Deploy one or more Connector Appliances in each of your Resource Locations.

By co-locating the Connector Appliance and the Compositing Engine, the deployment’s security posture increases greatly. The Connector Appliance keeps all components and communications within the same Resource Location. It needs access to the following URLs to prepare Images in the Image Portability Service:

*.layering.cloud.com
credentialwallet.citrixworkspaceapi.net
graph.microsoft.com
login.microsoftonline.com
management.azure.com
*.blob.storage.azure.net

PowerShell modules

We provide a collection of PowerShell modules for use within scripts as a starting point to develop your own custom automation. The supplied modules are supported as is, but you can modify them if necessary for your deployment.

The PowerShell automation uses supplied configuration parameters to compose a REST call to the Citrix Cloud API service to start the job. It provides you with periodic updates as the job progresses.

If you want to develop your own automation solution, you can make calls to the cloud service directly using your preferred programming language. See the API portal for detailed information about configuring and using the Image Portability Service REST endpoints and PowerShell modules https://developer.cloud.com/citrixworkspace/citrix-daas/Image-portability-service/docs/overview.

To use the PowerShell scripts, you need the following:

The latest version of PowerShell
Connectivity to the Microsoft PowerShell Gallery to download the required PowerShell libraries

Install-Module -Name PowerShellGet -Force -Scope CurrentUser -AllowClobber

Install-Module -Name "Citrix.Workloads.Portability","Citrix.Image.Uploader" -Scope CurrentUser
Update-Module -Name "Citrix.Workloads.Portability","Citrix.Image.Uploader" -Force

Install-Module -Name Az.Accounts -Scope CurrentUser -AllowClobber -Force
Install-Module -Name Az.Compute -Scope CurrentUser -AllowClobber -Force

Install-Module -Name VMware.PowerCLI -Scope CurrentUser -AllowClobber -Force -SkipPublisherCheck

Install-Module -Name Amazon AWS.Tools.Installer
Install-Amazon AWSToolsModule Amazon AWS.Tools.EC2,Amazon AWS.Tools.S3

All PowerShell cmdlets have built-in help containing full syntax and examples:

Get-Help Start-IpsVsphereExportJob -Full

PS C:\TACG> Get-Help Start-IpsVsphereExportJob

NAME
Start-IpsVsphereExportJob

OVERVIEW
Starts an Image Portability Service job to export an Image from Vsphere.

SYNTAX
Start-IpsVsphereExportJob -CustomerId  -SmbHost  [-SmbPort ] -SmbShare  [-SmbPath ] -SmbDiskName  [-SmbDiskFormat ] -SmbCwId  [-Deployment ] -ResourceLocationId  -VsphereCwSecretId  -VsphereHost  [-VspherePort ][-VsphereSslCaCertificateFilePath ] [-VsphereSslCaCertificate ] [-VsphereSslFingerprint ] [-VsphereSslNoCheckHostname ] -VsphereDataCenter  -VsphereDataStore  [-VsphereResourcePool ] -VsphereNetwork  [-VsphereHostSystem ] [-VsphereCluster ] -SourceDiskName  [-AssetsId ] [-Tags ] [-Timeout ] [-Prefix ] [-JobDebug ] [-Flags ] [-DryRun ] [-SecureClientId ] [-SecureSecret ] [-LogFileDir ] [-LogFileName ] [-OverwriteLog] [-Force] []

Start-IpsVsphereExportJob -ConfigJsonFile  [-SecureClientId ] [-SecureSecret ] [-LogFileDir ] [-LogFileName ] [-OverwriteLog] [-Force] []

DESCRIPTION
Starts an Image Portability Service job to export an Image from Vsphere to a virtual disk file on a SMB fileshare.
Start-IpsVspherePublishJob is an alias for this cmdlet.

LINKS

REMARKS
To open the examples, type: "get-help Start-IpsVsphereExportJob -examples".
Obtain more information by using: "get-help Start-IpsVsphereExportJob -detailed".
Technical information can be be obtained by using: "get-help Start-IpsVsphereExportJob -full".

Requirements

A Citrix Connector Appliance in all resource locations where IPS will be used.
A Windows (SMB) file share must be locally accessible to any export, prepare, and publish job.
A valid Citrix Cloud Customer ID and Citrix DaaS entitlement.
On-premises master Machine Create Services (MCS) or Provisioning Services (PVS) Image.
Access to public cloud resource location.
A Citrix Machine Catalog Image - IPS requires using Images that have one of the following tested configurations:
- Windows Server 2016, 2019, and 2022H2
- Windows 10 or 11
- Provisioned using Machine Creation Services or Citrix Provisioning
- Citrix Virtual Apps and Desktops VDA version 1912CU6, 1912CU7, 2203CU1, 2203CU2, 2212, 2303, 2305, 2308
- Citrix PVS Agent version 1912CU6, 1912CU7, 2203CU1, 2203CU2, 2212, 2303, 2305, 2308
- Remote Desktop Services enabled for console access in Azure

Image Portability service supports the following hypervisors and cloud platforms

Source platforms:

VMware vSphere 7.0 and 8.0
Citrix Hypervisor 8.2/XenServer 8
Nutanix Prism Element 3.x
Microsoft Azure
Google Cloud Platform

Destination platforms:

VMware vSphere 8.0
Citrix Hypervisor 8.2/XenServer 8
Nutanix Prism Element 3.x
Microsoft Azure
AWS
Google Cloud Platform

For using Postman

Download the Postman app for API calls: https://www.postman.com/downloads/

For using PowerShell

Download the Remote PowerShell kit: https://docs.citrix.com/en-us/citrix-daas/sdk-api.html#citrix-virtual-apps-and-desktops-remote-powershell-sdk

Install-Module -Name "Citrix.Workloads.Portability","Citrix.Image.Uploader"

Add-PSSnapin Citrix.*
Get-Module -ListAvailable "Citrix.*"

Folder: C:\Program Files\WindowsPowerShell\Modules

 ModuleType Version    Name                             ExportedCommands
 ---------- -------    ----                             ----------------
 Script     2.1.11.0   Citrix.Image.Uploader            {Copy-ToAzDisk, Copy-ToAwsDisk, Get-VhdSize, Get-VhdConten...
 Script     2.3.1      Citrix.Workloads.Portability     {Start-IpsAwsPrepareJob, Start-IpsVsphereExportJob, Start-...

For using the Windows .NET application

Download and install the DaaS Remote PowerShell kit
Download and install the latest version of PowerShell
Download and install the latest version of Azure PowerShell
Download and install .NET 7.0 Core
Download and install Chilkatsoft Chilkat .NET Core

Quote

Important Note:

The self-written .NET application only shows examples how to implement the API calls and PowerShell scripts into an application. No warranty, no liability, and no support of any kind are given for the application.

The .NET application shows the possibility to automate workflows by invoking REST-API calls and PowerShell scripts. The source code implements all 4 steps of the Image Migration Workflow.

Complete Citrix Cloud Prerequisites

Furthermore, some account information is necessary to obtain – the most important one is the Customer ID:

After logging in to Citrix Cloud, open the Account Settings window of the Cloud portal:

In the Account Settings window you find the Customer ID. Write it down or save it for further use.

Create an API client

API clients in Citrix Cloud are always tied to one administrator and one customer. API clients are not visible to other administrators. If you want to access to more than one customer, you must create API clients within each customer.

API clients are automatically restricted to the rights of that administrator that created it. For example, if an administrator is restricted to access only notifications, then the administrator's API clients have the same restrictions:

Reducing an administrator’s access also reduces the access of the API clients owned by that administrator.
Removing an administrator’s access also removes the administrator's API clients.

To create an API client, select the Identity and Access Management option from the menu. If this option does not appear, you may not have adequate permissions to create an API client. Contact your administrator to get the required permissions:

In the next screen select the API Access tab:

Name your Secure Client and click Create Client.

Now a message appears that ID and Secret have been created successfully. Download or copy the Client ID and Secret to access the APIs.

Accessing Citrix Cloud via API calls or PowerShell

To call APIs, you must also create a Bearer token. The Bearer token is used for API authentication and authorization. Tokens can be obtained using a standard OAuth 2.0 Client Credential grant flow. For more information about OAuth 2.0 Client Credential grant, see https://tools.ietf.org/html/rfc6749#section-4.4.

To get a bearer token, make a POST call to the trust service's authentication API:

POST https://api-us.cloud.com/cctrustoauth2/{customerid}/tokens/clients

Quote

Note:

Use one of the following endpoints based on the geographical region while creating the Citrix Cloud account:

api-ap-s.cloud.com – If your Citrix Cloud account is set to the Asia Pacific South region.

api-eu.cloud.com – If your Citrix Cloud account is set to the European Union region.

api-us.cloud.com – If your Citrix Cloud account is set to the United States region.

api.citrixcloud.jp - If your Citrix Cloud account is set to the Japan region.

Obtain a Bearer token for authentication

Flow to obtain a Bearer token using the Postman app

It is important to set the URI to call and the required parameters correct: The URI must follow this syntax: For example [https://api-us.cloud.com/cctrustoauth2/{customerid}/tokens/clients] where {customerid} is your Customer ID you obtained from the Account Settings page. If your Customer ID is for example 1234567890 the URI would be [https://api-us.cloud.com/cctrustoauth2/1234567890/tokens/clients]

Paste the correct URI into Postman´s address bar and select POST as the method. Verify the correct settings of the API call – please check the Headers tab to reflect the settings:

The next step is to enter your API credentials into the Body of the API call. Make sure that the Parameter type is set to x-www-form-encoded:

Now you are ready to call the API to get a Bearer token by pressing the Send button:

If everything is set correctly, Postman shows a Response containing a JSON-formatted file containing the Bearer token in the field access-token: The token is normally valid for 3600 seconds.

If an error occured, the Response contains some hints about the error:

To get a bearer token, make a POST call to the trust service's authentication API:

POST https://api-us.cloud.com/cctrustoauth2/{customerid}/tokens/clients

Response:

{
    "token_type": "bearer",
    "access_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCJ9…pZWFOBHuZ63tvGvRA",
    "expires_in": "3600"
}

Now you have a valid Bearer token for further API calls.

Flow to obtain a Bearer token using PowerShell

PS C:\TACG> $tokenUrl = 'https://api-eu.cloud.com/cctrustoauth2/1234567890/tokens/clients'
 PS C:\TACG> $response = Invoke-WebRequest $tokenUrl -Method POST -Body @{                                                                                                                       

 >> grant_type = "client_credentials"   
 >> client_id = "50XXXXXXXX-XXXXX-XXXXX-XXXXXXXXXXX7"
 >> client_secret = "8MXXXXXXXXXXXXXXXXXXX=="

 >> }

 PS C:\TACG> $token = $response.Content | ConvertFrom-Json
 PS C:\TACG> $token | Format-List

 token_type   : bearer
 access_token : J9.eyJzdWI
                ...
                BTp3KN5N_qr7Hjk-VTQy3Qp2dCId_cnagZaQleo1E98ifw2eUch1vu8tjYR-_NkA
 expires_in   : 3600

Flow to obtain a Bearer token using PowerShell

All relevant data is stored in an adjacent JSON file – you can follow the guide to obtain the Customer ID and the API Client values:

After entering the correct values you can use the Windows application to create the Bearer token:

Now you have your Bearer token for authentication and authorization. It must be included in each API-/PoSH-Call!

Image Migration Workflow

Migrating Images with the Citrix Image Portability Service consists of a 4-stage workflow.

Export: The export stage exports Images from the on-premises hypervisor and preps them for upload to the public cloud resource location. This stage can include converting file system types to a common format for the cloud.

Upload: The upload stage uploads the Image to the target cloud subscription. This process is a point-to-point transfer using the configuration and credentials for the public cloud supplied by the administrator.

Prepare: The prepare stage is a complex set of steps:

Removal of source platform components
Injection of target platform components into the Image
Reconfiguration of the VDA
Rearm of the OS based on the supplied configuration properties

At the end of this phase, the Image boots once to allow Windows plug-and-play to run and configure the OS for the new platform. Once the preparation completes, the Image is ready for provisioning with MCS.

Publish: The final stage deploys the Image as a new machine catalog.

In the case of MCS, the Citrix Virtual Apps and Desktops Remote PowerShell SDK can automate the creation of an MCS catalog from the migrated disk.
In the case of PVS on a HyperScaler, the Image Portability Service provides a REST interface or a PowerShell cmdlet to publish the migrated disk directly into the PVS vDisk store.

Throughout the four stages, the Image Portability Service uses App Layering compositing engines in the background to modify the Image and drive the process.

All Citrix Image Portability workflows are based on the configuration of the source Image and provisioning targets, either MCS or PVS. The workflow chosen determines the steps required by the Image Portability Service.

Part 1: Exporting the Image - Prerequisites

Exporting the Image to an SMB file share is a multi-step process:

Determine the ID of the Resource Location where the Image resides
Add new credentials to the Credential Wallet
Export the Image to the SMB share

In this guide we export the Image from VMware vSphere.

The following vCenter permissions are necessary to run the IPS export disk job in a VMware environment. For current permission requirements look at the product documentation https://docs.citrix.com/en-us/citrix-daas/migrate-workloads.html#vmware-vcenter-required-permissions.

-  Cryptographic operations
    -  Direct Access

-  Datastore
    -  Allocate space
    -  Browse datastore
    -  Low level file operations
    -  Remove file

-  Folder
    -  Create folder
    -  Delete folder

-  Network
    -  Assign network

-  Resource
    -  Assign virtual machine to resource pool

-  Virtual machine
    -  Change Configuration
        -  Add existing disk
        -  Add new disk
        -  Remove disk

    -  Edit Inventory
        -  Create from existing
        -  Create new
        -  Remove

    -  Interaction
        -  Power off
        -  Power on

Determining the ID of the Resource Location using Postman

GET https://api-eu.cloud.com/resourcelocations

Authorization:      CWSAuth bearer= {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}

Response (shortened):

{
    "items": [
        {
            "id": "58110e95-XXXX-XXXX-XXXX-XXXXXXXXXX",
            "name": "The Austrian Citrix Guy - vSphere",
            "internalOnly": false,
            "timeZone": "GMT Standard Time",
            "readOnly": false
        },
        {
            "id": "5faae27c-XXXX-XXXX-XXXX-XXXXXXXXXX",
            "name": "The Austrian Citrix Guy - Amazon AWS",
            "internalOnly": false,
            "timeZone": "GMT Standard Time",
            "readOnly": false
        },
        {
            "id": "76918c03-XXXX-XXXX-XXXX-XXXXXXXXXX",
            "name": "The Austrian Citrix Guy - AzHib",
            "internalOnly": false,
            "timeZone": "GMT Standard Time",
            "readOnly": false
        },
       ...
    ]
}

Copy the value of the id field as you need it for further calls.

Determining the ID of the Resource Location using PowerShell

PS C:\TACG> Get-ConfigZone | select Name, ExternalUid 
Name                                          ExternalUid
----                                          -----------
Initial Zone                                  00000000-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - Amazon AWS          5faae27c-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - AzGPU               b46c6873-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - AzHib               76918c03-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - AzStHCI local       e344b537-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - Azure Connectorless eec20fa2-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - On-Prem             dc4b9f88-XXXX-XXXX-XXXX-XXXXXXXXXX
The Austrian Citrix Guy - vSphere             58110e95-XXXX-XXXX-XXXX-XXXXXXXXXX

Copy the value of the ExternalUid field as you need it for further calls.

Determining the ID of the Resource Location using the Windows .NET Application

The .NET application requests all available Resource Locations automatically. You can choose the needed one using a drop-down field.

Add new credentials to the Credential Wallet using Postman

The correct types of Credentials are imperative for each operation - for example for Azure you need Azure-type credentials, for SMB SMB-type and so forth. The examples show the creation of UsernamePassword-type credentials.

More info about the different credential types and the creation can be found here: https://developer-docs.citrix.com/en-us/citrix-daas-service-apis/Image-portability-service/credentials.

POST https://api.eu.layering.cloud.com/credentials`

Authorization:      CWSAuth bearer= {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}

Body (Raw):
{
  "id": "vspXXXXXXXX",
  "type": "UsernamePassword",
  "username": "XXXXXXXXXXXX",
  "domain": "XXXXXXXX",
  "password": "XXXXXXXXXXXXX"
}

Response (shortened):

{
    "id": "vspXXXXXXXXX",
    "type": "UsernamePassword",
    "state": "Ok",
    "createdAt": "2023-11-13T09:00:18.2371226Z",
    "updatedAt": "2023-11-13T09:00:18.2371226Z"
}

Add new credentials to the Credential Wallet using PowerShell

PS C:\TACG> $Params = @{
 >>   CustomerId = 'uzXXXXXXXXXXX'
 >>   CredentialType = 'UsernamePassword'
 >>   CredentialId = 'platformid'
 >>   UserDomain = 'XXXXXXXXXXXXXXXXXXXX'
 >>   UserName = 'XXXXXXXXXXXXXXXXXXXXXXX'
 >>   UserPassword = 'XXXXXXXXXXXXXXXXXXXXXXXXX'
 >> }

 PS C:\TACG> New-IpsCredentials @Params
 Logging to C:\TACG\Credentials.log Verbose=False
 Interactively authenticating for Citrix customer uzXXXXXXXXXXX.
 Authenticated for Citrix customer uzXXXXXXXXXXX.
 Creating new UsernamePassword credential platformid
 geo EU api url https://api.eu.layering.cloud.com/
 Created credential id platformid for name platformid
 platformid

Part 1: Exporting the Image from on-premises vSphere using Postman

Before we can export the Image we need more information from the vSphere platform: The following parameters must be obtained from vSphere:

vCenterHost
vCenterPort
datacenter
datastore
cluster
network
sourceDisk

The following parameters are also required:

-  Prefix:  name of the export job
-  ResourceLocationID:  ID of the Resource Location of the Image
-  OutputStorageLocation:  
    -  Type (for example SMB)
    -  Credential-ID (for example SMB)
    -  Host-IP (for example 10.10.11.44):  must be reachable by the Connector Appliance in the Resource Location of the Image
    -  SharePath (for example SMB):  must be reachable by the Connector Appliance in the Resource Location of the Image

When all values are set we can call the API to export the Image.

POST https://api.eu.layering.cloud.com/Images/$export?async=true`

Authorization:      CWSAuth bearer=  {{Bearer-Token-Value}}
                    Citrix-CustomerId: {{Citrix-CustomerID}}

Body (Raw):
{
  "platform": "vSphere",
  "platformCredentialId": "vsXXXXXXXXX",
  "vCenterHost": "(FQDN)",
  "vCenterPort": 443,
  "vCenterSslNoCheckHostname": "true",
  "datacenter": "XXXX",
  "datastore": "XXXXX",
  "cluster": "TACG",
  "network": "VM Network",
  "prefix": "my-cejob",
  "resourceLocationId": "58110e95-XXXX-XXXX-XXXX-XXXXXXXXXX",
  "outputStorageLocation": {
    "type": "SMB",
    "credentialId": "XXXXXXXXX",
    "host": "10.10.11.99",
    "sharePath": "_sw"
  },
  "outputImageFilename": "my-exported-Image",
  "timeoutInSeconds": 3600,
  "sourceDiskName": "ds:///vmfs/volumes/65245805-XXXX-XXXX-XXXX-48210b5c6cd7/TACG-VSP-W11-M/TACG-VSP-W11-M.vmdk" 
}

Response:

{
    "id": "abcXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX",
    "type": "exportImage",
    "overallProgressPercent": 0,
    "isCancellable": true,
    "parameters": [],
    "status": "notStarted",
    "resultLocation": null,
    "additionalInfo": null,
    "warnings": [],
    "error": [],
    "createdAt": "2023-10-31T14:05:15Z",
    "updatedAt": "2023-10-31T14:05:15Z",
    "startedAt": "2023-10-31T14:05:15Z"
}

As the job runs asynchronously, we need another REST-API-call to get the status of the export job using the id parameter from the response:

GET 
https://api.eu.layering.cloud.com/jobs/{job-id}`

Authorization:      CWSAuth bearer= {{Bearer-Token-Value}}
                    Citrix-CustomerId: {{Citrix-CustomerID}}

The Response of the call contains all progress and error information. If the call is successful, we see the exported Image on the referenced SMB share.

Part 1: Exporting the Image from on-premises vSphere using PowerShell

Before we can export the Image we need more information from the vSphere platform: The following parameters must be obtained from vSphere:

vCenterHost
vCenterPort
datacenter
datastore
cluster
network
sourceDisk

The following parameters are also required:

-  Prefix:  name of the export job
-  ResourceLocationID:  ID of the Resource Location of the Image
-  OutputStorageLocation:  
    -  Type (for example SMB)
    -  Credential-ID (for example SMB)
    -  Host-IP (for example 10.10.11.44):  must be reachable by the Connector Appliance in the Resource Location of the Image
    -  SharePath (for example SMB):  must be reachable by the Connector Appliance in the Resource Location of the Image

When all values are set we can call the API to export the Image:

PS C:\TACG> $ExportParams = @{
>>   CustomerId = 'XXXXXXXXXX'
>>   SecureClientId = '71XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXb'
>>   SecureSecret = 'd-XXXXXXXXXXXXXX=='
>>   SmbHost = '10.10.11.99'
>>   SmbShare = '_SW'
>>   SmbDiskName = 'ipsexp-ps'
>>   SmbDiskFormat = 'VhdDiskFormat'
>>   SmbCwId = 'SMB'
>>   ResourceLocationId = '58XXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX2'
>>   VsphereCwSecretId = 'vsXXXXXXX'
>>   VsphereHost = '(FQDN)'
>>   VspherePort = '443'
>>   VsphereSslNoCheckHostname = $true
>>   VsphereDataCenter = 'TACG'
>>   VsphereDataStore = 'XXXXXXXXXXXX'
>>   VsphereNetwork = 'VM Network'
>>   VsphereCluster = 'TAXXXXXXXXXX'
>>   SourceDiskName = "ds:///vmfs/volumes/65245805-87e7af41-5aeb-48210b5c6cd7/TACG-VSP-W11-M/TACG-VSP-W11-M.vmdk"
>> }

PS C:\TACG> Start-IpsVsphereExportJob @ExportParams -Verbose | Wait-IpsJob
Logging to C:\TACG\ExportVsphereToSmb.log Verbose=True
Authenticating for Citrix customer XXXXXXXX using API key XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX.
VERBOSE: apikey
VERBOSE: __AllParameterSets
VERBOSE: Get-XDAuthentication: Enter
VERBOSE: invoking Get-XDAuthenticationEx:
VERBOSE: Get-XDAuthentication: Exit
Authenticated for Citrix customer XXXXXXXX.
Starting export workflow
***** Call Method: ExportImageJob overwrite: False *****
geo EU api url https://api.eu.layering.cloud.com/
VERBOSE: POST with -1-byte payload
VERBOSE: received 326-byte response of content type application/json; charset=utf-8
Image Export started with id 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX
Logging to C:\TACG\ExportVsphereToSmb.log Verbose=False
Interactively authenticating for Citrix customer XXXXXXXX.
Authenticated for Citrix customer XXXXXXXXX.
geo EU api url https://api.eu.layering.cloud.com/
Job 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX status: inProgress  percent done: 0  parameters @{name=currentStep; value=GenerateSecurityData}
Geo EU api url https://api.eu.layering.cloud.com/
Job 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX status: inProgress  percent done: 27  parameters @{name=currentStep; value=CreateCeVm}
geo EU api url https://api.eu.layering.cloud.com/
Job 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX status: inProgress  percent done: 67  parameters @{name=currentStep; value=Wait ForExportImage}
geo EU api url https://api.eu.layering.cloud.com/
Job7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX status: inProgress  percent done: 67  parameters @{name=currentStep; value=Wait ForExportImage}
geo EU api url https://api.eu.layering.cloud.com/
Job 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX status: inProgress  percent done: 73  parameters @{name=currentStep; value=GetCeLogs}
geo EU api url https://api.eu.layering.cloud.com/
Job 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX status: complete  percent done: 100  parameters
Job 7a4XXXXXXX-XXXX-XXXX-XXXXXXXXXX final status: complete
Job profile @{created compositing engine=0:01:12.666709, prepared to create compositing engine=0:00:01.100751, deleted compositing engine=0:00:01.774440, uploaded export assets to compositing engine=00:00:03.0517790})
Artifacts                       Status   LogFileDir LogFileName
---------                       ------   ---------- -----------
{output, tags, disk, temporary} complete            ExportVsphereToSmb.log

If the PowerShell script completed successfully, we see the exported Image on the referenced SMB share.

Part 1: Exporting the Image from on-premises vSphere using the Windows .NET Application

The first step obtains a Bearer token automatically.

Before we can export the Image we need more information from the vSphere platform: The following parameters must be obtained from vSphere:

vCenterHost
vCenterPort
datacenter
datastore
cluster
network
sourceDisk

The following parameters are also required:

-  Prefix:  name of the export job
-  ResourceLocationID:  ID of the Resource Location of the Image
-  OutputStorageLocation:  
    -  Type (for example SMB)
    -  Credential-ID (for example SMB)
    -  Host-IP (for example 10.10.11.44):  must be reachable by the Connector Appliance in the Resource Location of the Image
    -  SharePath (for example SMB):  must be reachable by the Connector Appliance in the Resource Location of the Image

Parts of the parameters have to be stored in the adjacent JSON-files of the Windows application:

{
  "vCenterHost": "vcenter.the-austrian-citrix-guy.at",
  "datacenter": "TACG",
  "datastore": "datastore1 (1)",
  "cluster": "TACG-CLUSTER",
  "network": "VM Network",
  "prefix": "my-cejob",
  "outputImageFilename": "my-exported-Image",
  "timeoutInSeconds": 36000,
"sourceDiskName": "ds:///vmfs/volumes/65XXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXd7/TACG-VSP-W11-M/TACG-VSP-W11-M.vmdk",
"smb": {
  "type": "SMB",
  "host": "10.10.11.44",
  "sharePath": "_TRANS"
}
}

The Resource Location-ID, the Platform-Credential, and the SMB Share-Credential are loaded from Citrix Cloud and can be selected at the adjacent drop-down boxes.

When all parameters are loaded, the export can be started by clicking the Export Image to SMB share.

After starting the export the application requests a status update at regular intervals as the export process is an asynchronous task. Progress is shown until the export has been completed.

Part 2: Uploading the Image - Prerequisites

The upload stage uploads the Image to the target cloud subscription. This process is a point-to-point transfer using the configuration and credentials supplied.

Quote

Note:

IPS provides PowerShell-based support for automating the upload of the disk. Other third-party tools can also support automation for uploading disks, but Citrix cannot directly support them.

In this guide we upload the Image to Microsoft Azure.

The following Azure permissions are necessary for uploading the Image (the Azure Resource group must be set in the Parameters):

Microsoft.Compute/disks/beginGetAccess/action
Microsoft.Compute/disks/endGetAccess/action
Microsoft.Compute/disks/delete
Microsoft.Compute/disks/read
Microsoft.Compute/disks/write
Microsoft.Compute/virtualMachines/delete
Microsoft.Compute/virtualMachines/powerOff/action
Microsoft.Compute/virtualMachines/read
Microsoft.Compute/virtualMachines/write
Microsoft.Network/networkInterfaces/delete
Microsoft.Network/networkInterfaces/join/action
Microsoft.Network/networkInterfaces/read
Microsoft.Network/networkInterfaces/write
Microsoft.Network/networkSecurityGroups/delete
Microsoft.Network/networkSecurityGroups/join/action
Microsoft.Network/networkSecurityGroups/read
Microsoft.Network/networkSecurityGroups/write
Microsoft.Resources/deployments/operationStatuses/read
Microsoft.Resources/deployments/read
Microsoft.Resources/deployments/write
Microsoft.Resources/subscriptions/resourcegroups/read

For current permission requirements look at the product documentation https://docs.citrix.com/en-us/citrix-daas/migrate-workloads.html#microsoft-azure-required-permissions.

Part 2: Uploading the Image from an on-premises SMB share to Azure using PowerShell

Before we can upload the Image, at least the following parameters must be obtained:

Filename            Filename of the disk to be uploaded
ManagedDiskName     Filename of the disk in Azure
SubscriptionID      Subscription-ID of the Azure tenant used
Location            Azure location
ResourceGroup       Azure Resource group
Timeout             Timeout before the script fails

When all values are set we can call the PowerShell script to export the Image. Be aware that the upload takes quite a while - in this example more than 16 hours…

PS C:\TACG> $Params = @{
 >>   Filename = 'C:\_SW\w11exp.vhd'
 >>   ManagedDiskName = 'IPS_W11EXP.vhd'
 >>   SubscriptionID = '58daXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
 >>   Location = 'eastus'
 >>   ResourceGroup = 'CTX-HibTest2'
 >>   Timeout = '86400'
 >> }

 PS C:\TACG> Copy-DiskToAzure @Params -Verbose                                                                                                                                                 Uploading                                                                                                                                            
  Uploading VHD                                                                                                                                      [                                                                                   ]                                                                                                                                                             15:06:19 689995776/85899345920   

2023-11-13 11:53:30Z: VHD size for C:\_SW\w11exp.vhd is 85899346432
2023-11-13 11:53:30Z: Creating managed disk 'IPS_W11EXP.vhd' with size 85899346432 bytes in resource group CTX-HibTest2 location eastus
2023-11-13 11:54:05Z: Copying disk 'C:\_SW\w11exp.vhd' to managed disk 'IPS_W11EXP.vhd' (threads=default)
2023-11-13 11:54:05Z: Detecting source type
2023-11-13 11:54:05Z: Analyzing VHD
2023-11-13 11:54:06Z: Uploading VHD
2023-11-14 04:27:56Z: Copied disk to Azure managed disk 'IPS_W11EXP.vhd'

Part 2: Uploading the Image from an on-premises SMB share to Azure using REST-API

Quote

Note:

As mentioned, uploading the Image from an on-premises SMB to Azure is not possible using REST-API calls. You have to invoke PowerShell.

Part 2: Uploading the Image from an on-premises SMB share to Azure using REST-API

The Windows .NET application encapsulates REST-API calls and invokes PowerShell scripts. The VHD file must reside on the computer where the .NET application is run.

Before we can upload the Image, at least the following parameters must be obtained:

Filename            Filename of the disk to be uploaded
ManagedDiskName     Filename of the disk in Azure
SubscriptionID      Subscription-ID of the Azure tenant used
Location            Azure location
ResourceGroup       Azure Resource group
Timeout             Timeout before the script fails

These parameters are set in a JSON-file or directly in the application.

When all values are set, the upload can be started by pressing the “Upload VHD...” button.

The upload is a long-lasting process depending on the size of the Image and the upload speed - in this example, it took over 16 hours to upload. Set the timeout parameter accordingly!

Quote

Note:

During the upload, the application does not refresh its state - it happens only after completion or occurrence of an error!

After a successful upload, the next step of the Image Migration workflow can be started.

Part 3: Preparing the Image - Prerequisites

The Prepare stage is a complex set of steps removing the source platform components and injecting the target platform components into the Image. An important prerequisite is a correct App registration in Azure and its IAM settings. The needed permissions can be found in the IPS documentation. Create the credential in the Citrix Credential Wallet using the PowerShell script or REST-API.

Example for creating Azure credentials in the Credential Wallet using a REST-API call:

Correct format:

{
  "id": "azadminjson",
  "name": "My Azure credential SPN",
  "type": "Azure",
  "tenantId": "e85XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "clientId": "fd7XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "clientSecret": "8cD8QXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX_"
}

The XXXXX-marked values are the corresponding values of the App registration in Azure.

Full REST-API-Call to create the Azure credential:

POST https://api.eu.layering.cloud.com/credentials 

Authorization:      CWSAuth bearer=  {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}
Accept:            application/json
Content-Type:      application/json

Body (Raw):
{
 "id": "azadminjson",
  "name": "My Azure credential SPN",
  "type": "Azure",
  "tenantId": "e85aXXXX-XXXX-XXXX-XXXXXXXXXXXX”,
  "clientId": "fd72XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "clientSecret": "8cDXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX_"
}

Response if credential was successfully created:

{
    "id": "azadminjson,
    "name": "My Azure credential SPN",
    "type": "Azure",
    "state": "Ok",
    "createdAt": "2023-11-15T18:01:49.8436445Z",
    "updatedAt": "2023-11-15T18:01:49.8436445Z"
}

Part 3: Preparing the Image on Azure using PowerShell

Before we can call the PowerShell script to prepare the Image, at least the following parameters must be obtained:

 CustomerID
 CloudCwSecretId                        Azure credentials stored in the Credential Wallet
 ResourceLocationId                     ID of the Citrix Cloud Resource location
 AzureSubscriptionID                    Azure region where the prepared disk is placed
 TargetResourceGroup                    Resource group where the prepared disk is placed
 AzureVirtualNetworkResourceGroupName   Resource group for placing the Compositing engine
 AzureVirtualNetworkName                Network for placing the Compositing engine
 AzureVirtualNetworkSubnetName          Subnet for placing the Compositing engine
 CloudProvisioningType                  Deployment with MCS or PVS
 DomainUnjoin                           Remove Image from Domain
 InstallMisa                            Install the Machine Identity Service Agent from VDA
 ForceMisa                              Install the latest Machine Identity Service Agent
 CloudDiskName                          Name of the disk to be prepared
 AzureLocation                          Azure region to deploy to
 XdReconfigure:
      ParameterName                     "controllers"
      "ParameterValue                   FQDN of the Cloud Controllers

When all values are set we can call the PowerShell script to prepare the Image:

 PS C:\TACG> $PrepareParams = @{
 >> CustomerId = 'uzyo2lp7eh7j'
 >> CloudProvisioningType = 'Mcs'
 >> CloudCwSecretId = 'azadXXXXXXXXX'
 >> DomainUnjoin = $true
 >> InstallMisa = $false
 >> ForceMisa = $false
 >> CloudDiskName = 'diskfromipsss'
 >> XdReconfigure =  @(
 >>     [pscustomobject]@{
 >>        ParameterName = 'controllers'
 >>        ParameterValue = 'TACG-XXXXXX.hib.the-austrian-citrix-guy.at'
 >>    }
 >>  )
 >> ResourceLocationId = '7691XXXX-XXXX-XXXX-XXXXXXXXXXXX'
 >> AzureSubscriptionID = '58daXXXX-XXXX-XXXX-XXXXXXXXXXXX'
 >> AzureLocation = 'eastus'
 >> TargetResourceGroup = 'CTX-XXXXXXXXXX
 >> AzureVirtualNetworkResourceGroupName = 'CTX-XXXXXXXXXX'
 >> AzureVirtualNetworkName = 'TACG-XXXXXXXXXX-vnet'
 >> AzureVirtualNetworkSubnetName = 'default'
 >> }

 PS C:\TACG> Start-IpsAzurePrepareJob @PrepareParams -Verbose | Wait-IpsJob
 VERBOSE: Initialize default drives.
 VERBOSE: Creating a new drive.
 VERBOSE: Creating a new drive.
 Logging to C:\TACG\PrepareAzure.log Verbose=True
 Interactively authenticating for Citrix customer uzyo2lp7eh7j.
 VERBOSE: __AllParameterSets
 VERBOSE: Get-XDAuthentication: Enter
 VERBOSE: invoking Get-XDAuthenticationEx:
 VERBOSE: Get-XDAuthentication: Exit
 Authenticated for Citrix customer XXXXXXXXXX.
 Starting prepare workflow
 ***** Call Method: PrepareImageJob *****
 geo EU api url https://api.eu.layering.cloud.com/

 VERBOSE: Cmdlet "Find-Package" is exported.
 VERBOSE: Cmdlet "Get-Package" is exported.
 VERBOSE: Cmdlet "Get-PackageProvider" is exported.
 VERBOSE: Cmdlet "Get-PackageSource" is exported.
 VERBOSE: Cmdlet "Install-Package" is exported.
 VERBOSE: Cmdlet "Import-PackageProvider" is exported.
 VERBOSE: Cmdlet "Find-PackageProvider" is exported.
 VERBOSE: Cmdlet "Install-PackageProvider" is exported.
 VERBOSE: Cmdlet "Register-PackageSource" is exported.
 VERBOSE: Cmdlet "Save-Package" is exported.
 VERBOSE: Cmdlet "Set-PackageSource" is exported.
 VERBOSE: Cmdlet "Uninstall-Package" is exported.
 VERBOSE: Cmdlet "Unregister-PackageSource" is exported.
 VERBOSE: Cmdlet "Find-Package" is imported.
 VERBOSE: Cmdlet "Find-PackageProvider" is imported.
 VERBOSE: Cmdlet "Get-Package" is imported.
 VERBOSE: Cmdlet "Get-PackageProvider" is imported.
 VERBOSE: Cmdlet "Get-PackageSource" is imported.
 VERBOSE: Cmdlet "Import-PackageProvider" is imported.
 VERBOSE: Cmdlet "Install-Package" is imported.
 VERBOSE: Cmdlet "Install-PackageProvider" is imported.
 VERBOSE: Cmdlet "Register-PackageSource" is imported.
 VERBOSE: Cmdlet "Save-Package" is imported.
 VERBOSE: Cmdlet "Set-PackageSource" is imported.
 VERBOSE: Cmdlet "Uninstall-Package" is imported.
 VERBOSE: Cmdlet "Unregister-PackageSource" is imported.
 VERBOSE: POST with -1-byte payload
 VERBOSE: received 327-byte response of content type application/json; charset=utf-8

 Image Prepare started with id 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
 Logging to C:\TACG\PrepareAzure.log Verbose=False
 Interactively authenticating for Citrix customer XXXXXXXXXX.
 Authenticated for Citrix customer XXXXXXXXXX.

 geo EU api url https://api.eu.layering.cloud.com/
 Job 33743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 21  parameters @{name=currentStep; value=CreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 21  parameters @{name=currentStep; value=CreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 21  parameters @{name=currentStep; value=CreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 42  parameters @{name=currentStep; value=UploadAssetsToCe}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 42  parameters @{name=currentStep; value=UploadAssetsToCe}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 53  parameters @{name=currentStep; value=WaitForPrepareImage}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 58  parameters @{name=currentStep; value=GetCeLogs}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 68  parameters @{name=currentStep; value=WaitForTargetBoot}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 68  parameters @{name=currentStep; value=WaitForTargetBoot}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 68  parameters @{name=currentStep; value=WaitForTargetBoot}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 89  parameters @{name=currentStep; value=DeleteCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 89  parameters @{name=currentStep; value=DeleteCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 89  parameters @{name=currentStep; value=DeleteCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: complete  percent done: 100  parameters
 Job 3743XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX final status: complete
 Job profile @{deleted compositing engine=0:03:17.912184, reconfigure VDA=00:02:45.0545592, created compositing engine=0:02:56.629924, installed windowsAzureVmAgent=00:00:56.9625675, prepared to create compositing engine=0:00:08.829692, uploaded prepare assets to compositing engine=00:00:58.2018150})

 Artifacts                 Status   LogFileDir LogFileName
 ---------                 ------   ---------- -----------
 {output, tags, temporary} complete            PrepareAzure.log

The preparation of the Image has been completed successfully.

Part 3: Preparing the Image on Azure using REST-API

An important prerequisite is a correct App registration in Azure and its IAM settings and a correct Azure-based credential. The needed permissions can be found in the IPS documentation.

Create the credential in the Citrix Credential Wallet using the PowerShell script or REST-API.

Before we can call the REST-API to prepare the Image, at least the following parameters must be obtained:

 platform                           Azure
 platformCredentialId               Azure credentials stored in the Credential Wallet
 resourceLocationId                 ID of the Citrix Cloud Resource location
 SubscriptionID                     Azure region where the prepared disk is placed
 targetDiskResourceGroupName        Resource group where the prepared disk is placed
 virtualNetworkResourceGroupName    Resource group for placing the Compositing engine
 virtualNetworkName                 Network for placing the Compositing engine
 virtualNetworkSubnetName           Subnet for placing the Compositing engine
 provisioningType                   Deployment with MCS or PVS
 domainUnjoin                       Remove Image from Domain
 installMisa                        Install the Machine Identity Service Agent from VDA
 forceMisa                          Install the latest Machine Identity Service Agent
 installUpl                         Install User Personal Layer
 defrag                             Run DEFRAG
 chkdsk                             Run CHKDSK
 targetDiskName                     Name of the disk to be prepared
 outputDiskName                     Name of the prepared disk 
 XdReconfigure:
      ParameterName                 "controllers"
      ParameterValue                FQDN of the Cloud Controllers

JSON-Call to prepare the Image:

POST https://api.eu.layering.cloud.com/Images/$prepare?async=true `

Authorization:      CWSAuth bearer=  {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}
Accept:            application/json
Content-Type:      application/json

Body (Raw):
{
  "platform": "Azure",
  "platformCredentialId": "azadmXXXXXXX",
  "resourceLocationId": "7691XXXX-XXXX-XXXX-XXXX-XXXXXXXXXX",
  "SubscriptionID": "58daXXXX-XXXX-XXXX-XXXX-XXXXXXXXXX",
  "azureRegion": "eastus",
  "targetDiskResourceGroupName": "CTX-XXXXXXXXX",
  "virtualNetworkResourceGroupName": "CTX-XXXXXXXXX",
  "virtualNetworkName": "TACG-XXXXXXXXXXXXX",
  "virtualNetworkSubnetName": "default",
  "provisioningType": "Mcs",
  "domainUnjoin": true,
  "installMisa": false,
  "forceMisa": false,
  "installUpl": false,
  "defrag": false,
  "chkdsk": false,
  "ceVmSku": "Standard_D2s_v5",
  "targetDiskName": "diskromXXXXXXXX",
  "outputDiskName": "procdiskXXXXXXXXX",
  "XdReconfigure": [{
      "ParameterName":"controllers",
      "ParameterValue":"TACGXXXXXXXX.hib.the-austrian-citrix-guy.at"
    }
  ]
}

Response:

{
    "id": "6267XXXX-XXXX-XXXX-XXXX-XXXXXXXXXX",
    "type": "prepareImage",
    "overallProgressPercent": 0,
    "isCancellable": true,
    "parameters": [],
    "status": "notStarted",
    "resultLocation": null,
    "additionalInfo": null,
    "warnings": [],
    "error": [],
    "createdAt": "2023-11-15T19:07:09Z",
    "updatedAt": "2023-11-15T19:07:09Z",
    "startedAt": "2023-11-15T19:07:09Z"
}

As the job runs asynchronously, we need another REST-API-call to get the status of the export job using the id parameter from the response:

Example: 42% progress:

Example: 100% progress, preparation successful:

JSON-Call to get the status of the preparation job:

GET 
https://api.eu.layering.cloud.com/jobs/6267XXXX-XXXX-XXXX-XXXX-XXXXXXXXX  

Authorization:      CWSAuth bearer=  {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}
Accept:            application/json
Content-Type:      application/json

Body (Raw):
{
}

Response - this example shows 100% progress and successful preparation

{
    "id": "6267XXXX-XXXX-XXXX-XXXX-XXXXXXXXX  ",
    "type": "prepareImage",
    "overallProgressPercent": 100,
    "isCancellable": true,
    "parameters": [],
    "status": "complete",
    "resultLocation": null,
    "additionalInfo": {
        "artifacts": {
            "tags": {
                "ctx-job-id": "6267XXXX-XXXX-XXXX-XXXX-XXXXXXXXXX",
                "component": "compositing"
            },
            "output": [
                {
                    "description": "Managed disk containing the prepared Image",
                    "name": "procdiskfromipsss",
                    "resourceGroup": "CTX-XXXXXXX"
                }
            ],
            "temporary": [
                {
                    "description": "Temporary resource group",
                    "name": "ctx-ce-50d0e27d"
                },
                {
                    "description": "Temporary Compositing Engine OS disk",
                    "name": "ce-50d0e27d-os-disk",
                    "resourceGroup": "ctx-ce-50d0e27d"
                },
                {
                    "description": "Temporary Compositing Engine NIC",
                    "name": "ce-50d0e27d-nic",
                    "resourceGroup": "ctx-ce-50d0e27d"
                },
                {
                    "description": "Temporary Compositing Engine network security group",
                    "name": "ce-50d0e27d-nic-nsg",
                    "resourceGroup": "ctx-ce-50d0e27d"
                },
                {
                    "description": "Temporary Compositing Engine VM",
                    "name": "ce-50d0e27d",
                    "resourceGroup": "ctx-ce-50d0e27d",
                    "encryptionAtHost": false
                }
            ]
        },
        "profile": {
            "prepared to create compositing engine": "0:00:09.071793",
            "created compositing engine": "0:02:58.483518",
            "uploaded prepare assets to compositing engine": "00:00:54.2715950",
            "installed windowsAzureVmAgent": "00:01:02.6609307",
            "reconfigure VDA": "00:03:54.8636235",
            "deleted compositing engine": "0:03:18.144080"
        },
        "warnings": [],
        "errors": [],
        "telemetry": {
            "diskSize": "85899345920",
            "freeSpace": "1048576",
            "windowsVersion": "@{CurrentVersion=@{value = 6.3, type = REG_SZ}; UBR=@{value = 0x7c8, type = REG_DWORD}; BuildLab=@{value = 22621.ni_release.220506-1250, type = REG_SZ}; RegisteredOwner=@{value = admin, type = REG_SZ}; CurrentBuild=@{value = 22621, type = REG_SZ}; SystemRoot=@{value = C:\\Windows, type = REG_SZ}; DigitalProductId4=@{value = F804000004000000300033003600310032002D00300033003300310031002D003000300030002D003000300030003000300031002D00300033002D0031003000330031002D00320032003600320031002E0030003000300030002D003200380033003200300....000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000, type = REG_BINARY}; ProductId=@{value = 00331-10000-00001-AA757, type = REG_SZ}; DigitalProductId=@{value = A40000000300000030303333312D31303030302D30303030312D414137353700EF0C00005B54485D5831392D3938373935000000EF0C10000000343DC5394EBD6E2F090000000000D51D25653D149BCE030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050F96851, type = REG_BINARY}; BuildBranch=@{value = ni_release, type = REG_SZ}; SoftwareType=@{value = System, type = REG_SZ}; CurrentType=@{value = Multiprocessor Free, type = REG_SZ}; DisplayVersion=@{value = 22H2, type = REG_SZ}; InstallDate=@{value = 0x65251dd7, type = REG_DWORD}; InstallTime=@{value = 0x1d9fb5edf5aef50, type = REG_QWORD}; InstallationType=@{value = Client, type = REG_SZ}; BuildLabEx=@{value = 22621.1.amd64fre.ni_release.220506-1250, type = REG_SZ}; ProductName=@{value = Windows 10 Pro, type = REG_SZ}; CompositionEditionID=@{value = Enterprise, type = REG_SZ}; CurrentBuildNumber=@{value = 22621, type = REG_SZ}; ReleaseId=@{value = 2009, type = REG_SZ}; PathName=@{value = C:\\Windows, type = REG_SZ}; EditionID=@{value = Professional, type = REG_SZ}; BuildGUID=@{value = ffffffff-ffff-ffff-ffff-ffffffffffff, type = REG_SZ}; CurrentMajorVersionNumber=@{value = 0xa, type = REG_DWORD}; BaseBuildRevisionNumber=@{value = 0x1, type = REG_DWORD}; PendingInstall=@{value = 0x0, type = REG_DWORD}; CurrentMinorVersionNumber=@{value = 0x0, type = REG_DWORD}}",
            "vdaVersions": "@{AppProtectionVC=@{value = 23.8.0.2, type = REG_SZ}; Citrix HDX Audio x64=@{value = 7.39.0.33, type = REG_SZ}; WmiSdk=@{value = 7.39.0.4, type = REG_SZ}; Citrix HDX Graphics x64=@{value = 7.39.0.36, type = REG_SZ}; WMI-Maschinenverwaltungsprovider=@{value = 7.39.0.4, type = REG_SZ}; (Default)=@{value = 7.39.0.0, type = REG_SZ}; Citrix Start Menu Disconnect Button=@{value = 7.39.0.41, type = REG_SZ}; Citrix Identity Assertion VDA Plugin=@{value = 10.15.0.4, type = REG_SZ}; Citrix Director VDA Plugin=@{value = 7.39.0.4, type = REG_SZ}; Citrix Überwachungsdienst-VDA-Plug-In=@{value = 7.39.0.10, type = REG_SZ}; Citrix WMI Proxy Plugin=@{value = 7.39.0.4, type = REG_SZ}; Citrix Browser Content Redirection=@{value = 15.45.0.12, type = REG_SZ}; Citrix Gruppenrichtlinie - clientseitige Erweiterung 7.39.0.13=@{value = 7.39.0.13, type = REG_SZ}; Citrix HDX Devices x64=@{value = 7.39.0.31, type = REG_SZ}; Machine Identity Service Agent=@{value = 7.39.0.4, type = REG_SZ}; Citrix HDX App Experience x64=@{value = 7.39.0.41, type = REG_SZ}; Citrix CDF Capture Service - x64=@{value = 7.39.0.4, type = REG_SZ}; Citrix HDX Printing x64=@{value = 7.39.0.26, type = REG_SZ}; UpmVDAPlugin=@{value = 23.8.0.7, type = REG_SZ}; Citrix HDX WS x64=@{value = 15.45.0.12, type = REG_SZ}; Citrix HDX IcaManagement x64=@{value = 7.39.0.47, type = REG_SZ}; Citrix Diagnostics Facility=@{value = 7.2.1.6, type = REG_SZ}; Citrix Telemetry Service - x64=@{value = 3.24.0.1, type = REG_SZ}; Citrix Universeller Druckclient=@{value = 7.39.0.26, type = REG_SZ}; Citrix Virtual Desktop Agent - x64=@{value = 7.39.0.11, type = REG_SZ}}",
            "partitionStyle": "GPT",
            "bootMode": "UEFI"
        }
    },
    "warnings": [],
    "error": [],
    "createdAt": "2023-11-15T19:07:09Z",
    "updatedAt": "2023-11-15T19:37:29Z",
    "startedAt": "2023-11-15T19:07:09Z",
    "endedAt": "2023-11-15T19:37:29Z"
}

The preparation of the Image has been completed successfully.

Part 3: Preparing the Image on Azure using the Windows .NET Application

The Windows .NET application encapsulates REST-API calls to prepare the Image on Azure. An important prerequisite is a correct App registration in Azure and its IAM settings and a correct Azure-based credential.

Before the application can prepare the Image, the following parameters must be obtained:

 platform                           Azure
 platformCredentialId               Azure credentials stored in the Credential Wallet
 resourceLocationId                 ID of the Citrix Cloud Resource location
 SubscriptionID                     Azure region where the prepared disk is placed
 targetDiskResourceGroupName        Resource group where the prepared disk is placed
 virtualNetworkResourceGroupName    Resource group for placing the Compositing engine
 virtualNetworkName                 Network for placing the Compositing engine
 virtualNetworkSubnetName           Subnet for placing the Compositing engine
 provisioningType                   Deployment with MCS or PVS
 domainUnjoin                       Remove Image from Domain
 installMisa                        Install the Machine Identity Service Agent from VDA
 forceMisa                          Install the latest Machine Identity Service Agent
 installUpl                         Install User Personal Layer
 defrag                             Run DEFRAG
 chkdsk                             Run CHKDSK
 targetDiskName                     Name of the disk to be prepared
 outputDiskName                     Name of the prepared disk 
 XdReconfigure:
      ParameterName                 "controllers"
      ParameterValue                FQDN of the Cloud Controllers

These parameters are set in a JSON-file.

Quote

Note:

The parameter overrideUploadedDiskName determines the preparation of the correct disk: true uses the disk name set in the adjacent JSON file, false uses the disk name uploaded before.

When all parameters are set, the preparation of the uploaded Image can be started by pressing the “Prepare VHD...” button. The preparation process lasted in this example for about 35 minutes…

The application refreshes every 30 seconds the job status by calling a REST-API to determine the job status.

The preparation of the Image has been completed successfully.

Part 4: Publishing the Image - Prerequisites

In the Publish phase, the prepared Image is published and ready to be streamed with Citrix Provisioning Server (PVS). The Image Portability Service provides a REST interface and PowerShell scripts to publish the migrated disk directly into the PVS vDisk store.

Quote

Note:

If you are using Machine Creation Services (MCS) to provision your machine catalog, you do not need to run the “Publish” stage. You can use the prepared Image from Part 3 to create the Machine Catalog.

An example of creating a Machine Catalog using PowerShell can be found on the Tech Zone article https://docs.citrix.com/en-us/tech-zone/build/deployment-guides/citrix-azure-hibernation-posh#creating-a-hibernation-capable-machine-catalog-using-powershell.

An example of creating a Machine Catalog using REST-API calls can be found on the Tech Zone article https://docs.citrix.com/en-us/tech-zone/build/deployment-guides/citrix-azure-hibernation-api#creating-a-hibernation-capable-machine-catalog-using-rest-api.

You can use these guides as a reference for further automation of creating machines using MCS.

Part 4: Publishing the Image on Azure to an SMB share for PVS using PowerShell

An important prerequisite is a correct App registration in Azure and its IAM settings.

Before we can call the PowerShell script to publish the Image, at least the following parameters must be obtained:

CustomerID                                     Citrix Customer-ID
SecureClientID                                 ID of the API client        
SecureSecret                                   Secret of the API client 
SmbHost                                        Hostname of SMB server where the exported disk will be stored
SmbShare                                       SMB server share name
SmbPath                                        Share path to the disk
SmbDiskName                                    Name of disk with no extension
SmbDiskFormat                                  Type of disk
SmbCwId                                        SMB Credential Wallet ID
ResourceLocationID                             ID of the Resource location      
AzureSubscriptionID                            ID of the Azure subscription  
CloudCWSecretID                                ID of the Cloud credential in the Credential Wallet
AzureLocation                                  Azure location
TargetResourceGroup                            Resource group for placing the Compositing engine  
AzureVirtualNetworkResourceGroupName           Resource group of the Network for placing the Compositing engine                   
AzureVirtualNetworkName                        Network for placing the Compositing engine    
AzureVirtualNetworkSubnetName                  Subnet for placing the Compositing engine     
CloudDiskName                                  Name of the disk to be transferred to the SMB share
AzureVmResourceGroup                           Resource group where the VM will be placed
Timeout                                        Timespan before the process times out
LogFileName                                    Name of the log file

When all values are set we can call the PowerShell script to publish the Image.

PS C:\TACG> $PublishParams = @{
 >>   CustomerId = "uzXXXXXXXXXXXX"
 >>   SecureClientId = "26ecXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
 >>   SecureSecret = "vhOXXXXXXXXXXXXXXXXXXXXXXXXXXXX"
 >>   SmbHost = "10.0.0.4"
 >>   SmbShare = "_PVS"
 >>   SmbDiskName = "ReadyForPVSPS"
 >>   SmbDiskFormat = "VhdDiskFormat"
 >>   SmbCwId = "azhibsmb"
 >>   ResourceLocationId = "7691XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
 >>   AzureSubscriptionId = "58daXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX"
 >>   CloudCwSecretId = "azadminjson"
 >>   AzureLocation = "eastus"
 >>   TargetResourceGroup = "CTX-Hibtest2"
 >>   AzureVirtualNetworkResourceGroupName = "CTX-Hibtest2"
 >>   AzureVirtualNetworkName = "TACG-HibTest-DCCC-vnet"
 >>   AzureVirtualNetworkSubnetName = "default"
 >>   CloudDiskName = "procdiskfromipsss"
 >>   AzureVmResourceGroup = "CTX-Hibtest2"
 >>   Timeout = "36000"
 >>   LogFileName = "AzurePublish.log"
 >> }

 PS C:\TACG> Start-IpsAzurePublishJob @PublishParams -Verbose | Wait-IpsJob
 VERBOSE: Initialize default drives.
 VERBOSE: Creating a new drive.
 VERBOSE: Creating a new drive.

 Logging to C:\TACG\AzurePublish.log Verbose=True
 Authenticating for Citrix customer uzXXXXXXXXXXXXXX using API key 26ecXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX.
 VERBOSE: apikey
 VERBOSE: __AllParameterSets
 VERBOSE: Get-XDAuthentication: Enter
 VERBOSE: invoking Get-XDAuthenticationEx:
 VERBOSE: Get-XDAuthentication: Exit
 Authenticated for Citrix customer uzyXXXXXXXXXX.
 Starting export workflow

 ***** Call Method: ExportImageJob overwrite: False *****
 geo EU api url https://api.eu.layering.cloud.com/
 VERBOSE: Cmdlet "Find-Package" is exported.
 VERBOSE: Cmdlet "Get-Package" is exported.
 VERBOSE: Cmdlet "Get-PackageProvider" is exported.
 VERBOSE: Cmdlet "Get-PackageSource" is exported.
 VERBOSE: Cmdlet "Install-Package" is exported.
 VERBOSE: Cmdlet "Import-PackageProvider" is exported.
 VERBOSE: Cmdlet "Find-PackageProvider" is exported.
 VERBOSE: Cmdlet "Install-PackageProvider" is exported.
 VERBOSE: Cmdlet "Register-PackageSource" is exported.
 VERBOSE: Cmdlet "Save-Package" is exported.
 VERBOSE: Cmdlet "Set-PackageSource" is exported.
 VERBOSE: Cmdlet "Uninstall-Package" is exported.
 VERBOSE: Cmdlet "Unregister-PackageSource" is exported.
 VERBOSE: Cmdlet "Find-Package" is imported.
 VERBOSE: Cmdlet "Find-PackageProvider" is imported.
 VERBOSE: Cmdlet "Get-Package" is imported.
 VERBOSE: Cmdlet "Get-PackageProvider" is imported.
 VERBOSE: Cmdlet "Get-PackageSource" is imported.
 VERBOSE: Cmdlet "Import-PackageProvider" is imported.
 VERBOSE: Cmdlet "Install-Package" is imported.
 VERBOSE: Cmdlet "Install-PackageProvider" is imported.
 VERBOSE: Cmdlet "Register-PackageSource" is imported.
 VERBOSE: Cmdlet "Save-Package" is imported.
 VERBOSE: Cmdlet "Set-PackageSource" is imported.
 VERBOSE: Cmdlet "Uninstall-Package" is imported.
 VERBOSE: Cmdlet "Unregister-PackageSource" is imported.
 VERBOSE: POST with -1-byte payload
 VERBOSE: received 326-byte response of content type application/json; charset=utf-8
 Image Export started with id 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX
 Logging to C:\TACG\AzurePublish.log Verbose=False
 Interactively authenticating for Citrix customer uzyXXXXXXXXXX.
 Authenticated for Citrix customer uzyXXXXXXXXXX.
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 20  parameters @{name=currentStep; value=PrepareForCreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 20  parameters @{name=currentStep; value=PrepareForCreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 27  parameters @{name=currentStep; value=CreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 27  parameters @{name=currentStep; value=CreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 27  parameters @{name=currentStep; value=CreateCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 67  parameters @{name=currentStep; value=WaitForExportImage}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 67  parameters @{name=currentStep; value=WaitForExportImage}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 67  parameters @{name=currentStep; value=WaitForExportImage}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 87  parameters @{name=currentStep; value=DeleteCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: inProgress  percent done: 87  parameters @{name=currentStep; value=DeleteCeVm}
 geo EU api url https://api.eu.layering.cloud.com/
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX status: complete  percent done: 100  parameters
 Job 467XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXXfinal status: complete
 Job profile @{created compositing engine=0:03:01.698686, prepared to create compositing engine=0:00:07.768624, deleted compositing engine=0:01:35.971565, uploaded export assets to compositing eng
 ine=00:00:03.2609860})

 Artifacts                       Status   LogFileDir LogFileName
 ---------                       ------   ---------- -----------
 {output, tags, disk, temporary} complete            AzurePublish.log

 PS C:\TACG>

The publishing of the Image has been completed successfully. All steps of the IPS workflow have completed successfully.

The next step is deploying the Image using Citrix Provisioning Services (PVS). More information about Citrix Provisioning Services (PVS) and how to deploy Images/machines using PVS can be found here: https://docs.citrix.com/en-us/tech-zone/build/deployment-guides/citrix-azure-hibernation-api#creating-a-hibernation-capable-machine-catalog-using-rest-api and https://docs.citrix.com/en-us/tech-zone/learn/tech-briefs/citrix-provisioning.

Part 4: Publishing the Image on Azure to an SMB share for PVS using REST-API

An important prerequisite is a correct App registration in Azure and its IAM settings.

Before we can call the PowerShell script to publish the Image, at least the following parameters must be obtained:

platform                               Azure
platformCredentialId                   Azure credentials stored in the Credential Wallet
resourceLocationId                     ID of the Citrix Cloud Resource location
SubscriptionID                         Azure region where the prepared disk is placed
targetDiskResourceGroupName            Resource group where the prepared disk is placed
virtualNetworkResourceGroupName        Resource group for placing the Compositing engine
virtualNetworkName                     Network for placing the Compositing engine
virtualNetworkSubnetName               Subnet for placing the Compositing engine
targetDiskName                         Name of the disk to be prepared
outputImageFilename                    Name of the published disk 
resourceGroup                          Resource group where the process will run 
timeoutInSeconds                       Timespan before the process will time out
outputDiskName: {                      Name of the prepared disk 
         type                          "SMB” as we publish to a share 
         credentialID                  Credential Wallet-ID of the SMB credential 
         host                          FQDN/IP of the server hosting the SMB share
         sharePath                     Name of the share 
 }

When all values are set we can call the REST-API script to publish the Image.

JSON-Call to start the publishing job:

POST https://api.eu.layering.cloud.com/Images/$publish?async=true`

Authorization:      CWSAuth bearer=  {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}
Accept:            application/json
Content-Type:      application/json

Body (Raw):
  {
  "platform": "Azure",
  "platformCredentialId": "azadminjson",
  "subscriptionId": "58dXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "resourceGroup": "CTX-Hibtest2",
  "virtualNetworkResourceGroupName": "CTX-Hibtest2",
  "virtualNetworkName": "TACG-HibTest-DCCC-vnet",
  "virtualNetworkSubnetName": "default",
  "timeoutInSeconds":86400,
  "targetDiskResourceGroupName": "CTX-Hibtest2",
  "targetDiskName": "procdiskfromipsss",
  "resourceLocationId": "769XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "outputStorageLocation": {
    "type": "SMB",
    "credentialId": "azhibsmb",
    "host": "10.0.0.4",
    "sharePath": "_PVS"
  },
  "outputImageFilename": "ReadyForPVS"
}

Response:

{
    "id": "d44XXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
    "type": "exportImage",
    "overallProgressPercent": 0,
    "isCancellable": true,
    "parameters": [],
    "status": "notStarted",
    "resultLocation": null,
    "additionalInfo": null,
    "warnings": [],
    "error": [],
    "createdAt": "2023-11-23T13:31:48Z",
    "updatedAt": "2023-11-23T13:31:48Z",
    "startedAt": "2023-11-23T13:31:48Z"
}

As the job runs asynchronously, we need another REST-API-call to get the status of the export job using the id parameter from the response:

Example: 100% progress, publishing successful:

JSON-Call to get the status of the publishing job:

GET https://api.eu.layering.cloud.com/jobs/6267XXXX-XXXX-XXXX-XXXX-XXXXXXXXX  

Authorization:      CWSAuth bearer=  {{Bearer-Token-Value}}
Citrix-CustomerId: {{Citrix-CustomerID}}
Accept:            application/json
Content-Type:      application/json

Body (Raw):
{
}

Response - this example shows 100% progress and successful publishing:

{
    "id": "d443XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
    "type": "exportImage",
    "overallProgressPercent": 100,
    "isCancellable": true,
    "parameters": [],
    "status": "complete",
    "resultLocation": null,
    "additionalInfo": {
        "artifacts": {
            "tags": {
                "ctx-job-id": "d443XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
                "component": "compositing"
            },
            "output": [
                {
                    "description": "Published disk",
                    "path": "//10.0.0.4/_PVS/ReadyForPVS.vhd"
                }
            ],
            "temporary": [
                {
                    "description": "Temporary Compositing Engine OS disk",
                    "name": "ce-f32672a0-os-disk",
                    "resourceGroup": "CTX-Hibtest2"
                },
                {
                    "description": "Temporary Compositing Engine NIC",
                    "name": "ce-f32672a0-nic",
                    "resourceGroup": "CTX-Hibtest2"
                },
                {
                    "description": "Temporary Compositing Engine network security group",
                    "name": "ce-f32672a0-nic-nsg",
                    "resourceGroup": "CTX-Hibtest2"
                },
                {
                    "description": "Temporary Compositing Engine VM",
                    "name": "ce-f32672a0",
                    "resourceGroup": "CTX-Hibtest2",
                    "encryptionAtHost": false
                },
                {
                    "description": "Temporary copy of the target disk",
                    "name": "procdiskfromipsss-f5276f68",
                    "resourceGroup": "CTX-Hibtest2"
                }
            ],
            "disk": {
                "diskPath": "\\\\10.0.0.4\\_PVS\\ReadyForPVS.vhd",
                "md5Hash": "f96519ee184ba47ba33f03d09384188b"
            }
        },
        "profile": {
            "prepared to create compositing engine": "0:00:07.449354",
            "created compositing engine": "0:03:01.894559",
            "uploaded export assets to compositing engine": "00:00:04.7360280",
            "deleted compositing engine": "0:01:40.349551"
        },
        "warnings": [],
        "errors": []
    },
    "warnings": [],
    "error": [],
    "createdAt": "2023-11-23T13:31:48Z",
    "updatedAt": "2023-11-23T14:39:54Z",
    "startedAt": "2023-11-23T13:31:48Z",
    "endedAt": "2023-11-23T14:39:54Z"
}

The publishing of the Image has been completed successfully. All steps of the IPS workflow have completed successfully. The next step is deploying the Image using Citrix Provisioning Services (PVS). More information about Citrix Provisioning Services (PVS) and how to deploy Images/machines using PVS can be found here: https://docs.citrix.com/en-us/tech-zone/build/deployment-guides/citrix-azure-hibernation-api#creating-a-hibernation-capable-machine-catalog-using-rest-api and https://docs.citrix.com/en-us/tech-zone/learn/tech-briefs/citrix-provisioning.

Part 4: Publishing the Image on Azure to an SMB share for PVS using the .NET application

The Windows .NET application encapsulates REST-API calls to prepare the Image on Azure.

An important prerequisite is a correct App registration in Azure and its IAM settings.

Before we can use the application to publish the Image, at least the following parameters must be obtained:

platform                               Azure
platformCredentialId                   Azure credentials stored in the Credential Wallet
resourceLocationId                     ID of the Citrix Cloud Resource location
SubscriptionID                         Azure region where the prepared disk is placed
targetDiskResourceGroupName            Resource group where the prepared disk is placed
virtualNetworkResourceGroupName        Resource group for placing the Compositing engine
virtualNetworkName                     Network for placing the Compositing engine
virtualNetworkSubnetName               Subnet for placing the Compositing engine
targetDiskName                         Name of the disk to be prepared
timeoutInSeconds                       Timespan before the process will time out
SmbHost                                FQDN/IP of the server hosting the SMB share
SmbShare                               Name of the SMB share
SmbDiskName                            Name of the published disk on the SMB share
SmbDiskFormat                          Disk format

These parameters are set in a JSON-file:

When all parameters are set, the publishing of the uploaded Image can be started by pressing the “Publish VHD...” button. The publishing process lasted in this example for about 65 minutes…

The publishing of the Image has been completed successfully.

Appendix

Code Snippets

Quote

Important Note:

These code snippets show examples how to implement the API calls and PowerShell scripts into an application.

No warranty, no liability, and no support of any kind are given for the application.

Example of Objects

Public Class CCAPI_Token
    Public Property CustomerID As String
    Public Property ClientID As String
    Public Property ClientSecret As String
    Public Property GrantType As String
End Class

Public Class CCAPI_ExportParameters 'Nested object
    Public Property platform As String
    Public Property platformCredentialId As String
    Public Property vCenterHost As String
    Public Property vCenterPort As Integer
    Public Property vCenterSslNoCheckHostname As String
    Public Property datacenter As String
    Public Property datastore As String
    Public Property cluster As String
    Public Property network As String
    Public Property prefix As String
    Public Property resourceLocationId As String
    Public Property outputStorageLocation As CCAPI_OutputStorageLocation
    Public Property outputImageFilename As String
    Public Property timeoutInSeconds As Integer
    Public Property sourceDiskName As String
End Class

Public Class CCAPI_OutputStorageLocation
      Public Property type As String
      Public Property credentialId As String
      Public Property host As String
      Public Property sharePath As String
End Class

Example of JSON-based variables

CCAPI-Token.json -> read into Class CCAPI_Token at startup:

{
  "CustomerID": "uzXXXXXXXXXXXXX",
  "ClientID": "5075XXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX",
  "ClientSecret": "8MXXXXXXXXXXXXXXXXXXXXX==",
  "GrantType": "client_credentials"
}

Obtain a Bearer token from Citrix Cloud

Private Sub FetchBearerToken(ByVal obj_CCAPI_Token As CCAPI_Token)
     'Create POST request to Citrix Cloud-API to retrieve BearerToken
     Dim rest As New Chilkat.Rest

     ' Connect to the CCAPI server.
     Dim bTls As Boolean = True
     Dim port As Integer = 443
     Dim bAutoReconnect As Boolean = True
     Dim success As Boolean = rest.Connect("api-eu.cloud.com", port, bTls, bAutoReconnect)
     If (success <> True) Then
         Debug.WriteLine(rest.LastErrorText)
         Exit Sub
     End If
     success = rest.AddQueryParam("grant_type", obj_CCAPI_Token.GrantType)
     success = rest.AddQueryParam("client_id", obj_CCAPI_Token.ClientID)
     success = rest.AddQueryParam("client_secret", obj_CCAPI_Token.ClientSecret)
     Dim APIPostCallPath As String = "/cctrustoauth2/" & obj_CCAPI_Token.CustomerID & "/tokens/clients"
     Dim s_Response As String = Nothing
     obj_BearerToken = New CCAPI_BearerToken

     Try
         s_Response = rest.FullRequestFormUrlEncoded("POST", APIPostCallPath)
         obj_BearerToken = JsonConvert.DeserializeObject(Of CCAPI_BearerToken)(s_Response, JSONSettings)

     Catch exc As Exception
         Console.WriteLine(exc.ToString)
     End Try

     If s_Response <> "" Then
         Dim json As JObject = JObject.Parse(s_Response)
         obj_BearerToken.TokenType = json.SelectToken("token_type")
         obj_BearerToken.Expiry = json.SelectToken("expires_in")
         obj_BearerToken.AccessToken = json.SelectToken("access_token")

         txtParams(0) = txt_status
         txtParams(1) = "Successfully obtained Bearer-Token..." & vbCrLf
         Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)

         txt_bearertoken.Text = obj_BearerToken.AccessToken.ToString

         txtParams(0) = txt_status
         txtParams(1) = "-------------------------------" & vbCrLf & vbCrLf
         Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)
     End If
 End Sub

Set all Export parameters and export Image from vSphere

Private Sub SetAllExportParameters(ByVal obj_CCAPI_Token As CCAPI_Token)
    s_APIBody = New Chilkat.StringBuilder
    s_APIBody.AppendLine("{", True)
    obj_AllExportParameters = New CCAPI_ExportParameters
    obj_AllExportParameters.outputStorageLocation = New CCAPI_OutputStorageLocation
    obj_AllExportParameters.vCenterPort = 443
    s_APIBody.AppendLine((Chr(34) & "vCenterPort" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.vCenterPort & Chr(34) & ","), True)
    obj_AllExportParameters.vCenterHost = obj_Export.vCenterHost
    s_APIBody.AppendLine((Chr(34) & "vCenterHost" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.vCenterHost & Chr(34) & ","), True)
    obj_AllExportParameters.vCenterSslNoCheckHostname = True
    s_APIBody.AppendLine((Chr(34) & "vCenterSslNoCheckHostname" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.vCenterSslNoCheckHostname & Chr(34) & ","), True)
    obj_AllExportParameters.platformCredentialId = s_VSPCredID
    s_APIBody.AppendLine((Chr(34) & "platformCredentialId" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.platformCredentialId & Chr(34) & ","), True)
    obj_AllExportParameters.datacenter = obj_Export.datacenter
    s_APIBody.AppendLine((Chr(34) & "datacenter" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.datacenter & Chr(34) & ","), True)
    obj_AllExportParameters.network = obj_Export.network
    s_APIBody.AppendLine((Chr(34) & "network" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.network & Chr(34) & ","), True)
    obj_AllExportParameters.datastore = obj_Export.datastore
    s_APIBody.AppendLine((Chr(34) & "datastore" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.datastore & Chr(34) & ","), True)
    obj_AllExportParameters.cluster = obj_Export.cluster
    s_APIBody.AppendLine((Chr(34) & "cluster" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.cluster & Chr(34) & ","), True)
    obj_AllExportParameters.outputImageFilename = obj_Export.outputImageFilename
    s_APIBody.AppendLine((Chr(34) & "outputImageFilename" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.outputImageFilename & Chr(34) & ","), True)
    s_APIBody.AppendLine((Chr(34) & "outputStorageLocation" & Chr(34) & ": {"), True)
    obj_AllExportParameters.outputStorageLocation.credentialId = s_SMBCredID
    s_APIBody.AppendLine((Chr(34) & "credentialId" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.outputStorageLocation.credentialId & Chr(34) & ","), True)
    obj_AllExportParameters.outputStorageLocation.type = obj_Export.smb.type
    s_APIBody.AppendLine((Chr(34) & "type" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.outputStorageLocation.type & Chr(34) & ","), True)
    obj_AllExportParameters.outputStorageLocation.host = obj_Export.smb.host
    s_APIBody.AppendLine((Chr(34) & "host" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.outputStorageLocation.host & Chr(34) & ","), True)
    obj_AllExportParameters.outputStorageLocation.sharePath = obj_Export.smb.sharePath
    s_APIBody.AppendLine((Chr(34) & "sharePath" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.outputStorageLocation.sharePath & Chr(34)), True)
    s_APIBody.AppendLine(("},"), True)
    obj_AllExportParameters.platform = "vSphere"
    s_APIBody.AppendLine((Chr(34) & "platform" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.platform & Chr(34) & ","), True)
    obj_AllExportParameters.prefix = obj_Export.prefix
    s_APIBody.AppendLine((Chr(34) & "prefix" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.prefix & Chr(34) & ","), True)
    obj_AllExportParameters.resourceLocationId = s_RLID
    s_APIBody.AppendLine((Chr(34) & "resourceLocationId" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.resourceLocationId & Chr(34) & ","), True)
    obj_AllExportParameters.sourceDiskName = obj_Export.sourceDiskName
    s_APIBody.AppendLine((Chr(34) & "sourceDiskName" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.sourceDiskName & Chr(34) & ","), True)
    obj_AllExportParameters.timeoutInSeconds = obj_Export.timeoutInSeconds
    s_APIBody.AppendLine((Chr(34) & "timeoutInSeconds" & Chr(34) & ": " & Chr(34) & obj_AllExportParameters.timeoutInSeconds & Chr(34)), True)
    s_APIBody.AppendLine(("}"), True)
End Sub

Private Sub but_export_Click(sender As Object, e As EventArgs) Handles but_export.Click
    Dim rest As New Chilkat.Rest
    ' Connect to the CCAPI server.
    Dim bTls As Boolean = True
    Dim port As Integer = 443
    Dim bAutoReconnect As Boolean = True
    Dim success As Boolean = rest.Connect("api.eu.layering.cloud.com", port, bTls, bAutoReconnect)
    If (success <> True) Then
        Debug.WriteLine(rest.LastErrorText)
        Exit Sub
    End If
    success = rest.AddHeader("Citrix-CustomerId", obj_CCAPI_Token.CustomerID)
    success = rest.AddHeader("Authorization", "CWSAuth bearer=" & obj_BearerToken.AccessToken.ToString)
    success = rest.AddHeader("Accept", "application/json")
    success = rest.AddHeader("Content-Type", "application/json")
    Dim APIPostCallPath As String = "/Images/$export?async=true"
    Dim s_Response As String = Nothing
    s_APIResponse = New Chilkat.StringBuilder
    Dim s_REsp As String
    Try
        success = rest.FullRequestSb("POST", APIPostCallPath, s_APIBody, s_APIResponse)
        s_REsp = s_APIResponse.GetAsString
        obj_ExportResponse = New CCAPI_ExportResponse
        obj_ExportResponse = JsonConvert.DeserializeObject(Of CCAPI_ExportResponse)(s_REsp, JSONSettings)
        ‘Enable timer to get progress of asynchronous process
        timer_progress.Enabled = True

    Catch exc As Exception
        Console.WriteLine(exc.ToString)

    End Try

End Sub

Invoke PowerShell to upload Image to Azure

Private Sub Invoke_PowerShellToUpload()
    Dim sessionState = InitialSessionState.CreateDefault()
    sessionState.ExecutionPolicy = Microsoft.PowerShell.ExecutionPolicy.Unrestricted

    Using powershell As PowerShell = PowerShell.Create(sessionState)
        powershell.AddCommand("Copy-DiskToAzure")
        powershell.AddParameter("Filename", obj_AllUploadParams.Filename)
        powershell.AddParameter("ManagedDiskName", obj_AllUploadParams.ManagedDiskname)
        powershell.AddParameter("SubscriptionId", obj_AllUploadParams.SubscriptionID)
        powershell.AddParameter("Location", obj_AllUploadParams.Location)
        powershell.AddParameter("ResourceGroup", obj_AllUploadParams.ResourceGroup)
        powershell.AddParameter("Timeout", obj_AllUploadParams.Timeout)
        lbl_upload.Text = "Uploading..."
        pb_upload.Value = 25
***** SNippet mus be completed, sync to GitHub failed *****
     End Using

End Sub

Start preparation of Image

Private Sub but_prepareVHD_Click(sender As Object, e As EventArgs) Handles but_prepareVHD.Click
        Dim rest As New Chilkat.Rest

        ' Connect to the CCAPI server.
        Dim bTls As Boolean = True
        Dim port As Integer = 443
        Dim bAutoReconnect As Boolean = True

        Dim success As Boolean = rest.Connect("api.eu.layering.cloud.com", port, bTls, bAutoReconnect)
        If (success <> True) Then
            Debug.WriteLine(rest.LastErrorText)
            Exit Sub
        End If

        success = rest.AddHeader("Citrix-CustomerId", obj_CCAPI_Token.CustomerID)
        success = rest.AddHeader("Authorization", "CWSAuth bearer=" & obj_BearerToken.AccessToken.ToString)
        success = rest.AddHeader("Accept", "application/json")
        success = rest.AddHeader("Content-Type", "application/json")

        Dim APIPostCallPath As String = "/images/$prepare?async=true"
        Dim s_Response As String = Nothing

        txtParams(0) = txt_status
        txtParams(1) = "Sending REST-Call to prepare Image to SMB share..." & vbCrLf
        Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)

        s_APIResponse = New Chilkat.StringBuilder
        Dim s_REsp As String

        Try
            success = rest.FullRequestSb("POST", APIPostCallPath, s_APIBody, s_APIResponse)
            s_REsp = s_APIResponse.GetAsString
            obj_PrepareResponse = New CCAPI_PrepareResponse
            obj_PrepareResponse = JsonConvert.DeserializeObject(Of CCAPI_PrepareResponse)(s_REsp, JSONSettings)
            timer_prepare.Enabled = True

        Catch exc As Exception
            Console.WriteLine(exc.ToString)

        End Try

    End Sub

Public Sub GetPrepareProgress(ByVal obj_CCAPI_Token As CCAPI_Token, ByVal obj_PrepareResponse As CCAPI_PrepareResponse)
        pb_prepare.Value = 5

        Dim rest As New Chilkat.Rest

        ' Connect to the CCAPI server.
        Dim bTls As Boolean = True
        Dim port As Integer = 443
        Dim bAutoReconnect As Boolean = True

        Dim success As Boolean = rest.Connect("api.eu.layering.cloud.com", port, bTls, bAutoReconnect)
        If (success <> True) Then
            Debug.WriteLine(rest.LastErrorText)
            Exit Sub
        End If

        success = rest.AddHeader("Citrix-CustomerId", obj_CCAPI_Token.CustomerID)
        success = rest.AddHeader("Authorization", "CWSAuth bearer=" & obj_BearerToken.AccessToken.ToString)
        success = rest.AddHeader("Accept", "application/json")
        success = rest.AddHeader("Content-Type", "application/json")

        Dim APIPostCallPath As String = "/jobs/" & obj_PrepareResponse.id
        Dim s_Response As String = Nothing

        Dim i_Progress As Integer

        Try
            s_Response = rest.FullRequestFormUrlEncoded("GET", APIPostCallPath)

            's_REsp = s_APIResponse.GetAsString
            obj_JobProgressResponse = New cc
            obj_JobProgressResponse = JsonConvert.DeserializeObject(Of CCAPI_JobProgressResponse)(s_Response, JSONSettings)
            'GetExportProgress(obj_CCAPI_Token, obj_ExportResponse)

            i_OverallProgress = CInt(obj_JobProgressResponse.overallProgressPercent)
            If i_OverallProgress <> 0 Then
                pb_prepare.Value = i_OverallProgress

            End If
            s_ProgressStatus = obj_JobProgressResponse.status
            lbl_progressstatus.Text = "Progress-Status: " & s_ProgressStatus

            If obj_JobProgressResponse.error.Length <> 0 Then
                Dim s_error As String
                s_error = obj_JobProgressResponse.error(0).ToString
                pb_prepare.BackColor = Color.Red
                pb_prepare.ForeColor = Color.Red

                pb_prepare.Value = 100
                lbl_progressstatus.Text = "Error - see logs!"
                timer_progress.Enabled = False
                txtParams(0) = txt_status
                txtParams(1) = "Export failed - see logs!..." & vbCrLf
                Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)
                txtParams(0) = txt_status
                txtParams(1) = "-------------------------------" & vbCrLf & vbCrLf
                Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)

            End If

            If s_ProgressStatus = "Complete" Then

                pb_prepare.Value = 100
                lbl_progressstatus.Text = s_ProgressStatus
                timer_progress.Enabled = False
                txtParams(0) = txt_status
                txtParams(1) = "Export successful!" & vbCrLf
                Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)
                txtParams(0) = txt_status
                txtParams(1) = "-------------------------------" & vbCrLf & vbCrLf
                Me.Invoke(New WriteTextDelegate(AddressOf WriteText), txtParams)

            End If

            ' s_ProgressError = obj_JobProgressResponse.error

        Catch exc As Exception
            Console.WriteLine(exc.ToString)

        End Try
    End Sub

Citrix Secure Access with Chrome Enterprise

Wed, 17 Sep 2025 16:29:00 +0000

Overview

The Citrix Secure Access (CSA) with Chrome Enterprise (CE) solution enables secure, adaptive, and high-performance Zero Trust Network Access (ZTNA) to all applications from Chrome Enterprise-managed browsers. Designed as a cutting-edge, cloud-delivered platform, it leverages the robust security and management capabilities of Chrome Enterprise directly at the endpoint, providing a comprehensive solution for modern application access. By leveraging Citrix Secure Private Access, it adheres strictly to Zero Trust principles, ensuring that access is continuously verified based on user identity, device posture, and application context, rather than implicit trust.

This deployment guide provides you with the essential steps to install and configure Citrix Secure Private Access in conjunction with Chrome Enterprise. It focuses on establishing a foundation for secure application delivery, allowing you to leverage your existing knowledge of Citrix policy and access management in this modern context.

The following key steps are covered in this guide:

Prepare the Citrix Cloud Environment for Secure Private Access

Configure Chrome Enterprise for managed browser and policy integration

Deploy and Configure Citrix Secure Access connectors for private application access

Define and Apply Adaptive Access Policies for SaaS, private web, and private TCP/UDP applications

Enable User Access and validate the secure application delivery flow from Chrome Enterprise endpoints

For detailed information regarding advanced Chrome Enterprise policies (beyond basic integration), specific application-level security controls, or in-depth troubleshooting, please refer to the respective Citrix Secure Private Access product documentation and Google Chrome Enterprise documentation.

Secure Access Delivery Options

Modern secure access solutions offer flexibility in deployment, catering to various organizational needs and infrastructure setups. The two primary models are cloud-native and hybrid.

This proof-of-concept (PoC) guide will focus exclusively on the steps for a cloud-native deployment, as it represents a streamlined and increasingly popular approach for modern secure access delivery.

Prerequisites

Chrome Enterprise Premium subscription

Citrix Workspace subscription configured with an identity provider (IdP)

Citrix Secure Private Access subscription

Admin access to Google Workspace Admin Console

Google Customer ID

Create a Resource Location

A Resource Location is a logically defined grouping within your network (on-premises or cloud) where your private applications and resources reside. It is connected to the Citrix Cloud service via a connector appliance for Zero Trust access. It serves as the bridge between your private app infrastructure and the cloud-delivered access control plane.

Within Citrix Cloud, select the menu button in the upper left hand corner and launch Resource Locations

If no resource locations exist, go ahead and create one by selecting “+ Resource Locations”

Once a Resource Location has been defined, add a Connector Appliance
Select your preferred hypervisor and download the corresponding file
Once downloaded, import it into your hypervisor. Once the appliance starts, you will see the access IP Address to complete configuration of the appliance.

The first time you connect to the appliance, you have to configure the logon password. Once complete, you will see the appliance dashboard.

If you want to reconfigure the network settings, do it now by selecting the Edit Network Settings button. Once updated, the appliance will automatically reboot.

Give the appliance a name
When you get the registration code, copy the value

Go back to the Citrix Cloud web page and paste this code into the Add a Connector Appliance dialog box

Once the details have been confirmed, you can register the appliance. Once complete, you will see the new connector appliance in your resource location

Note:

If this is the first appliance, you will receive a warning message indicating that you should have at least two connectors per resource location to provide high availability. As this is just a test environment, you can ignore it.

Onboarding Workflow

Once your Resource Locations are established, the next step is to define the specific applications that your users will access through Citrix Secure Access. An app, in this context, refers to a discreet service or resource (such as a SaaS application, an internal web application, or a private TCP/UDP application) that requires secure, policy-driven access. Each defined app represents an entry point for secure access, allowing the Citrix Cloud service to apply granular Zero Trust policies and deliver the application securely to the user's endpoint.

In this example, an internal web application will get added.

Within Citrix Cloud, select the menu button in the upper left hand corner and launch Secure Private Access

If this is your first time building Secure Private Access, you will be guided through an initial setup flow. Select Fully Cloud-delivered Service architecture

Google Chrome Integration

To integrate with Google Chrome, copy the Citrix service account address and select the Google Workspace admin roles link.
In the Google Chrome – Admin Roles console, select Create New Role
Select Create new role and give it a name like Chrome Enterprise Premium Admin

Add the following privileges to this role.

When the privileges are added, select Continue and Create Role

With the role created, select Assign Service Accounts
Paste the Citrix Service Account Address you copied earlier. Select Add and Assign Role

Back in the Citrix console, use the workflow and link to find and add your Google customer ID

With the information provided, select "Run CEP Verification”. Select Next. If verification was not successful, verify the privileges are assigned correctly.

Device Posture

You can obtain device posture status from third party services, but in this example, simply skip this option
Citrix also provides a device posture service integrated with Secure Private Access. For this example, skip this process

Add a Private Web App

The next part of the process is to define an application. Select Add an app
The first part of your application definition is to define the initial details for the app. In this example, the app is
1. Inside your corporate network
2. App Type: HTTP/HTTPS
3. App Name: This is the name users will see
4. App Icon: This will be the icon users will see
The second part of the application definition is to specify the URL for the app.
1. Agentless Access: Disabled. Citrix Secure Private Access provides the ability to access private web apps without requiring an agent. However, this configuration is out-of-scope for this guide.
2. URL: Provide the internal HTTPS address for the private web application
3. Routing Type: Select Internal via Connector. This routes the connection through the resource location and connector created earlier.
4. Resource Location: Select the resource location created earlier.
A related domain entry was created. Edit this to select the correct resource location
Select Finish to end the Add an app workflow
You now have a list of applications you are creating with the initial workflow. Select Next to define the access policies

Define Adaptive Access Policy

Building upon the foundation of defined Resource Locations and Applications, the next critical phase in securing your digital workspace involves Creating Adaptive Access Policies. These policies are the intelligence layer of Citrix Secure Private Access, allowing you to move beyond static, binary access decisions to a dynamic, context-aware security model. By leveraging real-time information about the user, their device posture, location, and the specific application being accessed, Adaptive Access Policies enable granular control and significantly enhance your Zero Trust security posture.

This section will guide you through the process of designing and implementing these powerful policies, ensuring that the right users receive the right level of access to the right applications, under the right conditions.

Note

You would typically have one Policy per application (or group of similar applications), and that Policy would contain multiple Rules to handle different scenarios for accessing that specific app.

Continuing from the initial app setup workflow, select Create policy to start defining your access policy

Policy Definition
1. Give the policy a name. This is the overarching name for a set of conditions that determine access to a specific application or group of applications
2. Select the applications associated with this policy. So far, you should only have one app
Inside each Policy, you define one or more Rules. Each rule specifies a particular set of conditions (e.g., device posture, user group, network location) and the actions to take (e.g., allow access, deny access, apply watermarking, force browser isolation) if those conditions are met. Rules are evaluated in order of precedence. Go ahead and Create a Rule
Provide a name for the rule. A good rule name should quickly convey who it applies to, what conditions trigger it, and what action or outcome it produces

For conditions of the policy, this will be a very simple policy applied to all domain users

The action is to allow access to the app

Once defined, complete the workflow by selecting Finish
Select Save to complete the policy workflow
This is the final step for the initial app creation wizard. Go ahead and complete the workflow

Verify Google Chrome Onboarding

Once the workflow is complete, backend processes will integrate your Google Chrome tenant with Citrix Services. To monitor the status of the onboarding process, in the Citrix Cloud console, navigate to: Secure Private Access – Browser Settings – Browser.

Do not continue until integration is complete.

Create Google Chrome Users

There are a few ways to define users in Google's directory, and the best method depends on the size of your organization and whether you have an existing directory like Active Directory. For Chrome Enterprise Premium, users must exist in Cloud Identity or a Google Workspace account.

Manual User Creation

For small organizations or for a few specific accounts, you can create users one-by-one directly in the Google Admin console.

Navigate to Directory > Users.

Click the "Add new user" button.

Fill in the user's details, including first name, last name, and primary email address.

Set a temporary password and choose whether to force the user to change it on their first login.

Bulk User Creation with a CSV

If you have a larger number of users but don't use an on-premises directory, you can create them in bulk by uploading a CSV file.

From the Users page in the Admin console, click the "Bulk update users" icon.

Download the provided CSV template.

Fill in the template with your users' information (name, email, password, etc.).

Upload the completed CSV file to create all the user accounts at once.

Automated Sync with Google Cloud Directory Sync (GCDS)

This is the most common and recommended method for organizations with an existing on-premises LDAP directory, such as Microsoft Active Directory. GCDS is a one-way synchronization tool that keeps your Google directory up to date.

Install GCDS: Install the GCDS application on a server in your environment.

Configure the Connection: Use the GCDS Configuration Manager to connect to your LDAP server and your Google account.

Create Sync Rules: Define which users, groups, and organizational units (OUs) you want to sync from your LDAP server to Google using LDAP queries. You can also set exclusion rules to prevent certain accounts from syncing.

Simulate and Sync: Run a simulation to preview the changes. Once you are satisfied, run a full sync to apply the changes to your Google directory.

Schedule Syncs: Set up a scheduled task to run GCDS regularly, ensuring your Google directory stays synchronized.

Use the Google Cloud Directory Sync guide to provide details on how to setup and configure

Third-Party Identity Provider (IdP) Provisioning

If you use a cloud-based IdP like Microsoft Entra ID (formerly Azure AD), you can set up automatic provisioning using the SCIM protocol. This allows user and group changes made in your IdP to automatically sync to your Google directory, streamlining the user lifecycle management process.

Configure Chrome Policies

Policies control how your users interact with Chrome. By configuring these policies, you can enforce a wide range of settings—from managing privacy and security features to controlling app and extension behavior—to ensure a consistent and secure Browse environment.

In the Google Admin console (admin.google.com), navigate to Chrome Browser - Settings

Search for the setting “Custom theme color”

Select the setting

Modify the Hex Color to be #003893. This will change the browser’s color when it is being managed by the policies.

Save the configuration.

Validate Chrome Configuration

Start Chrome and Sign in to Chrome

Once you successfully authenticate to Chrome, the browser’s color should change. You will also notice that three Chrome browser extensions were also automatically added. These extensions are used to provide agentless access to your private apps.

Validate Private App Access

With Chrome settings verified, the final step is private app access validation. This ensures that your newly defined application is accessible as intended, and that your granular policies are being enforced correctly.

Within your managed Chrome browser profile, try to access the private web app you defined earlier. If this doesn't succeed, verify the app is configured correctly, the cloud connector appliance is functional, that the cloud connector can communicate with the web app, and that the web app is online. ,
Once you connect to the private web app, verify session details within the Citrix Cloud admin console. On your admin desktop, log into the Citrix Cloud console.
Select Monitor from the menu bar in the top left corner.
You should see an active session within the Web/SaaS/TCP/UDP-Active Sessions graph. Select the number to get more details
Select the active session from the list

To get more details, select the Resource Name link from the session
This dashboard provides extensive information about the current session, including topology, app, policy, and more.

Summary

This deployment guide walked you through the end-to-end process of setting up secure access to private web applications using Citrix Secure Access with Chrome Enterprise. By following these steps, you have successfully:

Established a secure foundation by creating a resource location and defining your private web applications.

Implemented a robust security model by configuring adaptive access policies to control who can access your applications and under what conditions.

Provisioned user accounts in your Google directory, ensuring a seamless user experience.

Enforced a secure browser environment by configuring policies across your organization.

With this setup complete, you have a powerful and secure framework for delivering applications to your users, fully leveraging the Zero Trust capabilities of Citrix Secure Access with Chrome Enterprise.

Deploy FlexApp One Applications with Citrix DaaS

Tue, 10 Sep 2024 11:47:00 +0000

Overview

FlexApp is an application layering solution developed by Liquidware that attaches any application to a Windows session without modifying the underlying base image via the traditional application installation process.

FlexApp One applications are encapsulated in a single, shareable file, allowing them to operate without requiring an additional application player on Windows sessions. Users can initiate the application by clicking on the container file, which quickly integrates the application(s) into their Windows workspace. This solution is compatible with all Windows session types and supports various Windows application formats, including EXE, MSI, and MSIX.

Citrix DaaS can deliver FlexApp applications to end users through the Citrix Personalization component and FlexApp delivery agent from single or multi-session Citrix Virtual Delivery Agents (VDA).

This proof of concept guide provides the steps to deliver FlexApp applications via Citrix DaaS. The following is covered in this guide:

Installation of the Citrix Personalization component
Installation of the FlexApp service
Citrix DaaS FlexApp package discovery
Add FlexApp applications to a Delivery Group
Connect via Citrix Gateway Service to launch a FlexApp application

Prerequisites

An existing Citrix DaaS subscription
Windows Server 2022 Image
- Windows Server 2019 and Windows 10/11 single session are also supported.
Citrix VDA 2402 ISO downloaded
SMB network or Azure File Share
- The Citrix VDA must have read permission to the storage path. For more information on the permissions required for Azure File Share, visit our product documentation.
FlexApp One application(s)
- Pre-packaged FlexApp applications can be downloaded from Liquidware for testing purposes.
Citrix Delivery Group
- The Citrix Delivery Group must have Citrix VDAs with VDA version 2311 or later installed.
- The Citrix Personalization component must be installed on the VDAs within the Delivery Group.

Prepare Citrix Virtual Delivery Agent

The Citrix Personalization component and the FlexApp agent must be installed on the Citrix VDA to support the delivery of FlexApp applications.

Install Citrix Personalization component

The Citrix Personalization component manages the publishing process for the FlexApp application package and is not installed by default during the VDA installation process. We will use an existing VDA for our deployment and add the component. The component can be installed during the initial VDA install as well.

Connect to your Windows Server VDA.
Mount your Citrix Virtual Apps and Desktops ISO

Open Apps & Features, select Citrix Virtual Apps and Desktops 7 2402 LTSR - Virtual Delivery Agent, and click Modify.

Click Yes to allow the app to make changes if prompted.

Select Add components and prerequisites.

Click Next on the Core Components window.

Select Citrix Personalization for App-V - VDA and click Next.

Click Next on the Delivery Controller Window.

Click Next on the Features window.

Click Next on the Firewall windows.

Review the Summary page and click Install.

The Citrix App Personalization component installs.

The install completes. Click Next.

Click Finish.

You have successfully installed the Citrix App Personalization component.

Install FlexApp Service

The FlexApp One service is required on the Citrix VDA to deliver FlexApp One applications. If you have a FlexApp environment, install the agent and FlexApp applications on your VDA.

For our POC deployment, we will use the FlexApp One pre-packaged test applications. To activate the FlexApp service (LwlContainerService), we must open one of the FlexApp test applications to install and start the service on your Citrix VDA automatically.

Download and extract 2 or 3 of the pre-packaged FlexApp One applications to your file share.

Open your file share and run the executable for one of FlexApp applications.

When prompted, click Yes to install FlexApp onto the Citrix VDA.

Click OK once FlexApp is installed to activate your FlexApp application.

The application launches. Close the application and open Services to validate that the LwlContainerService is running and that the Startup Type is set to Automatic.

Once confirmed, you can exit out of your Citrix VDA.

Upload Applications to Citrix DaaS

Connect to Citrix DaaS web console and select App Packages.

Click Add Source or Package.

There are two ways to add FlexApp packages to Citrix DaaS: add the file share where all FlexApp One applications are stored or add a single package. For our deployment, we are adding our file share source.

Select Add Source.

Provide a name for the App Package source and select the Delivery Group you have created to deliver FlexApp One packages.

Choose Network share under Location type. Provide the UNC path, select FlexApp for package type, and select Yes for subfolder search. Click Add Source.

The Add Source process runs.

Once complete, the Source added will display in the Sources tab within App Packages with Import successful status.

Click Packages.

The FlexApp One packages stored within your file share will be displayed.

Add FlexApp apps to Delivery Group

Select the first FlexApp package to be added to your Delivery Group and click Assign to delivery groups.

Select the applications to assign and click Next.

Select your Delivery Group and click Next.

Review the summary page and click Finish.

Repeat the process for any further FlexApp applications assigned to the Delivery Group.

Validate and Launch FlexApp Application

Open your Citrix Workspace app or browse your Citrix Workspace.
Validate that the FlexApp applications added to your Delivery Group are present.

Launch the FlexApp application.

Your FlexApp application launches successfully.

Validate the application launch within Citrix DaaS web console.

Summary

This guide walked you through the configuration of deploying FlexApp One application packages to Citrix DaaS. This consisted of installing the Citrix Personalization components, installing the FlexApp service, Citrix DaaS FlexApp package discovery, adding FlexApp applications to a Delivery Group, and launching a FlexApp application via Citrix Workspace. For more information on deploying FlexApp applications, visit the Citrix App Packages product documentation.

How to connect PowerBI with DaaS Monitor using OData and API clients

Fri, 09 Feb 2024 12:31:00 +0000

Overview

As a Citrix DaaS customer, it’s typical that more than one monitoring tool is being used within your organization. Different teams use different solutions - one team might monitor infrastructure components while another is responsible for security and threat hunting. The need for observability and centralized dashboards is high on your wishlist. Citrix has a way to help! This POC Guide shows you how to build a basic dashboard. While we’ll use PowerBI, this can be any solution of your choice, capable of connecting and fetching data via OData.

For better readability and documentation, the keys and secrets in this blog aren’t blurred. The customer-tenant ID, key, and secrets in the screenshots are invalid - always replace them with your connection details.

Create an API client in Citrix Cloud

The first thing to do is to create an API client. A Citrix Cloud account is required to use Citrix Cloud Services APIs. If you’re a new administrator, you must ask an existing Citrix Cloud administrator to invite you and grant permission to Citrix DaaS, Identity and Access Management, or otherwise create an API client for you. Log in to Citrix Cloud to get started. Once you have access to Citrix Cloud, follow these steps.

In the Citrix Cloud console, click the menu in the upper left corner of the screen.
Select the Identity and Access Management option from the menu. If this option does not appear, you may not have adequate permissions to create an API client.
Select the API Access tab.
Name your Secure Client meaningfully so other Cloud Admins can later tell what this key is used for - for example, PowerBI-Dashboard, and click Create Client.
The following message appears: ID and Secret have been created successfully. Download or copy and save the Client ID and Secret. You’ll need both to access the APIs.
After closing the previous dialog, take note of the customer ID in the description above the Create Client button or at the CCID label in the top right corner of your screen. You’ll later need this to access the APIs.

Create a Bearer Token - Manually

First, test if we can authenticate and fetch data. Maybe there’s a proxy or firewall restriction in place that you aren’t aware of. We keep things simple to avoid unnecessary troubleshooting. There are two ways to do this: using the developer portal and API explorer or using the command line.

Using the API explorer

One of the simplest ways is to open our developer portal and make use of the Invoke API function.
After clicking Invoke API, click the Authorize button. A popup appears asking for the Client ID and Client Secret that was downloaded in earlier.
When you click Generate, the form provides a bearer token for authentication. When you triple-click or single-click and CTRL+A, you can select and copy the bearer token.
If you used this method, take a copy of the bearer token to a temporary notepad for simplicity. Notice that the token has the format CwsAuth bearer= before it starts with the token itself. It’s also important to remember that Bearer tokens are typically valid for an hour, after which they expire. Follow the same steps to generate a new token if this token turns invalid during this process.

Quote

Note:

By the end of this guide, PowerBI will automatically create tokens.

Using cURL

We’re using GIT for Windows and Git Bash, which comes with this bundle. You can also download a cURL client or Linux on Windows or whatever option suits you best. The commands will likely be the same.

Run this command after replacing the US with your region (US, EU, AP-S, or Japan cloud api.citrixcloud.jp), the client_id, and the client_secret with the details you created earlier.

curl 'https://api-us.cloud.com/cctrustoauth2/root/tokens/clients' --data-raw 'client_id=a7bd32de-h6c6-41d8-9138-d24354fb758a&client_secret=B9bhC3cn_08Ot9axi_5cgD==%3D%3D&grant_type=client_credentials'

Quote

Note:

Other than using the browser method, you’ll get access_token beginning with ey.. and must manually add CwsAuth bearer= in front.
If you used this method, take a copy of the bearer token to a temporary notepad for simplicity.

Connect to Citrix Cloud with Power BI

Prepare the connection details, as you must use them multiple times.
- Take note of the supported API Gateway endpoints for your region. Use one of the following endpoints based on your selected geographical region while accessing the Citrix Monitor Service data.
- Put the URL into the same notepad where you already have a copy of your bearer token.
  - US region:https://api-us.cloud.com/monitorodata
  - EU region: https://api-eu.cloud.com/monitorodata
  - AP-S region: https://api-ap-s.cloud.com/monitorodata
  - Japan region: https://api.citrixcloud.jp/monitorodata
In that same notepad, copy the Customer ID / CCID from earlier - in our example screenshot, it was dcint216d0e6.
Start PowerBI and open with an empty workspace / new report
Click Get data from another source and select Web by clicking connect.
Select Advanced and replace the content as described.
For the first connection test, we’ll connect to https://api-us.cloud.com/monitorodata, which provides us with a list of all available resources. This way, we avoid query typos and get an excellent overview simultaneously.
If you followed these steps in less than 60 minutes and your firewall is allowing you to connect to Citrix Cloud, you now see a screen like this:
Repeat the same connection steps for each table you’re interested in by appending /DesktopGroups for Desktops, /Sessions for Sessions or /Users for the Users table. For now, keep it simple. Shortly, we automate the bearer token creation process.
For our example, we’ve created the following tables and relations:
This connection will already allow us to create some basic visualizations.

Let PowerBI create the Bearer token using a function automatically

First, we must create a function within PowerBI and then update our sources to call this function instead of using the Bearer token.

Create a Blank Query
Name the Query GetAccessToken (right menu pane/properties) and put the following content in the query:

    let
    tokenUrl = "", // get citrix cloud API credential (bearer token)
    headers = [
    # "customerid" = "the-ccid-from-step-1", // CCID displayed in citrix cloud tenant
    # "Content-Type" = "application/x-www-form-urlencoded", //format for powerbi
    # "Accept" = "*/*"
    ],
    postData = [
    grant_type = "client_credentials",
    client_id = "the-long-customer-id-from-step1", // here your API key from cloud.com identity
    client_secret = "the-short-secret-from-step-1" // here your API secret
    ],
    response = Json.Document(Web.Contents(tokenUrl, [Headers = headers, Content = Text.ToBinary(Uri.BuildQueryString(postData))])),
    // get the CC bearer token from the response and add the in header expected 'CwsAuth bearer' in front
    access_token = "CwsAuth bearer=" & response[access_token]
    in
    access_token

Your result should look like this:

Using PowerBI Advanced Editor, modify your existing queries to use the new function.
- Depending on your PowerBI settings and whether you’re used to doing this, you may get a Formula.Firewall: Query references other queries or steps error message.
- A quick fix is to click in PowerBI File > Options > Privacy > and select Ignore the Privacy Levels.
In Power Query Editor, right-click any existing queries and select Power Editor.
Delete and replace the bearer token in your query with the newly created function GetAccessToken. The line should now say Authorization=GetAccessToken, without “ “ or ()
After clicking Doneand Close & Apply, your new function and the updated query should fetch a new token and update the content successfully.

When you’ve confirmed this step is working successfully, you can update the other queries you’ve added previously to make use of the function, too.

Summary

You may have noticed that there are certain limits in place.

Permissions

The permission required in Citrix Cloud to run the OData queries against the Monitor API is, at minimum Read Only Administrator. For more details, see our Data Access Privilege documentation.

Pagination

The monitor API returns 100 records per call, so if your script is designed to query more than 100 records, you need to modify the script to handle pagination or to filter the results correspondingly, for example, using a live query.

Data Granularity and Retention

Citrix Monitor stores and aggregates different types of data with different granularity. It’s essential to know the data granularity to understand the results you’ll receive when using the Monitor API to retrieve data.

For example, the SessionMetrics data, which includes session RTT, is only available for one day, while the sessions themselves are available, by default, for 90 days if you have Premium Edition and 31 days with Advanced.

This is because Citrix Director and Monitor´s purpose is real-time troubleshooting and triaging of sessions for help desk teams.

Here, you can learn more about Monitor Data Retention.

Looking for historical insights and analytics?

Currently, a Citrix Analytics OData connection in private preview provides you with 13 months of historical data and more insights. This requires you to have Citrix Analytics in place, which at the same time gives you even more metrics from various connected sites.

PoC Guide - Citrix Zero Trust Architecture Configuration Guide

Thu, 01 Jan 1970 00:00:00 +0000

Overview

As enterprises migrate towards a mature zero-trust architecture, it is crucial to understand the core concepts and how to configure an environment to satisfy the tenets of a zero-trust architecture. This article delves into a comprehensive zero-trust scenario and how to configure Citrix adaptive authentication, adaptive access, and Citrix DaaS policies to build the following architecture.

Use Case

The following diagram shows the architecture for the adaptive authentication, adaptive access, and DaaS policy configurations.

In this scenario, there are two user groups: employee and contractor. The employees and contractors access the same workspace URL in this example.

Employees

Walking through the nFactor flow from left to right, employee users select “Employee” from the organization drop-down list, which directs them to one of three outcomes:

Green - access to the employees-only app and a VDI with relaxed security controls.
Orange - access to the employees only app with strict security controls without access to a VDI.
Red - access denied.

All employees are subject to a device certificate endpoint analysis (EPA) scan and authentication via Azure Active Directory (Azure AD) SAML.

If an employee fails the device certificate EPA scan, they are prompted for a second EPA scan to check for Antivirus Software (AV) on the device.
If the employee’s device contains the specified device certificate or has antivirus software running, they are prompted to authenticate with their Azure AD credentials.
If the employee fails to have either the device certificate or antivirus running, they are denied access.

Contractors

When contractor users select “Contractor” from the organization drop-down list, two outcomes can occur:

Purple - access to a contractors-only app and a VDI with strict security controls applied to both.
Red - access denied.

All contractors are subject to a device certificate endpoint analysis (EPA) scan and authentication via the on-premises Active Directory (AD). If a contractor fails the device certificate EPA scan, they are denied access.

Prerequisites

The following prerequisites were completed before the Adaptive Authentication configurations:

Access to a Citrix Cloud tenant with Citrix DaaS and Secure Private Access Advanced enabled and Cloud Connector installed in your resource location.
Provision Adaptive Authentication by following Step 1 in the Provision Adaptive Authentication guide.
Published Desktop in Citrix DaaS with a Machine Catalog and Delivery Group.
The Access Policy is edited later for adaptive access (see Step 1: Provision Adaptive Authentication).
Published external (Outside my corporate network) Employees Only and Contractors Only apps from Secure Private Access.
- The Access Policies are edited later for adaptive access.
- Follow the Adaptive Access to SaaS and Private Web Apps POC guide.
Microsoft Azure AD Sync with existing Azure tenant and Active Directory.
Configure Device Certificate auto-enrollment via GPO on a domain controller.
- Follow the Configure Group Policy to Autoenroll and Deploy Certificates guide.
Download and install the EPA plug-in from the Workspace URL in Citrix Cloud > Workspace Configuration.

Configurations

The following sections detail the configuration of the previous scenario. The configuration guide is broken down into the following sections:

Adaptive Authentication configuration
Adaptive access configuration
DaaS policy configuration

Adaptive Authentication Configuration

The following configurations are done on the Adaptive Authentication instance. To access Adaptive Authentication:

Log in to Citrix Cloud and select the appropriate Customer.
From the main admin console home page, select the menu in the top left and navigate to My Services > Secure Private Access.
Hover over the menu icons on the far, select Identity and Access Management, and click Manage.
Copy the Primary IP, paste and go into the web browser, and authenticate.

LDAP

For use case scenario two, LDAP policies are needed. First, create the standard LDAP policy for the contractor flow and then a NO_AUTH LDAP policy that will come after the Azure SAML policy for the employee flow.

Start on the main adaptive auth configuration page, type LDAP into the top left search bar, and select Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Actions > LDAP.
For the standard LDAP, click Add, give it a Name, and enter the details for your LDAP server as shown, then click OK.
For the NO_AUTH LDAP, click Add, give it a Name, enter the details for your LDAP server as shown, and click OK.
The finished LDAP actions look similar to the following.

SAML

For the use case scenario, a single SAML auth policy needs to be created for the employee flow. In this configuration guide, Azure AD is used as the SAML IdP. In this section, the Azure Enterprise App is configured first followed by configuring the SAML auth action in adaptive auth.

Azure Enterprise App

In the Azure portal, select Azure Active Directory, Enterprise Applications, then New Application.
In the search bar, enter Citrix, select the Citrix ADC SAML Connector for Azure AD, give it a name, and click Create.
Once created, select Single Sign On from the left menu and click Edit for the Basic SAML Configuration.
Enter the following details for the Basic SAML Configuration:
- Entity ID: FQDN of my adaptive auth instance
- Reply URL: FQDN of my adaptive auth instance appended with “/cgi/samlauth”
- Sign-on URL: FQDN of my adaptive auth instance appended with “/cgi/samlauth”
Lastly, download the Certificate (Base64) from pane 3 and copy the Login URL from pane 4.

Adaptive Auth SAML configuration

Start on the main adaptive auth configuration page, type SAML into the top left search bar, select Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Actions > SAML.
Click Add and fill in the details for the SAML action as shown and click OK:
- Name
- Redirect URL (login URL that was copied from the Azure AD enterprise app configuration)
- Single Logout URL (login URL that was copied from the Azure AD enterprise app configuration)
- IdP Certificate Name (Base64 certificate from the Azure-AD enterprise app)
- Signing Certificate Name (adaptive auth certificate that was uploaded to the service during the provisioning process)
- Issuer Name (FQDN of the adaptive auth instance, specified during the provisioning process)
- Reject Unsigned Assertion (Off)

The finished SAML action looks similar to the one following.

EPA

For the use case scenario, there are three EPA policies to complete:

Employee device certificate check.
Employee antivirus check.
Contractor device certificate check.

Employee Device Certificate

Start on the main adaptive auth configuration page, type EPA into the top left search bar, and select Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Actions > EPA.
Click Add, give the EPA action a name, and enter the details:
- Default Group: Place the name of the AAA group users into if they pass the check (make sure to use all CAPS)
Note:

This group is used later to match with the Smart Access tag.
- Expression: click EPA Editor to the top right of the “Expression” text box, select the appropriate drop-down lists as shown, and click Done.
The finished action looks similar to the following:

Employee Antivirus

From the main EPA action page, click Add, give the EPA action a name, and enter the details:
- Default Group: Place the name of the AAA group users into if they pass the check (make sure to use all CAPS).
  
  Note:
  
  This group is used later to match with the Smart Access tag.
- Expression: click EPA Editor to the top right of the “Expression” text box, select the appropriate drop-down lists as shown, and click Done.
The finished action looks similar to the following.

Contractor Device Certificate

From the main EPA action page, click Add, give the EPA action a name, and enter the details:
- Default Group: Place the name of the AAA group users into if they pass the check (make sure to use all CAPS).
  
  Note:
  
  This group is used later to match with the Smart Access tag.
- Expression: click EPA Editor to the top right of the “Expression” text box, select the appropriate drop-down lists as shown, and click Done.
The finished action looks similar to the following.

The finished EPA actions looks similar to the following:

Smart Access

For the use case scenario there are three Smart Access policies to complete:

Employee with device certificate
Employee without device certificate but a device with proper antivirus software installed
Contractor device certificate.

Employee Device Certificate

Start on the main adaptive auth configuration page, type smart into the top left search bar and select Security > AAA - Application Traffic > Policies > Authentication > Advanced Policies > Smart Access.
Click Add, give it a Name and enter the details as follows.
- Action: select Add, enter a tag name
  
  Note:
  
  This is the tag that is passed to Citrix Cloud Workspace to be later used with adaptive access policies for SPA and policies for DaaS.
- Click OK
- Expression: To check to see if the user is a part of the AAA group that passed the Employee Device Certificate EPA check enter the following expression AAA.USER.IS_MEMBER_OF(“”.
The finished Smart Access policy looks similar to the following:

Employee antivirus

From the main Smart Access policy page, click Add. Give it a Name and enter the details as follows.
- Action: select Add, enter a tag name.
Note:

This is the tag that is passed to Citrix Cloud Workspace to be later used with adaptive access policies for SPA and policies for DaaS.
- Click OK.
- Expression: To check to see if the user is a part of the AAA group that passed the Employee Device Certificate EPA check enter the following expression "AAA.USER.IS_MEMBER_OF(“”)
The finished Smart Access policy looks similar to the following:

Contractor Device Certificate

From the main Smart Access policy page, click Add, give it a “Name,” enter the following details, and click OK.
- Action: select Add, enter a tag name.
Note:

This name is the tag that is passed to Citrix Cloud Workspace to be later used with adaptive access policies for SPA and policies for DaaS.
- Click OK.
- Expression: To see if the user is a part of the AAA group that passed the Employee Device Certificate EPA check, enter the following expression “AAA.USER.IS_MEMBER_OF(“”)
The finished Smart Access policy looks similar to the following:

The finished Smart Access policies look similar to the following:

nFactor Flow

For the use case, one nFactor flow is required.

Start on the main adaptive auth configuration page, type nfactor into the top left search bar, select Security > AAA - Application Traffic > nFactor Visualizer > Flows, and click Add on the next page.
Click The + to add the first factor.
In the new Add Factor Pane select Create Factor and give it a name.

Note:

This is the name of the entire flow.
Click Create.
Click Add Schema.
Click Add to add a new schema on the next pane.
Give the schema a Name and click the “pencil” icon to edit the schema.
Select the Login Schema folder, scroll down, select DomainDropdown.xml, and click Edit.
Give the schema a name and fill out the fields as shown:
By default, this schema provides three options in the drop-down list. To modify the schema to eliminate the third drop-down list option, hover over the newly created schema and click the download icon that appears. Open the downloaded XML file in a text editor.
In the downloaded XML file, delete the highlighted text shown to remove the third drop-down list option.
Close out of the schema edit pane, click edit on the newly created schema, upload the new schema XML file, click OK, and then OK once more. You can now edit the updated schema by clicking the pencil icon if needed.
Now, create the authentication policy associated with the domain drop-down list schema. In this case, a NO_AUTH policy is needed. Click Add Policy.
Click Add, give the policy a Name, select “NO_AUTHN” from the Action Type drop-down list, and enter “true” into the expression text box. Click Create. Click Add.
The next factor is the decision block for “Employee” or “Contractor.” Click the green “+” to add the next factor. Select the “Create Decision Block” radio button, give it a Name, and click Create.
Click “Add Policy,” click Add to create an authentication policy, and give it a Name. This policy determines if the user has selected the “Employee” option from the drop-down list. The expression used to check for this is:

HTTP.REQ.BODY(500).AFTER_STR("domain=").CONTAINS("Employee")
Click OK.
Click Add.
Repeat this process for the Contractor selection. Click the blue “+” below the Employee check policy, click Add to create an authentication policy, and give it a Name. This policy is for determining if the user has selected the “Contractor” option from the drop-down list. The expression used to check for this is:

HTTP.REQ.BODY(500).AFTER_STR("domain=").CONTAINS("Contractor")
Click Add.
The next steps focus on the configurations for the “Employee” use case. The next factor is going to be the device certificate check EPA scan. Click the green “+” on the employee check policy to add the next factor.
Give the factor a Name and click Create.
Select Add Policy for the “Employee Device Certificate Factor” and click Add to create an authentication policy, give it a Name, and set the Action Type to “EPA.” Attach the employee device certificate, check the EPA action created earlier, set the Expression to “true,” and click Create.
Click Add.
Continuing with the “Employee” use case (the configurations for the “Contractor” use case are covered later). Next is the configuration for the factor after the employee passes the previous device certificate EPA check. Click the green “+” on the employee device certificate check policy to add the next factor.
Give the factor a Name and click Create.
Select Add Policy for the “Employee Azure AD SAML Factor” and click Add to create an authentication policy, give it a Name, and set the Action Type to “SAML.” Attach the employee Azure AD SAML action created earlier, set the Expression to “true,” and click Create.
Click Add.
After the SAML policy, the next step is to attach the NO_AUTHN policy to retrieve the necessary attributes for proper authentication to Workspace. Click the green “+” on the employee Azure AD SAML policy to add the next factor.
Give the factor a Name and click Create.
Select Add Policy for the “Employee No-Auth LDAP Factor” and click Add to create an authentication policy, give it a Name, and set the Action Type to “LDAP.” Attach the employee NO_AUTH LDAP action created earlier. Set the Expression to “true” and click Create.
Click Add.
To configure the second employee use case where the employee fails the device certificate check, click the red “+” on the “Employee Device Certificate Check” factor.
Give the factor a Name and click Create.
Select Add Policy for the “Employee AV Check Factor” and click Add to create an authentication policy, give it a Name, and set the Action Type to “EPA.” Attach the Employee AV Check action created earlier, set the Expression to “true” and click Create.
Click Add.
If the employee passes the antivirus check, they get passed through to the Azure AD SAML + NO_AUTHN LDAP. To configure this, click the green “+” for the “Employee AV Check” factor.
In the Next Factor to Connect pane, click the radio button for “Connect to existing factor", select the “Employee Azure AD Factor”, and click Create.
This completes the Green, Orange, and Red Employee use case configurations. The configuration up to this point looks similar to the following:
Moving on to configurations for the “Contractor” use case, the first factor to configure is a device certificate EPA check. To start, click the green “+” on the contractor check policy to add the next factor.
Give the factor a Name and click Create.
Select Add Policy for the “Contractor Device Certificate Factor” and click Add to create an authentication policy, give it a Name, and set the Action Type to “EPA.” Attach the contractor device certificate action created earlier. Set the Expression to “true” and click Create.
Click Add.
If the contractor passes the device certificate check, they are permitted to log in. Next, configure the LDAP authentication for the contractor by clicking the green “+” for the “Contractor Device Certificate Check Factor”.
Give the factor a Name and click Create.
Select Add Policy for the “Contractor LDAP Factor” and click Add to create an authentication policy. Give the policy a Name and set the Action Type to “LDAP”. Attach the contractor LDAP action created earlier, set the Expression to “true” and click Create.
Click Add.
A login schema is required for this LDAP factor to show the user name and password fields to the end user. To configure this, click Add Schema for the “Contractor LDAP Factor”.
On the choose Login Schema pane, click Add.
Give the schema a Name and click the pencil icon.
Click the “Login Schema” folder and scroll down to and select “SingleAuth.xml”. Then click the Select button.
Click Create.
Click OK.

This completes the configurations for the nFactor flow. The final result looks similar to the following image:

AAA Virtual Server

To apply these configurations to the authentication flow, apply the following configurations on the AAA virtual server:

1.  upload and bind the CA certificate
2.  bind the nFactor flow
3.  bind the Smart Access policies.

There's a subsection for each.

First, navigate to the AAA virtual server. Start on the main adaptive auth configuration page, type “AAA” into the top left search bar, and select Security > AAA - Application Traffic > Virtual Servers.
Click the "auth_vs" virtual server to edit.

CA Certificate

On the main edit page of the AAA virtual server, select the pencil icon in the top right.
Click More.
Scroll down to the “CA for Device Certificate” setting pane and click Add.
Select the CA certificate that was added earlier, click the “+,” and then OK.
Click No Device Certificate.
Click the “>” and select the same CA certificate, click Select, and then Bind.
The AAA virtual server looks similar to the following image:

nFactor Flow

The next step is to bind the nFactor flow created earlier to the AAA virtual server.

On the main edit page for the auth_vs AAA virtual server, click Continue until you see “No nFactor Flow”. Click “No nFactor Flow”.
Click the “>” to select the nFactor flow created earlier, click Select, and then Bind.
Select the nFactor flow created earlier and click Select.
Click Bind.
The AAA vServer looks similar to the following:

Smart Access Policies

The final necessary configuration on the AAA virtual server is binding the three smart access policies created earlier.

On the main edit page for the auth_vs AAA virtual server, click Continue until you see “No Smart Access Policy”. Click “No Smart Access Policy”.
Click Add.
Select the first “smart access policy” by clicking the radio button and then click Select.
Click Bind.
Repeat steps 2 through 4 for the other two smart access policies. The finished smart access policy bind looks similar to the following. Click Close.

The AAA virtual server configurations are now complete. On the main AAA virtual server configuration page, click Continue or scroll to the bottom and click Done.

Adaptive Access Policies

The following configurations are done in the Secure Private Access service in the Citrix Cloud administration console. For the scenario, there are three adaptive access policies that need to be created:

Green - access to employee app with relaxed security controls
Orange - access to employee app with strict security controls
Purple - access to contractor app with strict security controls.

There's a subsection for each.

The following configurations are done on the Adaptive Authentication instance. To access Adaptive Authentication:

Log in to citrix.cloud.com and select the appropriate “customer”.
From the main admin console home page select the menu in the top left and navigate to My Services > Secure Private Access.
Hover over the left-hand navigation icons to show the labels, then select Access Policies.

Green - Access to employee app with relaxed security controls

The first policy to create is for the employee app with relaxed security controls. To get started, from the main policy configuration page, click Create Policy.
Fill out the policy creator with the following details, and then click + Add condition:
- Applications:
- User/user groups:

Note:

AD security groups can be used instead of individual user names.

Continue to fill out the policy creator with the following details:
- Select condition: Device posture check > “matches all of”
- Enter custom tags: CERT
- Then do the following - select action: Allow access
- Policy name: enter a name
- Enable check box “Enable policy on save”
The policy looks similar to the following, then click Save.

Orange - Access to employee app with strict security controls

The second policy to create is for the employee app with strict security controls. To start, click Create Policy from the main policy configuration page.
Fill out the policy creator with the following details, and then click + Add condition:
- Applications:
- User/user groups:
Continue to fill out the policy creator with the following details:
- Select condition: Device posture check > “matches all of”
- Enter custom tags: NOCERT
- Then do the following - select action: Allow access with restrictions
- Restrictions: select the restrictions to be enabled
- Policy name: enter a name
- Enable check box “Enable policy on save”
The policy looks similar to the following, then click Save.

Purple - access to contractor app with strict security controls

The third policy to create is for the contractor app with strict security controls. To start, click Create Policy from the main policy configuration page.
Fill out the policy creator with the following details, and then click + Add condition:
- Applications:
- User/user groups:
Continue to fill out the policy creator with the following details:
- Select condition: Device posture check > “matches all of”
- Enter custom tags: CONTRACTOR
- Then do the following - select action: Allow access with restrictions
- Restrictions: select the restrictions to be enabled
- Policy name: enter a name
- Enable check box “Enable policy on save”
The policy looks similar to the following, then click Save.

The adaptive access policies configurations are now complete. The main configuration page for adaptive access looks similar to the following image:

DaaS Policies

The following configurations are done in the DaaS service in the Citrix Cloud administration console. For the scenario, two DaaS policies need to be created:

Allow VDI for “green” employees and “purple” contractors
Purple contractor VDI with strict security controls.

There's a subsection for each.

The following configurations are done on the Citrix DaaS service. To access the Citrix DaaS service:

Log in to citrix.cloud.com and select the appropriate “customer”
From the main admin console home page select the menu in the top left and navigate to My Services > DaaS.

Allow VDI for green employees and purple contractors

To configure VDI access for “green” employees and “purple” contractors' use cases the access policy must be edited for the delivery group. Select “Delivery Group” from the left menu. Highlight the delivery group for the VDI and click Edit.
On the delivery group edit pane click “Access Policy” from the left menu. Select all three check boxes and Click Add.
The first filter to add is to allow access for the employee. In the “Add Filter” pane, add the following details:
- Site or farm name: workspace
- Filter:

Note:

For this example, “CERT” is used. This matches the smart access tag configured previously in the Adaptive Authentication console.

Click OK.
The second filter to add is to allow access for the contractor. Back on the main “access policy” page click Add.
In the “Add Filter” pane, add the following details:
- Site or farm name: workspace
- Filter:

Note

For this example, “CONTRACTOR” is used. This matches the configured smart access tag in the Adaptive Authentication console.

Click OK.
Click Save.

Contractor VDI with strict security controls

To configure contractor VDI with strict security controls, the DaaS studio policies must be edited. To start the configurations, from the DaaS manage home page click “Policies” from the left menu.
Click Create Policy.
The strict security policy to enforce is setting a session watermark for the Contractor VDI. The right search bar type in “watermark.” Click Select for “Enable session watermark”.
Enable the setting and click Save.
Click Next.
In the “Assign Policy To” box, click Assign for the “Access control” setting.
In the “Access control elements” box, enter the “contractor device certificate smart access tag” in the Access condition field. Click Save.
Click Next.
Make sure that the policy is enabled on the summary page, give it a name, and click Finish.

Summary

This guide walked you through the configurations for the adaptive authentication and adaptive access scenario described in the Use Case section. Use the Workspace URL found in the Workspace Configuration section of citrix.cloud.com to test and validate the configuration.

PoC Guide: Configuring Non-Domain Joined Desktops in Citrix DaaS with Google IdP

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Google Cloud Identity is an Identity as a Service (IDaaS) solution that centrally manages users and groups. Google Cloud Identity can be configured to federate identities between Google and other identity providers, such as Active Directory and Azure Active Directory. However, many organizations need to support non-domain joined solutions (not managed through Active Directory), and with Citrix DaaS support for Google Cloud Identity authentication, this is achievable.

The following guide will provide the requirements, and step-by-step instructions to create and configure a Windows and Linux non-domain joined virtual machines, machine catalog, and delivery group using Citrix DaaS.

Requirements and Prerequisites

A current Citrix DaaS subscription.
Single session Windows 10/11 and supported Linux virtual machines.
Citrix VDA 2203 or later.
Rendezvous v2 must be enabled.
Cloud Connectors: Only required if you plan to provision machines on on-premises hypervisors.
Google Cloud Platform developer account.

Note

Service continuity is not supported for non-domain joined VDAs.

Connect Google as an Identity provider to Citrix Cloud

It is assumed that you already use Google Cloud and have users created in it.

Create a service account

To complete this task, you need a Google Cloud Platform developer account.

Sign in to Google Cloud Console.
From the Dashboard sidebar, select IAM & Admin and then choose Service Accounts.
Select Create service account.
Under Service account details, enter the service account name and service account ID.
Select Done.

Create a service account key

On the Service Accounts page, select the service account you created.
Select the Keys tab, then select Add key > Create new key.
Leave the default JSON key type option selected.
Select Create. Save the key to a secure location that you can access later. You enter the private key in the Citrix Cloud console when you connect Google as an identity provider.

Configure domain-wide delegation

Enable the Admin SDK API:
Select APIs & Services > Enabled APIs & services from the Google Cloud Platform menu.
Select Enable APIs and services near the top of the console. The API Library home page appears.
Search for Admin SDK API and select it from the results list.
Select Enable.
Create an API client for the service account:
Select IAM & Admin > Service Accounts from the Google Cloud Platform menu, and then select the service account you created earlier.
From the service account's Details tab, expand Advanced settings.
Under Domain-wide Delegation, copy the Client ID and select View Google Workspace Admin Console.
If applicable, select the Google Workspace administrator account you want to use. The Google Admin console appears.
Select Security > Access and data control > API controls from the Google Admin sidebar.
Under Domain wide delegation, click Manage Domain Wide Delegation.
Select Add new.
In Client ID, paste the client ID for the service account you copied in Step C.
In OAuth scopes, enter the following scopes in a single comma-delimited line: https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly
Select Authorize.

Add a read-only API user account

You create a Google Workspace user account with read-only API access for Citrix Cloud in this task. This account is not used for any other purpose and has no other privileges.

From the Google Admin menu, select Directory > Users.
Select Add new user and enter the appropriate user information.
Select Add new user to save the account information.
Create a custom role for the read-only user account:
From the Google Admin menu, select Account > Admin roles.
Select Create new role.
Enter a name for the new role. Example: API-ReadOnly
Select Continue.
Under Admin API privileges, select the following privileges:
- Users > Read
- Groups > Read
- Domain Management
Select Continue and then select Create role.
Assign the custom role to the read-only user account that you created earlier:
From the custom role details page, in the Admins pane, select Assign users.
Start typing the name of the read-only user account and select it from the user list.
Select Assign role.
Return to the Users page (Directory > Users) to verify the role assignment and select the read-only user account. The custom role assignment is displayed under Admin roles and privileges.

Connect Google to Citrix Cloud

The next step is configuring Citrix DaaS to use Google Cloud as Identity Provider. The first step is to configure Google Cloud Identity globally.

Sign in to Citrix Cloud.
From the Citrix Cloud menu, select Identity and Access Management.
Locate Google and select Connect from the ellipsis menu.
Select Import File and then select the JSON file you saved when you created the key for the service account. This action imports your private key and the email address for the Google Cloud service account that you created.
In Impersonated User, enter the name of the read-only API user account.
Select Next. Citrix Cloud verifies your Google account details and tests the connection.
Review the associated domains that are listed. If they're correct, select Confirm to save your configuration.

Enable Google for workspace authentication

Now that Google Cloud Identity is configured switch the Workspace configuration to use it.

From the Citrix Cloud menu, select Workspace Configuration > Authentication.
Select Google. When prompted, select I understand the impact on the subscriber experience, then click Save.

Create Windows Virtual Machine

Create the Windows virtual machine on any hypervisor or hyperscaler supported by Citrix DaaS. In this case, Google Cloud is being used. Once your virtual machine is created, follow these steps:

RDP into your virtual machine
Download the latest and correct OS type release of the Citrix Virtual Delivery Agent
Run the VDA setup
Select Create a master MCS image, then click Next.
Click Next.
Select any Additional Components your deployment requires, click Next.
Select Let Machine Creation Services do it automatically, then Click Next.
Click Next.
Select Automatically, then click Next.
Review the summary page, then click Install.
When the installation is complete, click Finish and let the machine restart.
Once the machine restarts, edit the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\VirtualDesktopAgent

Create Linux Virtual Machine

In this step, the Linux virtual machine VDA is installed. The virtual machine can be created on any hypervisor or hyperscaler supported by Citrix DaaS. In this case, Google Cloud is being used. During this process, the Citrix VDA will also be installed. Please refer to the following Citrix blog post for assistance during this process.

Prerequisites

A supported Linux desktop installed.
Microsoft .NET Runtime 6.0 installed
Supported Linux VDA available to be installed.

Install the Linux VDA via SSH
Installation errors are expected. When the install completes, run the following command: sudo apt --fix-broken install
Create the MCS base image with the following command: sudo /opt/Citrix/VDA/sbin/deploymcs.sh
Shut down the virtual machine and create a snapshot. Use the snapshot when you create the Linux Machine Catalog.

Create Machine Catalogs

Click Machine Catalogs, then click Create Machine Catalog.
Select Machine Type, click Next.
Select the Machine Management options, and click Next.
Select the Desktop Experience type and if desktop is dedicated, then click Next.
Select the Master Image, VDA functional level, then click Next.
Select storage type, then click Next.
Choose the number of virtual machines to create, select zones, then click Next.
Choose non-domain-joined for the Identity type, provide a name for desktops, then click Next.
On the summary page, provide a name for the Machine Catalog, then click Finish.
The Machine Catalog is now being created. Once complete, move on to creating the Delivery Group.
Repeat the steps to create the Linux Machine Catalog.

Create Delivery Groups

Select Delivery Groups, then click Create Delivery Group.
Select the desktops and number of machines to add, then click Next.
Choose your user assignment type, then click Next.
Select your license type, then click Next.
Review the summary, give the Delivery Group, and display a name, then click Finish.
Repeat the steps to create the Linux Delivery Group.

Create Rendezvous Citrix Policy

Click Manage to open Citrix DaaS web studio.
Click Policies
Click Create Policy
Find the Rendezvous Protocol settings and click Select.
Select Allowed, then click Save.
Click Next
Choose the policy assignment method by Delivery Group.
Select the delivery group in the drop-down, ensure Enable is selected, then click Save.
Click Next.
Select Enable policy, name the policy, and then click Finish.
The rendezvous protocol policy is now enabled.

Assign Desktops

On the Citrix Cloud home page, click View Library.
Click the ellipsis for the Non-domain Joined GCP desktop and select Manage Subscribers
Begin to type the name of the user, then select the user.
Once the user has been Subscribed, close the screen.
Repeat the process for the Non-domain Joined Linux desktop.

Launch Desktops

Connect to your Workspace URL, where you will be directed to Google Authentication. Provide your email address and password, then click Next.
Select the desktop to launch.

PoC Guide: Configuring Non-Domain Joined Virtual Desktops in Citrix DaaS

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Many organizations need to support non-domain joined solutions where the Citrix-accessed virtual machine is not managed through Active Directory. Several use cases that can require this type of configuration include:

Providing non-domain joined desktops to developers or contractors where local administrator rights are needed to install specific applications.
Researchers in the healthcare space that require these same rights.
Temporary workforce where the workload are only needed for a short time.

With Citrix DaaS and Citrix Gateway service support for non-domain joined Virtual Delivery Agents (VDA), this is achievable.

The following guide provides the requirements and step-by-step instructions to create and configure a non-domain joined Windows 11 virtual machine hosted in Azure, a machine catalog and delivery group using Citrix DaaS, and access to end users via Citrix Workspace or Citrix Workspace app.

Requirements and Prerequisites

Review the requirements for creating and accessing non-domain joined virtual machines via Citrix DaaS. Both single-session (desktops only) and multi-session (apps and desktops) are supported.

For this POC Guide, the following are being used:

A current Citrix DaaS subscription.
Single-session Windows 11 image hosted in Azure.
Citrix VDA 2303
Rendezvous v2 enabled.
Azure Active Directory for Citrix Workspace authentication.

Quote

Note

Service continuity is not supported for non-domain joined VDAs.

Enable Authentication for Citrix Workspace

Citrix Workspace supports several authentication identity providers to allow users access to non-domain joined virtual machines including:

Azure Active Directory
Active Directory
Active Directory and Token
Okta
Google IdP
SAML
Citrix Gateway
Adaptive Authentication

Azure Active Directory is being used for this POC Guide. Ensure that the authentication option you have chosen is connected to your Citrix Cloud tenant in Identity and Access Management. Refer here for the instructions to connect an identity provider.

Configure Azure Active Directory authentication for Citrix Workspace

From the Citrix Cloud menu, select Workspace Configuration.
Select Authentication.
Select Azure Active Directory, select I understand the impact on the subscriber experience, then click Confirm.

Create Windows Virtual Machine

Non-domain joined machines are supported on all platforms supported by Citrix Machine Creation Services (MCS). In this step, you create the Windows virtual machine on any supported hypervisor or hyperscaler supported for MCS. In our case, Microsoft Azure is being used. Once your virtual machine is created, follow these steps:

RDP into your virtual machine
Download the latest release and correct OS type release of the Citrix Virtual Delivery Agent
Install the required applications.
Run the VDA setup
Select Create a master MCS image, then click Next.
In the Core Components window, click Next.
Select any Additional Components your deployment requires, such as Citrix Profile Management and Machine Creation Services storage optimization, click Next.
In Delivery Controller, select Let Machine Creation Services do it automatically, Click Next.
Click Next.
Select Automatically, click Next.
Review the summary page, click Install.
When the installation is complete, click Finish and let the machine restart.
Once the machine restarts, edit the following registry value: HKEY_LOCAL_MACHINE\SOFTWARE\Citrix\VirtualDesktopAgent

Create Machine Catalogs

Click Machine Catalogs, then click Create Machine Catalog.
Select Single-session OS for the Machine Type, click Next.
In Machine Management, select Machines that are power managed, Citrix Machine Creation Services (MCS), and the appropriate resources from the drop-down list. click Next.
Select I want users to connect to the same (static) desktop each time they log on and Yes, create a dedicated virtual machine and save changes on the local disk for the Desktop Experience, click Next.
Select the Master Image, set the VDA functional level to 2206 (or later), click Next.
Select your storage and Windows license type, click Next.
In Virtual Machines, choose the number of virtual machines to create and the machine size, click Next.
Choose non-domain-joined for the Identity type, provide a name for desktops, click Next.
On the summary page, provide a name for the Machine Catalog, click Finish.
The Machine Catalog is now being created. Once complete, move on to creating the Delivery Group.

Create Delivery Groups

Select Delivery Groups, then click Create Delivery Group.
Select the desktops and number of machines to add, then click Next.
Select Desktops as the delivery type, click Next.
Choose Leave user management to Citrix Cloud option, then click Next.
Select your license type, then click Next.
Review the summary, give the Delivery Group, and display a name, then click Finish.

Your Non-domain joined Delivery Group is now ready.

Create Rendezvous Citrix Policy

Click Policies
Click Create Policy
Find the Rendezvous Protocol settings and click Select.
Select Allowed, then click Save.
Click Next
Choose the policy assignment method by Delivery Group.
Select the delivery group in the drop-down list, ensure Enable is selected, then click Save.
Click Next.
Select Enable policy, name the policy, and then click Finish.

The rendezvous protocol policy is now enabled.

Assign Desktops

On the Citrix Cloud home page, click View Library.
Click the ellipsis for the Non-domain Joined Windows 11(Desktops) and select Manage Subscribers
Begin to type the name of the user, then select the user.
Once all users/groups have been Subscribed, close the screen.

Launch Desktop

Connect to your Workspace URL, and provide credentials for login.
Select the desktop to launch.

Summary

This guide walked you through creating a non-domain joined Windows 11 virtual machine in Microsoft Azure. You learned how to enable Azure Active Directory for your Citrix Cloud tenant, create a Windows 11 master image, Machine Catalog, Delivery Group, and a Citrix Policy to enable the Rendezvous protocol. Lastly you assigned the desktops via the Citrix Cloud library and then accessed them via Citrix Workspace. Please refer to the following references for any additional information on the topics covered in this POC Guide.

Citrix DaaS Non-domain joined VDA

Rendezvous V2

PoC Guide: Adaptive Access to SaaS and Private Web Apps

Thu, 01 Jan 1970 00:00:00 +0000

Overview

As users consume more SaaS-based applications, organizations must unify all sanctioned apps and simplify user login operations while enforcing authentication standards. Organizations must be able to secure these applications even though they exist beyond the confines of the data center. Citrix Workspace provides organizations with secure access to SaaS apps.

In this scenario, a user authenticates to Citrix Workspace using Active Directory, Azure Active Directory, Okta, Google, or Citrix Gateway as the primary user directory. Citrix Workspace provides single sign-on services for a defined set of SaaS applications.

If the Citrix Secure Private Access service is assigned to the Citrix subscription, enhanced security policies, ranging from applying screen-based watermarks, restricting printing/downloading actions, screen grabbing restrictions, keyboard obfuscation, and protecting users from untrustworthy links are applied on top of the SaaS applications.

The following animation shows a user accessing a SaaS application with Citrix providing SSO and secured with Citrix Secure Private Access.

This demonstration shows an IdP-initiated SSO flow where the user launches the application within Citrix Workspace. This PoC guide also supports a SP-initiated SSO flow where the user tries to access the SaaS app directly from their preferred browser. Also, this guide demonstrates the use of Adaptive Access policies to provide conditional access depending on conditions such as user role, network location, or device posture.

This proof of concept guide demonstrates how to:

Setup Citrix Workspace
Integrate a primary user directory
Incorporate Single Sign-On for SaaS applications
Validate the configuration
Configure and validate Adaptive Access

Setup Citrix Workspace

The initial steps for setting up the environment is to get Citrix Workspace prepared for the organization, which includes

Set Workspace URL

Connect to Citrix Cloud and log in as your administrator account
Within Citrix Workspace, access Workspace Configuration from the upper-left menu
From the Access tab, enter a unique URL for the organization and select Enabled

Verify

Citrix Workspace takes a few moments to update services and URL settings. From a browser, verify that the custom Workspace URL is active. However, logon is not available until a primary user directory gets defined and configured.

Integrate a Primary User Directory

Before users can authenticate to Workspace, a primary user directory must be configured. The primary user directory is the only identity that the user requires as all requests for apps within Workspace use single sign-on to secondary identities.

An organization can use any one of the following primary user directories

Active Directory: To enable Active Directory authentication, a cloud connector must be deployed within the same data center as an Active Directory domain controller by following the Cloud Connector Installation guide.
Active Directory with Time-Based One Time Password: Active Directory-based authentication can also include multifactor authentication with a Time-based One Time Password (TOTP). This guide details the required steps to enable this authentication option.
Azure Active Directory: Users can authenticate to Citrix Workspace with an Azure Active Directory identity. This guide provides details on configuring this option.
Citrix Gateway: Organizations can use an on-premises Citrix Gateway to act as an identity provider for Citrix Workspace. This guide provides details on the integration.
Okta: Organizations can use Okta as the primary user directory for Citrix Workspace. This guide provides instructions for configuring this option.
SAML 2.0: Organizations can use the SAML 2.0 provider of choice with their on-premises Active Directory (AD). This guide provides instructions for configuring this option.

Configure single sign-on

To successfully integrate SaaS apps with Citrix Workspace, the administrator needs to do the following

Configure a SaaS app
Authorize a SaaS app

Configure a SaaS App

Within Citrix Workspace, select Manage from the Secure Private Access tile.
Select Applications
Select Add an app
In the Choose a template wizard, search, and choose the correct template, which in this instance is Zoho, and click Next

In the App Details window, type in the organization's unique domain name for the SaaS application. The URL and Related Domains will automatically populate
Select Next

Note: Enhanced security policies use the related domains field to determine the URLs to secure. One related domain is automatically added based on the URL in the previous step. Enhanced security policies require related domains for the application. If the application uses multiple domain names, the must be added into the related domains field, which is often `..SaaSApp.com(as an example.citrix.slack.com`)

In the Single Sign-On window, copy the Login URL (1)
Select Download to download the X.509 certificate in PEM format (2)

Within the Zoho Account app, select Organization > SAML Authentication to bring up settings
(Requires a permanent or trial Enterprise license with Enterprise user objects created)
Select Setup Now

For the Sign-in URL and Change Password URL, paste the Login URL obtained from the Citrix Secure Private Access configuration
For the X.509 Certificate, upload the .PEM file you downloaded from the Citrix Secure Private Access configuration
For the Zoho Service, enter "People"
Select Configure

Within Citrix Secure Private Access Configuration, select Next
In the App Connectivity window, notice the required domains automatically set to route externally, and select Save

Select Finish

Authorize a SaaS App and configure enhanced security

Within the Secure Private Access menu, select Access Policies
In the Access Policy section, select Create policy
Enter the Policy name and a brief Policy description
In the Applications drop-down list, search for "Zoho People" and select it

Quote

Note

You can create multiple access rules and configure different access conditions for different users or user groups within a single policy. These rules can be applied separately for both HTTP/HTTPS and TCP/UDP applications, all within a single policy. For more information on multiple access rules, see Configure an access policy with multiple rules.

Select Create Rule to create rules for the policy
Enter the rule name and a brief description of the rule, and select Next

Add the appropriate users/groups who are authorized to launch the app, and select Next

Quote

Note

Click + to add multiple conditions based on the context.

Specify if the HTTP/HTTPS app can be accessed with or without restrictions
The following screenshot has watermarking restriction configured.
If no enhanced security is needed, change “Allow access with restrictions” to “Allow access”.
Specify the TCP/UDP apps action
The following screenshot denies access to TCP/UDP apps.
Select Next

The Summary page displays the policy rule details
Verify the details and select Finish

In the Create policy dialog, verify that Enable policy on save is checked, and select Save.

Note: For initial SSO testing, it is always a good idea to configure enhanced security with the option "Open in remote browser" set.

Validate the Configuration

IdP-Initiated Validation

Log into Citrix Workspace as a user
Select the configured SaaS application.
The SaaS App successfully launches
The user automatically signs on to the app
Enhanced security is applied

SP-Initiated Validation

Launch a browser
Go to the company-defined URL for the SaaS application
The browser directs the browser to Citrix Workspace for authentication
Once the user authenticates with the primary user directory, the SaaS app launches in the local browser if enhanced security is disabled. If enhanced security is enabled, a Secure Browser instance launches the SaaS app

Configure and validate Adaptive Access

Admin

Within the Citrix Secure Private Access tile, select Manage
Select Access Policies from the menu on the left
In the search field enter "Zoho" (1)
Click on the three dots (2) and select Edit (3) to open the existing Zoho access policy

Click Create Rule to create a second rule for this policy
Enter the rule name and a brief description of the rule, and select Next

Add the appropriate users/groups who are authorized to launch the app
Select + to add a second condition

Quote

Note

Based on the context, the following conditions can be applied.

Select Network location and select "Create network location"

Enter the Location name and Location tag, and for the Public IP address range, look up the public IP address of the PoC endpoint and enter that followed by /32, indicating it's a host IP address
Select Save

In the Create new rule dialog, select the before created network Location tag, and select Next

Specify if the HTTP/HTTPS app can be accessed with or without restriction, or access is denied
The following screenshot denies access to HTTP/HTTPS apps.
Specify the TCP/UDP apps action
The following screenshot denies access to TCP/UDP apps.
Select Next

The Summary page displays the policy rule details
Verify the details and select Finish

In the Create policy dialog, reorder the access policy priority, and select Save

User

Log into Citrix Workspace as a user
Select Apps from the menu on the left
Observe that the Adaptive Access, Network Location policy has been applied, and Zoho People is now missing from the list of available apps

Troubleshooting

Enhanced Security Policies Failing

Users might experience the enhanced security policies (watermark, printing, or clipboard access) fail. Typically, this happens because the SaaS application uses multiple domain names. Within the application configuration settings for the SaaS app, there was an entry for Related Domains

The enhanced security policies are applied onto those related domains. To identify missing domain names, an administrator can access the SaaS app with a local browser and do the following:

Navigate to the section of the app where the policies fail
In Google Chrome and Microsoft Edge (Chromium version), select the three dots in the upper right side of the browser to show a menu screen
Select More Tools
Select Developer Tools
Within the developer tools, select Sources. This provides a list of access domain names for that application section. To enable the enhanced security policies for this app, those domain names must be entered into the related domains field within the app configuration. Related domains are added like the following *.domain.com

PoC Guide: Adaptive Authentication with Citrix DaaS

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Citrix Cloud customers can use Citrix Workspace to provide Adaptive Authentication to Citrix DaaS. Adaptive Authentication is a Citrix Cloud service that enables advanced authentication for customers and users logging in to Citrix Workspace. This POC Guide aims to show how Adaptive Authentication can provide access to Citrix DaaS to a client or third party without creating and managing local AD accounts and allowing multiple IdPs.

Conceptual Architecture

Here is an overview of the deployment created for this POC Guide.

Main Provider with Citrix Cloud components (including PKI and FAS) and two domains to mimic customers.
Shadow accounts created in lab.local with email matching customer email for first-factor validation (group extraction).
Citrix DaaS is configured for the lab.local Active Directory domain with the following details:
- Domain Controllers:
  - LAB-AD-01
  - LAB-AD-02
- Cloud Connectors:
  - LAB-CC-01
  - LAB-CC-02
- Microsoft Certificate Server:
  - LAB-PKI-01
- Citrix FAS Servers:
  - LAB-FAS-01
  - LAB-FAS-02
- Citrix Virtual Delivery Agents (VDA):
  - DAAS-MCS-S-02.lab.local
  - DAAS-MCS-S-03.lab.local
  - DAAS-MCS-S-04.lab.local -Published resources:
  - Windows 10 MCS Desktop for lab\user1, lab\shadow001, and lab\shadow002.

Configure Adaptive Authentication service

The following high-level steps are involved in configuring the Adaptive Authentication service.

Prerequisites

Reserve an FQDN for your Adaptive Authentication instance. For example, aauth.arnaud.biz, assuming arnaud.biz is your company domain. This FQDN is the Adaptive Authentication service FQDN in this document and is used when provisioning the instance. Map the FQDN with the IdP virtual server public IP address. This IP address is obtained after provisioning in the Upload Certificate step.
Procure a certificate for aauth.arnaud.biz. Certificates must contain the SAN attribute, or the certificates are not accepted.
Choose your connectivity type for the on-premises AD/RADIUS connectivity. The following two options are available. Use the connector connectivity type if you do not want data center reachability.
Citrix Cloud Connector - For details, see Citrix Cloud Connector.
Azure VNet peering - For details, see Set up connectivity to on-premises authentication servers using Azure VNet peering.
Configure the network time protocol (NTP) server to avoid time skews. For details, see How to synchronize system clock with servers on the network.

Points to note

Citrix recommends not to run clear config for any Adaptive Authentication instance or modify any configuration with the prefix AA (for example, AAuthAutoConfig), including certificates. This disrupts Adaptive Authentication management, and user access is impacted. The only way to recover is through reprovisioning.
Do not add SNIP or any additional routes on the Adaptive Authentication instance.
The nFactor configuration required for the Citrix Workspace or the Citrix Secure Private Access service is the only configuration customers must create directly on the instances. Currently, no checks or warnings in the Citrix ADC prevent admins from making these changes.
Do not upgrade the Adaptive Authentication instances to random RTM builds. Citrix Cloud manages all upgrades.
Only a Windows-based cloud connector is supported. The connector appliance is not supported in this release.
If you are an existing Citrix Cloud customer and have already configured Azure AD (or other authentication methods) to switch to Adaptive Authentication (for example, device posture check), you must configure Adaptive Authentication as your authentication method and configure the authentication policies in the Adaptive Authentication instance. For details, see Connect Citrix Cloud to Azure AD.
For RADIUS server deployment, add all connector private IP addresses as the RADIUS clients in the RADIUS server.
In the current release, the external ADM agent is not allowed, so Citrix Analytics (CAS) is not supported.
Citrix Application Delivery Management service collects the backup for your Adaptive Authentication instance. To extract the backup from ADM, onboard the ADM service. For details, see Config backup and restore. Citrix does not take the backups explicitly from the Adaptive Authentication service. Customers must take the backup of their configurations from the Application Delivery Management service if necessary.

How to configure the Adaptive Authentication service

The following steps assume you use Citrix DaaS with Citrix Cloud Connectors and Active Directory on-premises.

Access the Adaptive Authentication user interface

You can access the Adaptive Authentication user interface by one of the following methods.

Manually type the URL https://adaptive-authentication.cloud.com.
Log in using your credentials and select a customer.
After you successfully authenticate, you are redirected to the Adaptive Authentication user interface.

Navigate to Citrix Cloud > Identity and Access Management.
In the Authentication tab, click the ellipsis menu in Adaptive Authenticationand select Manage. The Adaptive Authentication user interface appears.

Step 1: Provision Adaptive Authentication

Perform the following steps:

On the Adaptive Authentication UI, click Provision.
Click Next.
Select the preferred connection for Adaptive Authentication.
- Citrix Cloud Connector: You must set up a connector in your on-premises network for this connection type. Citrix recommends deploying at least two Citrix Cloud Connectors in your environment to set up the connection to the Citrix Gateway hosted on Azure. You must allow your Citrix Cloud Connector to access the domain/URL reserved for the Adaptive Authentication instance. For example, allow https://aauth.xyz.com/*.
For details on Citrix Cloud Connector, see Citrix Cloud Connector.
- Azure VNet peering: You must set up the connectivity between the servers using Azure's VNet peering.
- Ensure that you have an Azure subscription account to set up the connectivity.
- The customer VNet being peered must already have an Azure VPN gateway provisioned. For details, see Azure VPN Gateway.
To add a Citrix Cloud Connector as your preferred connection: Perform the following steps.
- Select the Citrix Cloud Connector option, and select the end user agreement checkbox.
- Click Provision.

Note:

Provisioning might take up to 30 minutes to complete.

Set up credentials to access the instances you have enabled for Adaptive Authentication. You need management console access to create policies for authentication, conditional access, and so on
- Enter the user name and password in the Console access screen, and click Next.
Add the Adaptive Authentication service FQDN and upload the certificate-key pair. You must enter the Adaptive Authentication service FQDN of your choice for the publicly accessible authentication server. This FQDN must be publicly resolvable.
- in the Upload Certificate screen, enter the FQDN reserved for Adaptive Authentication.
- Select the certificate type.
- Upload the certificate and the key.

Note:

A DNS entry needs to be created for the configuration to apply.

![Adaptive Authentication](/en-us/tech-zone/learn/media/poc-guides_adaptive-authentication-citrix-daas_aa7.png)

Upload the certificate and the key. The Adaptive Authentication instance is connected to the Identity and Access Management service. The Adaptive Authentication method status is displayed as Connected.
Set up IP addresses to access the Adaptive Authentication management console.
- In the Allowed IP addresses screen, enter a public IP address as the management IP address for each instance. To restrict access to the management IP address, you can add multiple IP addresses allowed to access the management console.
- To add multiple IP addresses, click Add, enter the IP address, and click Done. This step must be done for every IP address. If you do not click the Done button, the IP addresses are not added to the database but are only added to the user interface.
- If you use the connector connectivity type, specify a set of resource locations (connectors) to reach the AD or RADIUS servers. You can skip this step if you use the VNet peering connectivity type.
- Admins can choose the connectors through which back-end AD and RADIUS servers must be reached. To enable this feature, you can set up a mapping between their back-end AD/RADIUS server subnets such that if the authentication traffic falls under a specific subnet, then that traffic is directed to the specific resource location. However, If a resource location is not mapped to a subnet, then admins can specify to use the wildcard resource location for those subnets.
- Previously, Adaptive Authentication traffic for on-premises AD/RADIUS was directed to any available resource location using the round-robin method. This setup caused issues for customers with multiple resource locations.
On the Adaptive Authentication UI, click Manage Connectivity, enter the subnet details, select the respective resource location, click Add, and click Save Changes.

Step 2: Configure Adaptive Authentication policies

After the provisioning, you can access the Adaptive Authentication management IP address directly. You access the Adaptive Authentication management console using the FQDN or your primary IP address.

Access the Adaptive Authentication management console:
- To access the Adaptive Authentication management console using the FQDN, see Configure SSL for ADC Admin UI access.

To access the Adaptive Authentication using your primary address, do the following:

Copy the primary IP address from the Configure Authentication policies section in the GUI and access the IP address in your browser.
Log in using the credentials that you have entered while provisioning.
Click Continue.
Navigate to Configuration> Security > AAA - Application Traffic > Virtual Servers.
Add the authentication policies. For various use cases, see Sample authentication configurations. The configuration part of this article is provided below in the next section.

Step 3: Enable Adaptive Authentication for Workspace

After provisioning is complete, you can enable authentication for Workspace by clicking Enable in the Enable Adaptive Authentication for Workspace section.

Click Enable to enable Adaptive Authentication for Workspace.
Check the Box and click Confirm.

Configure input-based group extraction

Consider an organization with the following three departments (groups), Employee, Partner, and Vendor. The Citrix ADC appliance can extract the user's group based on the user's email ID or the AD user name in the first-factor login form. Based on the group a user belongs to, Citrix ADC presents an authentication method (LDAP, SAML, OAuth, and so on), as shown in the following table as an example.

Group Name	Factor
Employee	Single Auth (Username/Password)
Partner	SAML (redirects to different IdP)
Vendor	SAML (redirects to different IdP)

The following diagram shows a high-level interaction between a user and the Citrix ADC appliance for the previously mentioned use case.

The user logs in to Citrix Workspace and gets redirected to a virtual authentication server.
Citrix ADC presents a login form to enter their email ID (or user name).
The user enters the Email ID (or user name).
Citrix ADC presents a login form based on the group extracted using the provided email ID (or user name).

Configure email ID (or user name) input using CLI

Prerequisite

A load-balancing virtual server configured with authentication enabled.
LDAP Load Balancing virtual server with IP address: 10.0.0.1 created:

add server LAB-AD-01 192.168.2.1

add server LAB-AD-02 192.168.2.2

add serviceGroup LDAP_SG TCP -maxClient 0 -maxReq 0 -cip DISABLED -usip NO -useproxyport YES -cltTimeout 9000 -svrTimeout 9000 -CKA NO -TCPB NO -CMP NO

add lb vserver LDAP_VS TCP 10.0.0.1 389 -persistenceType NONE -cltTimeout 9000

bind lb vserver LDAP_VS LDAP_SG

bind serviceGroup LDAP_SG LAB-AD-02 389

bind serviceGroup LDAP_SG LAB-AD-01 389

Configure authentication virtual server for email-based group extraction

Note:

You can modify **OnlyUsername.xml schema to create a customized login schema (emailOnlyLSchema).

Create login schema policy using email login schema created in the previous step and bind to the virtual authentication server

add authentication loginSchema emailOnlyLSchema -authenticationSchema "/nsconfig/loginschema/LoginSchema/EmailOnlyLSchema.xml"

add authentication loginSchemaPolicy lschema_only_email_pol -rule true -action emailOnlyLSchema

bind authentication vserver auth_vs -policy lschema_only_email_pol -priority 100 -gotoPriorityExpression END

Create an LDAP authentication policy for group extraction

Note:

ldapLoginName is "mail" for email ID-based login, whereas -ldapLoginName is "samAccountName" for username-based login.

add authentication ldapAction aaa_local_grp_extraction -serverIP 10.0.0.1 -ldapBase "dc=lab,dc=local" -ldapBindDn svc_ldap@lab.local -ldapBindDnPassword ****** -ldapLoginName mail -groupAttrName memberOf -subAttributeName CN -secType TLS -authentication DISABLED

add authentication Policy aaa_local_grp_extraction_pol -rule true -action aaa_local_grp_extraction

Extracted group-based policy configuration

Create the next factor for Employee, Partner, and Vendor Groups using policy labels

add authentication loginSchema lschema_noschema -authenticationSchema noschema

add authentication policylabel plabel_noauth_Employee_Partner_Vendor -loginSchema lschema_noschema

add authentication Policy noauth_Employee_pol -rule "AAA.USER.IS_MEMBER_OF(\"Employee\")" -action NO_AUTHN

add authentication Policy noauth_Partner_pol -rule AAA.USER.IS_MEMBER_OF(\"Partner\")" -action NO_AUTHN

add authentication Policy noauth_Vendor_pol -rule "AAA.USER.IS_MEMBER_OF(\"Vendor\")" -action NO_AUTHN

Create a single Auth policy factor (LDAP is used as an example for this configuration)

add authentication loginSchema lschema_singleauth_Employee -authenticationSchema "/nsconfig/loginschema/LoginSchema/ PrefilUserFromExpr.xml"

add authentication policylabel plabel_singleauth_Employee -loginSchema lschema_singleauth_Employee

add authentication ldapAction aaa_local_pwd_act -serverIP 192.168.2.1 -ldapBase "dc=lab,dc=local" -ldapBindDn svc_ldap@lab.local -ldapBindDnPassword ****** -ldapLoginName samAccountName -groupAttrName memberOf -subAttributeName CN -secType TLS -ssoNameAttribute userPrincipalName -passwdChange ENABLED -nestedGroupExtraction ON -maxNestingLevel 7 -groupNameIdentifier sAMAccountName -groupSearchAttribute memberOf -groupSearchSubAttribute CN -defaultAuthenticationGroup ldapDefaultAuthGroup -Attribute1 userPrincipalName -Attribute2 mail

add authentication Policy aaa_local_pwd_pol -rule true -action aaa_local_pwd_act

bind authentication policylabel plabel_singleauth_Employee -policyName aaa_local_pwd_pol -priority 100 -gotoPriorityExpression NEXT

Create SAML Policy for redirecting to Okta SAML IdP

add authentication policylabel plabel_saml_Partner -loginSchema lschema_noschema

add authentication samlAction "SAML OKTA" -samlIdPCertName Okta -samlSigningCertName MTRCConsulti-certkey -samlRedirectUrl "https://dev-52531691.okta.com/app/citrixnetscalergateway_saml/exk9a4qvlqFEP4bHI5d7/sso/saml" -samlUserField userprincipalname -samlIssuerName https://aauth.arnaud.biz

add authentication Policy SAML-OKTA -rule true -action "SAML OKTA"

bind authentication policylabel plabel_saml_Partner -policyName SAML-OKTA -priority 100 -gotoPriorityExpression NEXT

Create SAML Policy for redirecting to Azure SAML IdP

add authentication policylabel plabel_saml_Vendor -loginSchema lschema_noschema

add authentication samlAction saml_sp_act -samlIdPCertName "Citrix ADC SAML" -samlRedirectUrl "https://login.microsoftonline.com/a5edf84a-78ce-4ceb-92d0-2c835a217494/saml2" -samlUserField userprincipalname -samlIssuerName " https://aauth.arnaud.biz"

add authentication Policy saml_sp_pol -rule true -action saml_sp_act

bind authentication policylabel plabel_saml_Vendor -policyName saml_sp_pol -priority 100 -gotoPriorityExpression NEXT

Bind all three policy factors to plabel_noauth_Employee_Partner_Vendor

bind authentication policylabel plabel_noauth_Employee_Partner_Vendor -policyName noauth_Employee_pol -priority 100 -gotoPriorityExpression NEXT -nextFactor plabel_singleauth_Employee

bind authentication policylabel plabel_noauth_Employee_Partner_Vendor -policyName noauth_Partner_pol -priority 110 -gotoPriorityExpression NEXT -nextFactor plabel_saml_Partner

bind authentication policylabel plabel_noauth_Employee_Partner_Vendor -policyName noauth_Vendor_pol -priority 120 -gotoPriorityExpression NEXT -nextFactor plabel_saml_Vendor

Bind group-based policy label as nextFactor for group extraction authentication policy

bind authentication vserver auth_vs -policy aaa_local_grp_extraction_pol -priority 100 -nextFactor plabel_noauth_Employee_Partner_Vendor -gotoPriorityExpression NEXT

Configure email ID (or user name) input using the nFactor Visualizer

Navigate to Security > AAA-Application Traffic > nFactor Visualizer > nFactor Flow and click Add.
Click + to add the nFactor flow.
Add a factor for group extraction with LDAP group extraction policy using EmailOnlyLoginSchema. The name that you enter is the name of the nFactor flow. Click Create.
Click Add Schema on the nFactor block. To create a customized login schema (emailOnlyLSchema), you can edit the built-in OnlyUsername.xml schema.
Click Add Policy.
Select Policy aaa_local_grp_extraction_pol and click Add.
Click the green + sign on the emailbasedGroupExtraction block to create decision blocks for the subsequent factors.
On the Next Factor to Connect screen, select Create decision block, enter a name for the decision block, and click Create.
Click Add Policy
Select Policy and click Add.
The following diagram shows the nFactor flow after creating all the decision blocks.
Once all the decision blocks are created, bind all the group-based decision blocks to the respective authentication factors. For example, an Employee group can have a username and password authentication factor.
Choose login schema from the Authentication Login Schema drop-down menu and click Add.
Choose the authentication policy and click Add.
Once all group-based decision blocks are configured with authentication policies as factors, the nFactor flow looks like the following diagram.
Click Bind to Authentication Server and click Create.
Select the virtual authentication server and click nFactor Flow.
Choose the nFactor flow under the Select nfactor Flow field and click Add.
Bind this flow to the authentication, authorization, and auditing virtual server.

Note:

Azure AD does not expect the Subject ID field in the SAML request. For Citrix ADC to not send the Subject ID field, type the following command on the Citrix ADC CLI. nsapimgr_wr.sh -ys call="ns_saml_dont_send_subject" This command only applies to nFactor authentication workflows.

Summary

This guide walked you through using Adaptive Authentication to provide access to Citrix DaaS to a client or third party without creating and managing local AD accounts and allowing multiple IdPs.

PoC Guide: App protection policies

Thu, 01 Jan 1970 00:00:00 +0000

POC Guide - Citrix App Protection.pdf

Overview

This guide is designed to walk you through the technical prerequisites, use cases, and configuration of App protection policies for your Citrix Virtual Apps and Desktops or Citrix DaaS deployment. App protection is a Citrix Workspace app (CWA) feature that provides enhanced security when using Citrix-published resources. Anti-keylogging, anti-screenscraping, and anti-DLL injection can be enabled in your Citrix environment to secure the work of your end users and protect your enterprise's sensitive data.

In this POC Guide, we will configure Citrix App Protection to protect virtual applications, virtual desktops, and Web/SaaS applications. We will use the Global App Configuration service to enable and deploy the Citrix Workspace app with App Protection, Citrix DaaS to ensure App Protection is enabled on specific Delivery Groups, and Citrix Secure Private Access to secure our Web/SaaS applications.

Prerequisites

The following prerequisites are required to use Citrix App Protection:

An active license subscription from the following:
- Citrix Platform
- Citrix Universal Premium
- Citrix Universal Premium Plus License
Citrix Workspace app:
- Citrix Workspace app for Windows 2203.1 or later
- Citrix Workspace app for Mac 2001 or later
- Citrix Workspace app for Linux 2108 or later
- Citrix Workspace app iOS 24.9.0 or later
- Citrix Workspace app for Android 24.7.0 or later
Citrix DaaS or Citrix Virtual Apps and Desktops
- Minimum version of Delivery Controllers and StoreFront must be 2203 or later.
Citrix Secure Private Access to protect Web/SaaS applications
Endpoint OS Platform:
- Windows 10/11
- macOS High Sierra 10.13 or higher
- Linux Ubuntu 22.04, Ubuntu 24.04, RHEL 0, ARM64 Raspberry Pi OS (Debian 11 bullseye, Debian 12 Bookworm)
- iOS 16 or higher
- Android 12 or higher

Refer to the system requirements in the product documentation for the most up-to-date requirements.

Global App Configuration Service Configuration

Select Workspace Configuration.

Select App Configuration.

Select the appropriate Workspace URL and click Configure.

Ensure Citrix Workspace App is selected and expand Security and authentication.

Expand Prevent Keylogging and select Mac, Windows, and Linux and ensure Enabled is selected for each.

Expand Prevent screen capture and select Android, iOS, Mac, or Windows, ensuring Enabled is selected for each.

Expand Prevent dynamic-link libraries (DLL) injection, select Windows and each of the three options in the drop-down menu.

Click Publish Drafts.

Click Save on the Save settings screen.

Select Citrix Enterprise Browser and then Security and privacy.

Expand Prevent keylogging, select iOS, Mac, Windows, and Linux, and ensure Enabled is chosen for each.

Expand Prevent screen capture, select the appropriate device types and ensure Enabled is chosen for each.

Click Publish Drafts.

Click Save.

Citrix DaaS Configuration

Open the Citrix DaaS web console and select Policies.

Click Create Policy.

Expand ICA and select App Protection.

Select the Posture check for Citrix Workspace App setting and click Edit.

Uncheck Use default value click Add.

Enter the values you require in to the policy, clicking Add after each entry. Click Save.

Windows-AntiScreencapture
Windows-AntiKeylogging
Linux-AntiScreencapture
Linux-AntiKeylogging
Mac-AntiScreencapture
Mac-AntiKeylogging

Click Next.

Assign your policy via Filter users and computers or All users and computers. Click Next.

Select Enable policy, provide a name for the policy, then click Finish.

The policy is now created and enabled.

Click Delivery Groups.

Right-click on the first Delivery Group you wish to apply App Protection and select Edit.

Select App Protection, select Apply to this delivery group, check both Anti-keylogging and Anti-screen capture, then click Save.

Configure Secure Private Access

Open the Citrix Secure Private Access web console.

Select Policies > Access Policies.

Click Create Policy.

Provide a name for the policy then click Select applications.

Choose the applications you wish to protect, click Save.

Select Create rule.

Enter a name for the rule, click Next.

Select either User or Machine for the Rule Scope. Choose the appropriate options for your choice. Click Next.

Select Allow access with restrictions, select Keylogging protection, and Screen capture.

Scroll to the bottom of the blade and select Allow access for TCP/UDP apps. Click Next.

Click Finish.

Click Save.

The Policy is created successfully.

App Protection Test

App Protection is installed by default when using a supported Citrix Workspace app noted in the prerequisites. Starting with Citrix Workspace app v2311, App Protection will begin immediately after installation when the Start App Protection after installation is checked during the Citrix Workspace app install process.

Important:

The following steps provide guidance for anti-screen sharing testing only. We recommend consulting with your security team to test anti-keylogging protection and anti-dll injection.

Launch Citrix Workspace app and log in with your credentials.
Click on a Web/SaaS, published app, or desktop that has been protected and launch the HDX session.
Open the Windows Snipping tool, attempt to perform a screen capture, and confirm you see a black screen (expected behavior).

References

Product Documentation - Citrix Workspace app

Product Documentation - App Protection

Citrix Tech Brief - App Protection

PoC Guide: Automated Configuration Tool

Fri, 09 Feb 2024 12:31:20 +0000

Overview

The Automated Configuration tool facilitates migrating and exporting configurations to Citrix DaaS. This Proof of Concept guide illustrates the step by step instructions on how to use this tool.

Administrators can easily test and explore the Citrix DaaS features and advantages, while simultaneously running existing On-Premises environments and even facilitate moves between cloud regions, back up existing configurations, and other use cases. The Automated Configuration download link also contains additional information and detailed documentation on said use cases and customizations.

Pre-requisites

On-Premises environment

Citrix Virtual Apps and Desktops (CVAD) on-Premises environment with at least one registered VDA.
Citrix Virtual Apps and Desktops on-Premises environment running on one of the following versions: Any Long Term Service Release (LTSR) versions with their latest CU (1912, 2203); Or one of the corresponding latest two Current Releases (CR) versions (for example: 2308, 2311).
The domain-joined machine where you plan on running the Automated Configuration tool commands must be running .NET 4.7.2 version or higher.
A machine with the Citrix PowerShell SDK, which is automatically installed on the DDC.

Note:

If running the tool on a different machine, it must be domain-joined and Studio must have the correct PowerShell snap-ins installed. This installer can be found on your corresponding versions Product ISO installation media, which can be obtained from the Citrix Downloads > Citrix Virtual Apps and Desktops website.

Download the Automated Configuration tool MSI from the Official Downloads website

Cloud-related components

Note: If migrating between cloud sites (cloud to cloud migration) refer to the Official Documentation for detailed steps.

Valid Citrix DaaS license.
Administrator must be able to log into the Cloud Portal and obtain: The resource location name, customer ID, client Secret (app ID and Secret Key)
The existing Citrix Cloud Resource Location has at least one Cloud Connector, which is marked as green (Healthy) and is part of the same domain as the On-Premises setup.

Note:

Citrix recommends having two or more Cloud Connectors (for redundancy and High Availability). For information on how to set up your Cloud Connectors, refer to this guide.

This proof of concept guide demonstrates how to

Complete the On-Premises pre-requisites
Export your On-Premises site configuration into YAML (.yml) files
Complete the cloud pre-requisites
Complete the requisites for importing site configuration when using different provisioning methods (Machine Creation Services (MCS) for both Pooled and Static Catalogs)
Import your Site Configuration into Cloud (by editing the required files)
Troubleshooting tips and where to find more information

Complete Pre-requisites for Exporting from on-premises site

These steps must be run in your DDC or the domain-joined machine where you want to run the Automated Configuration tool.

Download the latest Automated Configuration tool MSI to your On-Premises DDC or a domain-joined machine. Note: See the Pre-requisites section for more details on how to run it from a different machine. The tool can be downloaded from here. Note: See the Pre-requisites section for more details on how to run it from a different machine.
Run the MSI on your On-Premises DDC, by right-clicking on the AutoConfig_PowerShell_x64.msi installer and clicking on Install.
Read the License Agreement and check the box if you accept the terms. Then click Install:
Files are copied and the progress bar continues moving until it finishes the install.
After the MSI runs, a window indicating successful completion pops up. Click Finish to close the MSI setup window.

Note: Upon successful execution a desktop icon called Auto Config is created. When launched, the corresponding folder structure located in C:\Users\\Documents\Citrix\AutoConfig, is created. This tool is the one used on subsequent steps.

Export your On-Premises site configuration

Using an export PowerShell command, you can export your existing On-Premises configuration and obtain the necessary .yml files. These files are used to import your desired configuration into Citrix Cloud.

After running the MSI installer on the previous step, you get an Auto Config shortcut automatically created on the Desktop. Right-click this shortcut and click Run as Administrator.
Run the Export-CvadAcToFile command. This command exports policies, manually provisioned catalogs, and delivery groups. It also exports applications, application folders, icons, zone mappings, tags, admin roles and scopes, and other items. Note: For MCS machine catalogs and delivery groups, refer to the steps on Requisites for Importing Site Configuration using different Provisioning Methods section in this guide.
Once the tool finishes running, the Overall status shows as True and the export process is completed (the output lines shown match the following illustration). Note: If there are any errors, diagnostic files are created in the action-specific subfolders (Export, Import, Merge, Restore, Sync, Backup, Compare), which can be found under %HOMEPATH%\Documents\Citrix\AutoConfig. Refer to the Troubleshooting Tips section if you encounter any errors.
The resulting .yml files are now in the current users Documents\Citrix\AutoConfig path:
See the image below for an example of the contents on a .yml file (Application.yml)

Note:

If necessary, copy the .yml files to the machine you want to use to import settings to your Citrix Cloud environment. Exporting and importing can be done from the same machine.

Complete Prerequisites in Cloud

Go to your Resource Location and make sure your Cloud Connectors are both showing green (Available). Note: If you need instructions on how to set up your Cloud Connectors, refer to this guide.

To verify the health status of your Cloud Connectors, first log in to your cloud portal with your Citrix administrator credentials (or your Azure AD credentials, when applicable).
If you have more than one Organization ID (Org ID), select your corresponding tenant.
Upon logon, go to the hamburger menu on the top left corner and then click Resource Locations:
Access the Cloud Connector(s) tile under your Resource Location.

Note:

The Cloud Connector(s) must show green, indicating a Healthy status, as seen on the following image. Citrix recommends having more than one Cloud Connector per Resource Location, for redundancy purposes.

Requisites for Importing Site Configuration using different Provisioning Methods

Dealing with Provisioning Services (PVS) Machine Catalogs, Delivery and Application Groups and Policies

No extra steps are required to import your PVS Catalogs and their corresponding applications at this time. Follow the steps mentioned on the Import your Site Configuration into Cloud section in this guide.

Dealing with Machine Creation Services (MCS): Pooled VDI multi-session (Random) and RDS Machine Catalogs

Note:

A separate section is available with instructions for Static assigned virtual machines. Refer to the steps mentioned on the MCS Static Assigned VDIs section in this guide.

The import and export commands are supported for this task now. Both the golden image and the configuration in Catalogs with User data: Discard can be migrated. However the virtual machines in these catalogs do not get migrated, since the site you are importing from is responsible for maintaining the life cycle of the virtual machine.

When machines are turned on, their state might change, affecting import data for the virtual machines synchronization. Therefore when migrating these catalogs using the tool, it creates a catalog metadata and initiates master image creation. However zero machines are imported.

Important Considerations:

The MCS catalog import process can take a couple of hours based on the size of the master image. Therefore the import command within the tool only starts the MCS catalog creation and does not wait for it to finish.
After the import has completed, the catalog creation progress can be monitored via Studio in the cloud deployment.
Once the master image is created you can provision machines. Consider your hypervisor's existing capacity, since you have consumption from your on-premises usage.
All other objects (including the Delivery Group, applications, policies, and everything that uses the catalog) can be imported, without having to wait for the master image creation. The same commands available within the tool can be used to migrate catalogs and all other objects.
When the catalog has finished creating, machines can be added to the imported catalog, and then users can launch their resources.

Note:

After these considerations, follow Import your Site Configuration into Cloud section in this guide to merge your configuration as needed.

Dealing with Machine Creation Services (MCS): Static Assigned Machines

Note:

A separate section is available with instructions for Pooled and RDS Machines. Refer to the steps mentioned on the MCS Pooled VDI and RDS Machines

This process imports some low-level details which are stored in the database so it needs to be run from a machine with database access. The tool import process migrates the configuration, master image and the machines as well. It is a quick operation since no images are created.

Important Considerations:

The VDAs need to be pointed to the Cloud Connectors for them to register with Citrix Cloud.
Refer to the Activating sites documentation to activate your Cloud site and thus control reboot schedule, power management, and others, via Citrix Cloud.
Once the migration is completed, if you want to delete the corresponding catalog from your on-premises site, you must select the option to leave VM and AD account. Otherwise both records will be deleted and the Cloud site left pointing to the deleted virtual machine.

Note:

After these considerations, follow Import your Site Configuration into Cloud section in this guide to merge your configuration as needed.

Import your Site Configuration into Cloud

During this step, you obtain the customer connection details, manually create your Zone mappings, and import the configuration to your Cloud tenant. Note: For MCS, first follow the corresponding subsections under the Import your Site Configuration into Cloud section in this guide.

Obtaining Customer Connection Details

Administrators must edit the CustomerInfo.yml file and add the corresponding CustomerName, CustomerID, and SecretKey values to it. These values can be obtained and generated from the Cloud portal, as shown in the following steps.

First, open your CustomerInfo.yml file using a text editor application, such as Notepad. The following screenshot shows the CustomerInfo.yml file values that must be edited (underlined in red):
On your Cloud portal click the hamburger menu again and go to Identity and Access Management:
Go to the API Access tab and copy the Customer ID value, which can be found next to the customer ID text as seen on the following screenshot (red rectangle):
Paste the retrieved value between the quotes that follow the CustomerId field in your CustomerInfo.yml file, between the ââ (quotes):
Back on your Cloud portal, go to the Identity and Access Management portal and API Access tab. Enter the name you want to identify this API key with on the Name your Secure Client box. Then click the Create Client button. Note: This action generates the Client ID and the Secret Key.
Copy the ID and the Secret values, one by one (paste them on the CustomerInfo.yml file as shown in the following step). Then click Download to save the file for later reference.
Paste the ID and Secret values onto the corresponding fields in the CustomerInfo.yml file:

Manually update the Zone Mapping file (ZoneMapping.yml)

On-Premises Zones cannot be automatically migrated to a cloud Resource Location, so they must be mapped using the ZoneMapping.yml file. Note: Migration failures occur if the zone is not mapped with a homonymous resource location (a Resource Location with the exact same name).

Back in the same directory where your .yml files reside (Documents\Citrix\AutoConfig), open up the ZoneMapping.yml using Notepad or your preferred text editor. Note: The Primary value must be replaced with the name of your corresponding Zone you want to migrate objects from (in your On-Premises environment).
You can find this name under your On-Premises Citrix Studio console > Configuration > Zones. Note: if your Zone is named Primary in your On-Premises environment, this value on the ZoneMapping.yml file doesn't need to be changed:
Still on the ZoneMapping.yml file, the Name_Of_Your_Resource_Zone value must be replaced with your Cloud Resource Location name. This value can be found on your cloud portal under the Hamburger menu > Resource Locations:
Copy your Resource Location name (Shown as My Resource Location on the following screenshot):
Paste this value on the ZoneMapping.yml file instead of the Name_Of_Your_Resouce_Zone value:
Multiple Zones in your On-Premises environment can also map to one Resource Location in the cloud. However there always must be one row in the file for each zone in the On-Premises environment. For multiple zones on-premises and one Resource Location, the format on this file would look as follows:
When mapping Zones to different Resource locations, the file must look like this instead:

Manually update the CvadAcSecurity.yml file

Host Connections and their associated hypervisors can be migrated to Citrix DaaS. Adding the Host Connections requires security information for the specific hypervisor. This information needs to manually added into the CvadAcSecurity.yml file. Note For this example we are using Citrix Hypervisor. For information on the security information required for other hypervisor types, visit the Citrix DaaS product documentation site.

Back in the same directory where your .yml files reside (Documents\Citrix\AutoConfig), open up the CvadAcSecurity.yml using Notepad or your preferred text editor.
In the CvadAcSecurity.yml file, enter the username and password for your hypervisor connection, then Save the file.

Merging configuration

Back on the Migration tool PowerShell console, run the following command: Merge-CvadAcToSite to merge the existing Cloud configuration (if any exists) with the configuration exported from the On-Premises site.
When each task runs successfully, the output looks green as .yml files are imported and the corresponding components are added to the cloud site:
The resulting files show in the following directory: \Documents\Citrix\AutoConfig\Import_
On this same folder, you can find a Backup_YYYY_MM_DD_HH_mm_ss folder. Note: Copy this folder somewhere safe as it is a backup of the configuration.
The Backup folder contains the following files, which are helpful for reverting changes, if needed:

Verify configuration created in Cloud Studio

Access your Citrix DaaS Manage tab via the Cloud Console > My Services > Citrix DaaS > Manage tab).
Refresh to make sure the Machine catalogs, Delivery groups, policies, tags, and applications are now showing as expected. Note: Depending on what you import, the results vary as they are specific to your own unique configuration. Review each section to make sure the expected items are listed.

Machine Catalogs list example:

If everything looks as expected, your Citrix DaaS migration is complete.

Migrating Cloud environment across Resource Locations

For guidance on how to migrate across Cloud regions or DaaS environments, refer to the Citrix DaaS Migrating from Cloud to cloud documentation.

Troubleshooting Tips

General information for troubleshooting:

Refer to the Automated Configuration Tool Troubleshooting FAQ article.
Prior to opening support ticket with Citrix, collect all log and *.yml files into a single zip by running New-CvadAcZipInfoForSupport. No customer security information is included. Forward the zip file at the following location %HOMEPATH%\Documents\Citrix\AutoConfig\CvadAcSupport_yyyy_mm_dd_hh_mm_ss.zipNew-CvadAcZipInfoForSupport.
Running any cmdlet creates a log file and an entry in the master history log file. The entries contain the date, operation, result, backup, and log file locations of the execution. This log provides potential solutions and fixes to common errors.
The master history log is located in %HOMEPATH%\Documents\Citrix\AutoConfig, in the file named History.Log.* All operation log files are placed in a backup folder.
All log file names begin with CitrixLog, then show the auto-config operation and the date and timestamp of the cmdlet execution.
Logs do not auto-delete.
Console logging can be suppressed by using the -quiet parameter

PoC Guide: Automated Configuration Tool - Backup and Restore On-Premises

Thu, 01 Jan 1970 00:00:00 +0000

Overview

The Citrix Automated Configuration Tool (ACT) migrates workloads and aids in daily Citrix administration tasks for both on-premises and Cloud. The ACT Backup and Restore functionality allow Citrix administrators to create a Citrix Site backup in configuration files (.yaml), which contain the current state of the site. Think of this as a point-in-time snapshot of your Citrix Site, rather than an incremental backup. ACT generates configuration files for each of the Citrix components (Machine Catalogs, Delivery Groups, Applications, and Host Connections). The ACT Backup and Restore feature are only available as part of the Citrix Web Studio console. The article Install Web Studio details the steps required to install and configure the Citrix Web Studio console.

Backup and Restore Process

When you select the Backup + Restore tab in Citrix Web Studio, you're prompted to download and install the Automated Configuration Tool. The Backup and Restore process is completed using the PowerShell SDK of the ACT.

Download the .msi file and install the Automated Configuration Tool. It's suggested to install it on a Citrix Delivery Controller server.

After installing the Automated Configuration Tool, verify the installation by viewing it listed under 'Programs and Features'.

A Direct Access icon named Auto Config is created for the Automated Configuration Tool on the desktop.

Creating a Backup and Restore

Before starting working with the tool, let’s get familiar with the main base cmdlets of the Automation Configuration Tool:

Backup-CvadAcToFile - Backs up all the configurations from your Citrix Site.
Restore-CvadAcToSite - Restores backup YAML files to the Citrix Site. This can refer to the same or a different Citrix Site.

Based on these cmdlets, you can do either a full restore or a granular selection of the component you want by adding a switch pointing to the specific resource/configuration file (.yml) such as -includebyname (we explain this later and provide examples).

Backing up your site is a straightforward process, as mentioned, the Automated Configuration Tool exports your site “snapshot” into configuration files. The ACT files are in the folder %HOMEPATH%\Documents\Citrix\AutoConfig

Below is a screenshot displaying the contents of a backup folder. A unique folder is created for each backup with the date and time stamp of when the backup was completed. Every backup folder has configuration files that can be used to restore.

Backup and Restore Example

This example walks you through the following processes to begin using the Automated Configuration Tool:

Creating the base folder structure %HOMEPATH%\Documents\Citrix\AutoConfig
Modifying the CustomerInfo.yml file for On-Premises
Creating a Backup
Restoring from Backup

Creating the Folder Structure

The ACT requires a folder structure to locate the .yml files generated during the backup. First, we need to 'export' the initial configuration.

Launch ACT and run the command Export-CvadAcToFile

ACT creates the folder structure, and in it the configuration files. Below is a screenshot displaying the results.

Modifying Configuration File for On-Premises

Open the CustomerInfo.yml file from C:\Users\%username%\Documents\Citrix\AutoConfig
Find the 'Environment' variable and replace the value 'Production' with 'OnPrem'

Note:

Remember, the 'OnPrem' parameter is case-sensitive. Be sure to capitalize both the 'O' and 'P,' or else you are asked to log in to Citrix Cloud.

Creating a Backup

Once the Folder structure is ready, you can continue to run the 'Backup' cmdlet. As mentioned before, to create a backup you need to run the following command: Backup-CvadAcToFile

Restoring from Backup

Files that are imported come from the folder specified using the -RestoreFolder parameter. This parameter recognizes the folder that holds the .yml files to restore the site. This must be a fully qualified folder path. This cmdlet can also be used to revert to the previous configuration or to backup and restore your Citrix Site. This command can add, delete, and update your Citrix Cloud Site.

Note:

The switch name corresponds to each .yaml file's content, allowing you to restore components like Machine Catalogs, Delivery Groups, Applications, and Policies.

Here are some examples of restoration granularity and their corresponding commands:

Restore to a specific backup
- Restore-CvadAcToSite -RestoreFolder %HOMEPATH%\Documents\Citrix\AutoConfig/Backup_yyyy_mm_dd_hh_mm_ss

Restore Granular for specific components

Restore a specific Machine Catalog
- Restore-CvadAcToSite -RestoreFolder %HOMEPATH%\Documents\Citrix\AutoConfig/Backup_yyyy_mm_dd_hh_mm_ss -MachineCatalog -IncludeByName “name of the catalog”
Restore a specific Delivery Group
- Restore-CvadAcToSite -RestoreFolder %HOMEPATH%\Documents\Citrix\AutoConfig/Backup_yyyy_mm_dd_hh_mm_ss -DeliveryGroups -IncludeByName “name of the Delivery Group”

Running the Restore

Launch ACT and enter the 'Restore' command depending on what you want to restore, either a full restore or by component.

We're restoring a single Delivery group in this example to demonstrate how detailed and granular the command syntax can be. Restore-CvadAcToSite -RestoreFolder C:\Users\amiringectxadminaz\Documents\Citrix\AutoConfig\Backup_2023_04_14_10_50_31 -DeliveryGroups -IncludeByName “VDI-MANUAL”

Let’s break down this command for a clear understanding of how it works. This provides guidance on using other switches:

Restore-CvadAcToSite: This is the base Restore command or instruction.
-RestoreFolder: followed by the folder name. It calls the specific path/location of the files that we want to restore.
-DeliveryGroups: Switch used to specify Citrix Component to migrate.
-IncludeByName: Specify a single resource to migrate using this command (add suffix/prefix to restore multiple resources with similar names).

A prompt request for you to 'Confirm' if you want to continue.

Type YES to continue.

The ACT starts the process by contacting the backup folder that you specified in the command, followed by the specific component (Delivery Group, in this example). ACT reads and pulls the existing information in the DeliveryGroups.yml file, as demonstrated below:

Final Result

Once ACT finishes running the restore process, it generates a Log File with details of what was done and list recommendations in case something goes wrong. Below you can see the content of the log file.

From the Citrix Web Studio console and click the Refresh button on the top right corner to refresh the console and show the restored components.

Click “Refresh” on the Citrix Web Studio console.
The Restore process is complete.

Summary

This guide walked you through configuring the ACT folder structure, modifying the On-Premises configuration, creating a backup, and performing a restore. To learn more about the Citrix Automated Configuration Tool cmdlets, visit the Automated Configuration Tool product documentation

PoC Guide: Automated Configuration Tool - On-Premises to On-Premises Migration

Thu, 01 Jan 1970 00:00:00 +0000

Overview

The Automated Configuration Tool facilitates migrating and exporting configurations to Citrix DaaS. However, Citrix Virtual Apps and Desktops site configurations can also be migrated and exported from one on-premises environment to another using the ACT on-premises. This POC Guide guides you to migrate an on-premises Citrix Virtual Apps and Desktops site to another Citrix Virtual Apps and Desktops on-premises site using the Citrix Automated Configuration Tool. Consider moving a tested and validated DEV/UAT configurations to Production as a potential use case for the Automated Configuration Tool on-premises to on-premises migration.

Source Deployment:

Target Deployment:

Configuration with source and target:

Note:

Web Studio must be installed on the Target site, requiring, at minimum, Citrix Virtual Apps and Desktops Current Release 2212. Web Studio is necessary to use the orchestration APIs locally on the DDC.

Pre-requisites

On-Premises environment

Citrix Virtual Apps and Desktops On-Premises environment with at least one registered VDA.
Source: Citrix Virtual Apps and Desktops On-Premises environment running on one of the following versions:
- Any Long Term Service Release (LTSR) versions with their latest CU (1912, 2203)
- Or one of the corresponding latest two Current Releases (CR) versions (for example, 2112, 2206).
Destination: Citrix Virtual Apps and Desktops On-Premises environment running at minimum the latest Current Releases (CR) version 2212.
The domain-joined machine where you plan to run the Automated Configuration tool commands must run a .NET 4.7.2 version or higher.
A machine with the Citrix PowerShell SDK, which automatically installs on the DDC.

Note

If running the tool on a different machine, it must be domain-joined, and Studio requires the correct PowerShell snap-ins installed. The installer can be found on your corresponding versions Product ISO installation media, obtained from the Citrix Virtual Apps and Desktops downloads website.

Download the Automated Configuration tool MSI from here.

This proof of concept guide demonstrates how to

Deploy a new Delivery Controller.
Configure the new Delivery Controller.
Export configuration from source DDC.
Prepare the import.
Import configuration on target DDC.

Deploy a new Delivery Controller

For this POC Guide, the new server is named UAT-DDC-01.

Note:

The new Delivery Controller Server requires at least 5 GB of memory.

Use a newly deployed Windows Server domain joined server.
Download Citrix Virtual Apps and Desktops 2212 or later.
Mount the ISO file.
Run AutoSelect as an Administrator.
Click Start.
Click Delivery Controller.
Accept the license and click Next.
Clear License Server and click Next.
Click Next.
Clear Install Microsoft SQL Server 2019 Express CU15 to use your current Database server and click Next.
Click Next.
Click Install.
Click Connect or clear the box and click Next.
Click Finish.

Configure the new Delivery Controller

Initial configuration

Click Deliver applications and desktops to your users.
Provide a Site Name and Click Next.
Provide Database information and Click Next.
Provide the name of your Citrix License Server and Click Connect.
Select Connect me and Click Confirm.
Click Next.
Click Finish.

Log on to Web Studio

Browse the Web Studio website at https:///Citrix/WebStudio.

Connect to Web Studio from the Start Menu and select Citrix Web Studio.
Provide credentials and Click Sign In.
Upon the first launch, the console is empty

Export configuration from source DDC

Connect to the Source Delivery Controller.
Download the latest version of the Citrix Automated Configuration tool from here
Install AutoConfig_Powershell_x64.msi.
Open Auto Config from the icon on your desktop.
Run Export-CvadAcToFile.

Prepare the import

Connect to the Destination Delivery Controller.
Download the latest version of the Citrix Automated Configuration tool from here
Install AutoConfig_Powershell_x64.msi.
Open Auto Config from the icon on your desktop (this creates the Citrix folder under C:\Users\%username%\Documents).
Copy the folder C:\Users\%username%\Documents\Citrix on the Source Delivery Controller and paste it to C:\Users\%username%\Documents\Citrix on the Destination Server. Accept the merge option.
Edit CvadAcSecurity.yml using notepad.
Provide the correct Hypervisor password and save the file.
Edit CustomerInfo.yml using notepad.
Update the environment from Production to OnPrem and save the file.

Import configuration on target DDC

Connect to the Destination Delivery Controller.
Open Auto Config from the icon on your desktop.
Run Import-CvadAcToSite.
Enter Yes to confirm and continue with the import.
The Hosting Connection is created first.
Next, the Machine Catalogs are created.
The Delivery Groups are created next.
Next, the Applications.
Lastly, the Policies are created.

Note:

Alternatively, run Merge-CvadAcToSite to ensure any existing configurations do not get overwritten. Optionally, migrate one component at a time by running Merge-CvadAcToSite -Tags, followed by Merge-CvadAcToSite -MachineCatalogs, etc. See here for more information on granular migration.

Validation

Resource creation

First, validate that the resources have been created on the Destination Delivery Controller.

On Destination Delivery Controller, connect to Web Studio.
Click Machine Catalogs to validate your Machine Catalogs.

Here we can see that PVS and Static VDAs are present, and the MCS machine catalog is still running (the master image metadata has been copied)
Click Delivery Groups to validate your Delivery Groups.

Here we can see that the Delivery Groups have been created and PVS and Static VDAs added. However, the Delivery groups are in maintenance mode.
Click Applications and ensure you see all your applications (and any applications folder you have set up).
Click Policies and ensure you see all your Policies.
Click Machine Catalog. Wait until the process of the master copy is complete.

VDA Creation

Any VDAs need to be created manually for the MCS machine catalog. We add one Windows 10 MCS and one Windows Server 2022 MCS VDA to validate.

VDA Registration

Now that we have our MCS VDAs created, we can use PVS and Static without the need to recreate them.

Turn Off Maintenance Mode on the Delivery Group.
Restart all your VDAs.
Check the registration state.
All the Windows 10 MCS VDAs are registered. They have registered because they were installed with the VDA selected to Let machine creation service do it for registration.
All VDAs need to register with the new Delivery Controller to test everything. In our case, we created OU in Active Directory to place the new MCS, current PVS, and Static and create a GPO to change registration.
Move the VDAs you want to test to the OU where the GPO is applied.
Reboot the VDAs and check the registration status.
The VDAs moved to the correct OU with GPO applied are now registered.

Troubleshooting Tips

General information for troubleshooting:

Refer to the Automated Configuration Tool Troubleshooting FAQ article.
Prior to opening support ticket with Citrix, collect all log and *.yml files into a single zip by running New-CvadAcZipInfoForSupport. No customer security information is included. Forward the zip file at the following location %HOMEPATH%\Documents\Citrix\AutoConfig\CvadAcSupport_yyyy_mm_dd_hh_mm_ss.zipNew-CvadAcZipInfoForSupport.
Running any cmdlet creates a log file and an entry in the master history log file. The entries contain the date, operation, result, backup, and log file locations of the execution. This log provides potential solutions and fixes to common errors.
The master history log is located in %HOMEPATH%\Documents\Citrix\AutoConfig, in the file named History.Log.* All operation log files are placed in a backup folder.
All log file names begin with CitrixLog, then show the auto-config operation and the date and timestamp of the cmdlet execution.
Logs do not auto-delete.
Console logging can be suppressed by using the -quiet parameter

For more information:

You can also reach out via the Support Forum
Read the Automated Configuration Tool documentation
Download new versions from the direct Downloads website link
Check out our On-demand August 19 webinar recording - "Why Citrix Cloud migration is easier than ever". We shared more information on the tool and hosted a Live Q&A session with a panel of Citrix experts.
Refer to the Citrix DaaS Migrate to cloud section for more information and the Official Documentation.
If after consulting the information listed previously you still need assistance, get in touch with your Citrix representatives, Customer Success Manager, or Support.

PoC Guide: Citrix Analytics for Performance

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Citrix Analytics for Performance allows you to track, aggregate, and visualize key performance indicators of your Citrix Virtual Apps and Desktops environment. It quantifies user experience and gives customers end-to-end visibility on what the root cause for end user experience is. It also provides multi-site aggregation and reporting. Customers who have multiple sites can consume data from a single pane of glass instead of having to log into multiple consoles. More information on Citrix Analytics for Performance can be found here and videos demonstrating the Citrix Analytics for Performance can be found here.

Pre-requisites

Please review the following Analytics for Performance onboarding guide before moving into your POC build.

Analytics PoC Onboarding Guide.PDF

On-premises Citrix Virtual Apps and Desktops Sites

Delivery Controller and Director 1909 or later
Citrix Cloud account with Citrix Analytics entitlements
- Your Citrix Cloud account is an Administrator account with rights to the Product Registration Experience.
Full details on pre-requisites can be found here

On-premises StoreFront

Your StoreFront version must be 1906 or later.
The StoreFront deployment must be able to connect to the following address:
- https://.cloud.com
- *https:// api.analytics.cloud.com
The StoreFront deployment must have port 443 open for outbound internet connections. Any proxy servers on the network must allow this communication with Citrix Analytics.

Deployment Steps

Connecting Citrix Analytics with on-premises Citrix Virtual Apps and Desktop sites

Log into Director as a full administrator and pick which Site you want to configure with Performance Analytics
Click the Analytics tab
Select the terms and click Get Started
Click Connect Site
Click Copy Code and then click Register on Citrix Cloud
Log in to Citrix Cloud
Paste the 8 digit code you copied in Director and click continue

Connecting to on-premises StoreFront

Log into Citrix Cloud and click Manage under the Analytics console from your StoreFront server
Click Manage
Click on settings and then click on data sources
Click the ellipses next to Virtual Apps and Desktops and select Connect to StoreFront Deployment
Click download file
Open powershell and run the following command: Import-STFCasConfiguration -Path "configuration file path"
You will now be able to see that the StoreFront database has been added

Citrix Desktop-as-a-Service (DaaS)

Citrix Analytics automatically detects Citrix DaaS sites and no action by the administrator is needed.

Relevant Data

Once data is flowing into the environment some things to keep in mind:

Multi-site aggregation

Allows you to get insights into multi-sites regardless of whether they are hosted on-premises, cloud, or hybrid.

User-Experience Score

The User Experience score is a comprehensive measurement of the quality of the session established by the user. Click on the number of poor users

User experience score are based on:

Session availability
Session responsiveness
Session logon duration
Session resiliency

You can click on each factor to get corresponding subfactors and insights into what might be causing the issue and proactively resolve those issues.

Failure Insights

Failure Insights provide insights into the root causes for session failures in your environment.

Click on the number of machines to see which machines are black hole machines

Click on a specific machine to see further details on the black-hole machine

PoC Guide: Citrix DaaS with Azure Virtual Desktop Hybrid

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Microsoft Azure Virtual Desktops allow enterprises to deliver virtual applications and desktops from Azure.
This proof of concept (PoC) guide is designed to help you quickly configure Citrix DaaS with Azure Virtual Desktop for a trial evaluation only, in a hybrid environment.
At the end of this PoC guide you are able to bridge your on-premises Citrix DaaS deployment with a Microsoft Azure subscription using Citrix DaaS.
You are able to let your users launch an Azure Virtual Desktop virtual app or desktop using the new Windows 11 Multi-Session experience, while also accessing on-premises resources.

Conceptual Architecture

Scope

In this PoC guide, you experience the role of a Citrix Cloud and Microsoft Azure administrator and create a hybrid environment that spans your organization’s on-premises deployment and Azure.
You provide access to a virtualization environment consisting of the Windows 11 Multi-Session experience in Azure Virtual Desktop (AVD) and on-premises resources to an end user with Citrix DaaS.

This guide showcases how to perform the following actions:

Create a new Azure subscription and an Azure Active Directory (AAD) Tenant (if you don’t have one)
Connect your on-premises AD to your AAD using Azure AD Connect
Create Master Image using Windows 11 Enterprise for Virtual Desktops
Create a Citrix Cloud account (if you don’t have one)
Request a Citrix DaaS trial
Create a Citrix DaaS account (Citrix Cloud account) and add the Azure tenant as a Resource Location
Create a Windows Server VM and install the Citrix Cloud Connector in your Azure resource location
Prepare the Azure Virtual Desktop template for the session host virtual machines (VMs). Install the Citrix Virtual Delivery Agent on the AVD VM
Use your Citrix Virtual Apps and Desktops service account (Citrix Cloud account) to connect to your Azure subscription using the Citrix Cloud Connector
Use Citrix Machine Creation Services for deploying a catalog and then create a delivery group
Create a Windows Server VM and install the Citrix Cloud Connector in on-premises Resource Location and add it as a resource location
Use your Citrix DaaS account (Citrix Cloud account) to connect to your on-premises resources using the Citrix Cloud Connector
Let your users connect to the AVD or on-premises sessions via Citrix Workspace

There is a requirement from Microsoft that the AVD session hosts must be joined to a Windows Active Directory (AD) domain that has been synchronized with either Azure AD using Azure AD Connect or with Azure AD Domain Services. It requires you to connect your on-premises Active Directory to your organization’s Azure subscription. This is out-of-scope for this guide but if you are also a Citrix Networking customer then you can use Site-to-Site VPN with Citrix ADC (which requires a public IP).
The two preceding options are creating IPsec tunnels between your on-premises environment and the AVD network in Azure.

If you are looking for a solution that does much more than just set-up a link between these two locations, then we suggest considering creating an end to end SDWAN solution. The main advantages this gives you are integrated security, orchestration, and policy-based configuration.
SDWAN has further benefits:

Enables direct access to video-on-demand that is rendered from the customer data center
Provides intelligent traffic steering from the VDA to other on-premises properties
VoIP and real-time video traffic are navigated from the corporate data center
Aggregate more than 1 link to give you resiliency and expanded bandwidth by combining the different links

To set up an end to end SDWAN solution you can follow these guides:

Express route or Point-to-Site VPN which doesn’t require a public IP are other options to establish the connectivity.

This guide provides detailed instructions on how to deploy and configure your environment including VMs, connecting your AD to Azure AD. As a Citrix and Azure tenant administrator, you create the AVD environment to enable your users to test various scenarios that showcase Citrix DaaS and Azure Virtual Desktop integration.

Create an Azure Subscription and an Azure Active Directory Tenant

If you are an existing Microsoft O365 customer you already have an Azure Active Directory (AAD) and so you can log in to Azure as the global administrator of the subscription and skip to the next section.

Go to the url: Sign into Azure and login to Azure
Enter you information, click Next
Verify your identity and then provide your credit card details for billing purposes. You may be asked to verify your card details by making a payment of ~ USD 1
Once you are done you see this in Azure Portal. If that is the payment method you want to use click Next. Else change it and then click Next.
If you agree, check the I agree checkbox for subscription agreement, offer details, and privacy statement. Click Sign Up.
Alternately you can enroll in an O365 Enterprise E3 trial by going to this link and providing your details
Click + Create a Resource and search for Azure Active Directory and select it
Click Create
Provide the Organization name and Initial domain name of the AD that you want to create. Select the Country or Region and then click Create
Wait for the Azure AD to be created

Connect the on-premises AD to Azure AD using Azure AD Connect

Launch an RDP session to the AD.
Open a browser and login to Azure as the global administrator of the subscription and Azure AD. Click Azure Active Directory and then Azure AD Connect. Click Download Azure AD Connect
In the browser window that opens click Download
Click Run
In the Azure AD connect dialog, click Continue
Click Use Express Settings
Provide the Azure Active Directory global administrator Username and Password. Click Next and login again if requested
Provide the Active Directory enterprise administrator Username and Password. Click Next.
Check the Continue without matching all UPN suffixes to verified domains, click Next
Click Install
Once the config is complete, click Exit
Go back to the Azure Active Directory page in the Azure portal and click Users. Validate that one or more users you created are visible in the list.

Create a master image using Windows 11 Enterprise Multi-session

Select + or + Create a resource. Search for Microsoft Windows 11 and select the Microsoft Windows 11 option that shows Windows 11 Enterprise multi-session in the drop-down list.
Select the Windows 11 Enterprise multi-session option from the drop-down list and then click Create
Select the appropriate Subscription and the Resource group created for AVD to deploy the machine in. Provide a name for the Master Image VM. Choose the same region as the AD VM. Enter the credentials for the administrator account. Click Next: Disks
Select the appropriate OS disk type and Encryption type for your deployment. Click Next: Networking
Select the virtual network that your other VMs are on and ensure that a Public IP is being created for the Master Image. Click Review + Create
Ensure that the Validation Passed message appears and check the machine settings. Click Create to begin the Master Image VM creation
Once the VM creation completes, click Go to resource.
The VM must have a networking rule to allow incoming RDP traffic on it Public IP. Click Networking in the Favorites column. Click Add inbound port rule
Your public IP can be obtained by running a google search for whatsmyip address to make RDP connections to the AD VM. Select IP Address as Source, enter the Public IP Address of the machine you want to connect from in the Source IP field, set Destination Port ranges to 3389, and Protocol to TCP. Set an appropriate Priority value and provide a name to the rule. * Click Add

*: Leaving port 3389 open remotely long-term can pose a security risk.
RDP in to the machine with the admin credentials you provided when creating the VM and join the VM to the domain and reboot the machine.

Create a Cloud Connector in your Azure subscription

Select + or + Create a resource in Azure. Select Windows Server 2019 Datacenter under Get Started to create a new Windows Server 2016 machine.
Select the appropriate Subscription and the Resource group created for AVD to deploy the machine in. Provide a name for the Cloud connector VM. Choose the same region as the AD VM. Enter the credentials for the administrator account. Click Next: Disks
Select the appropriate OS disk type and Encryption Type for your deployment. Click Next: Networking
Select the virtual network that your other VMs are on and ensure that a Public IP is being created for the Cloud Connector VM. Click Review + Create
Ensure that the Validation Passed message appears and check the machine settings. Click Create to begin the Cloud connector VM creation
Once the VM creation completes, click Go to Resource
The VM must have a networking rule to allow incoming RDP traffic on it Public IP. Click Networking in the favorites column and then click the name of the network interface
Click Network Security Group and then select the Network Security Group of your AVD VM as it already has the port rules to allow access to your machine. Click Save

*: Leaving port 3389 open remotely long-term can pose a security risk.
RDP in to the machine with the admin credentials you provided when creating the VM and join the Cloud Connector VM to the domain and reboot the machine.

Create a Citrix Cloud account

If you are new to Citrix Cloud, follow the instructions on the Citrix Cloud Sign Up page.

If you are an existing Citrix Cloud customer continue onto the next section. Ensure that you have an active Citrix Cloud account. If your account has expired you need to contact sales to enable it.

Create a new Resource Location

RDP to the Cloud Connector VM and login as the AD admin. Goto the URL: Citrix Cloud.
Enter Username and Password. Click Sign In. (If your account manages more than one customer select the appropriate one)
Under Resource Locations Click Edit or Add New
Click + Resource Location and enter name of the New Resource Location. Click Save
Under the newly created resource location click + Cloud Connectors
Click Download. Click Run when the download begins
The Citrix Cloud Connectivity test successful message is displayed. Click Sign in and Install to continue. If the test fails, check the following link to resolve the issue - CTX224133
From the drop-down lists select the appropriate Customer and Resource Location. Click Install
Once the installation completes, a service connectivity test runs. Let it complete and you again see a successful result. Click Close
Refresh the Resource Location page in Citrix Cloud. Click Cloud Connectors
The newly added Cloud Connector is listed. In production environments, ensure to have 2 Cloud Connectors per resource location

Request a Citrix DaaS trial

Sign in to your Citrix Cloud account
From the management console, select Request Trial for the Citrix DaaS Service

Quote

Note:

For some services you must request a demo from a Citrix sales representative before you can try out the service. Requesting a demo allows you to discuss your organization’s cloud service needs with a Citrix sales representative. Also, the sales representative ensures you have all the information needed to use the service successfully. When your trial is approved and ready to use, Citrix sends you an email notification.

Install Virtual Delivery Agent on the AVD host VM

While we wait, we can install the Citrix Virtual Apps and Desktops, Virtual Delivery Agent on the Windows 11 Multiuser VM that we created.

Connect to the AVD VM via RDP as the domain admin
Open Citrix.com in your browser. Hover over Sign in and click My Account
Sign in with your Username and Password.
Click Downloads.
From the Select a Product drop-down list, select Citrix Virtual Apps and Desktops
In the page that opens, select the latest version of Citrix Virtual Apps and Desktops 7 (without the .x at the end)
Scroll down to Components that are on the product ISO but also packaged separately. Click the chevron to expand the section. Click Download File under Server OS Virtual Delivery Agent
Check “I have read and certify that I comply with the Export Control Laws” checkbox, if you agree. Click Accept. The download begins.
Save the file and Run it when the download completes
Click Next in the Environment section to create a master MCS image.
In the Core Components section, check the Citrix Workspace app checkbox if your users can use the session to launch sessions from within it. Click Next
In the Additional section choose the components that you need and click Next

NOTE: To see logon information in Citrix Director, select also Citrix User Profile Manager
Enter the UPN for the Cloud Connector VM and click Test Connection. Ensure that the test is successful a green tick appears next to the entered UPN. Click Add and click Next
Click Next in the Feature section and Next again in the Firewall section.
Click Install in the Summary section
Once the installation completes, in the Diagnostics section click Connect. Enter your Citrix Cloud credentials, click OK. Once the credentials are validated, click Next
Click Finish and let the VM reboot.

Create a hosting connection between Citrix DaaS and Azure

Configure Citrix DaaS to connect to the Azure Subscription that hosts the Azure Virtual Desktop VMs.

Once the trial is approved, Log in to Citrix Cloud from your local machine. Scroll to My Services, and locate DaaS service tile, click Manage
the Full Configuration page is displayed
in the left navigation menu, click Zones and verify that the Resource Location and Cloud Connector you have setup are visible.
In the left menu under Configuration. Click Hosting and then click Add Connection and Resources that host the machines.
From the drop-down lists select Create New Connection, Microsoft© AzureTM as Connection Type, Azure Global for Azure environment and the Azure zone location setup as a Resources Location. Select Citrix provisioning tools (Machine Creation Services selected. Click Next
Paste your Azure Subscription ID in the Subscription ID text box and enter a Connection Name. Click Create New to create a new service principal. Alternately you can manually grant Citrix Cloud Access to the Azure subscription (with more restrictive roles than the default contributor) CTX224110
Sign in to your Azure account when prompted. Ensure that the user is an owner and not an external user in the subscription
Check the Consent on behalf of your organization checkbox and click Accept if you agree. Once the validation completes Connected is displayed. Click Next
Select the appropriate Region and click Next
Enter a Name for these resources and select the appropriate Virtual network and Subnet where the VMs are to be created. Click Next. Review the Summary and click Finish
You are returned to the Hosting page. Once you are done click Machine Catalogs to start creating your catalog.

Create a Machine Catalog and a Delivery Group

Click Create Machine Catalog.
In the Machine Catalog Setup dialog, click Next
Ensure Multi-Session OS is selected. Click Next
Ensure Machines that are power managed and Citrix Machine Creation service are selected and the correct Azure network is shown in the Resources. Click Next
Choose the correct disk that is associated with the AVD VM. From the minimum functional level drop-down list select 1811 (or newer). Click Next. A pop-up appears to ask for the VM attached to the VHD to be stopped.
Log in to the Azure portal and Under Virtual Machines, go to the AVD VM and Click the Stop button. Ignore the warning about losing the Public IP. Wait for status to show Stopped (deallocated). Return to the Citrix Cloud tab and click Close
Leave Defaults and click Next
Modify the number of VMs if you want and select the machine size you want for your VMs. Click Next
Click Next
Set the write back cache size if you want it. Click Next
Click Next and click Close
Select the OU in which the VMs are placed. Enter the computer Account naming scheme. Ensure that the name is fewer than 15 chars long and ends with a #. Click Next
Click Enter Credentials. In the dialog that opens enter username and password of the AD admin. Click Done. Click Next
Click Next
Click Next
Enter a name for the machine catalog. Click Finish
Wait for the catalog to be created.
When Machine Catalog creation is finished, from the left side menu click Delivery Groups then Create Delivery Group.
Select the Windows 11 Multisession Catalog. Increment the number of machines to the number of VMS you want to add to the delivery group. Click Next
For our example we select the Allow any authenticated users to use this Delivery Groupo radio button. Click Next
If you want to also make apps available from this delivery group click the Add drop-down list and choose From Start Menu
From the Add Applications from the Start drop-down list Dialog check the boxes next to the apps you want to make available. Then click OK
Click Next
In the Desktops section click Add. Enter Display Name for the delivery group. Ensure Enable desktop is checked. Click OK
Click Next
Click Next
Select the appropriate License Type and Click Next
Enter a Delivery Group name. Click Finish
Once the delivery group is created, your Delivery Group overview looks like this.

If you want to add your on-premises resources to the Workspace follow the below steps.

Create a Cloud Connector in your on-premises data center

Add a cloud connector in your on-premises data center. Create a Windows server 2012 R2 or 2016 VM in your on-premises. Repeat the steps in the “Create a new Resource Location” section.

Add on-premises site to the Workspace

Follow the steps in the guide to add the on-premises site to Citrix DaaS. Complete until the end of Task 3: Configure connectivity and confirm settings in this page.

Launch the session from Citrix Workspace

Open the Workspace URL you saved earlier (from Citrix Cloud) to the Citrix Workspace. Log in as one of the domain users that you added to the Delivery Group.
Click View all Desktops
Click the Windows 11 Multi-session DG desktop that you created in Azure.
The session launch gives you access to the Azure Virtual Desktop

Summary

The guide walked you through bringing your Azure hosted Azure Virtual Desktop and on-premises resources (using Workspace Configuration) together, so users access them in one place. You learned how to create a hybrid setup to manage both Azure Virtual Desktops based VMs and on-premises based resources using Citrix Virtual Apps and Desktops. The process included creating a network connection between the Azure virtual network and your on-premises data center. Also you learned how to synchronize your on-premises Active Directory with Azure Active Directory with Azure AD connect. We even looked at how to create a Citrix Cloud account, if you didn't have one and get access to the Citrix Virtual Apps and Desktops service, which makes all this work.

To learn more about migrating your on-premises Citrix Virtual Apps and Desktops setup to the cloud, read the deployment guide

PoC Guide: Citrix for Windows 365

Wed, 09 Oct 2024 11:51:00 +0000

Overview

Microsoft Windows 365 (Cloud PC) is an Azure-hosted service providing dedicated Windows virtual machines.

Citrix for Windows 365 extends the Cloud PC experience with high-end graphics technology, integration with third-party solutions, support for thousands of devices and peripherals, and added layers of security, benefiting IT admins and users alike.

This Proof-of-Concept Guide provides the steps to integrate Windows 365 Cloud PCs with Citrix DaaS (Desktop as a Service). The following is covered in this guide:

Enable the Citrix connector for Windows 365
Connect Microsoft Entra ID to Citrix Cloud
Connect Windows 365 to Citrix Cloud
Assign Citrix licenses
Provision Cloud PCs
Enable Citrix VDA Upgrade service

Prerequisites

Citrix Cloud Account: You'll need an active Citrix Cloud account with the necessary licenses.
Windows 365 Enterprise Subscription: Ensure you have a Windows 365 Enterprise subscription to access Cloud PCs.
Microsoft Intune entitlement: You need an active Microsoft Intune environment in your Entra ID directory.
Azure Administrator accounts: You will require an Entra ID global administrator and Intune Global administrator privileges or someone with access to these accounts.

Enable Citrix Connector for Windows 365:

Open your Intune administrator portal and log in with an account with Global Administrator privileges.
Select Tenant administration.

Select Connectors and tokens.

Select Windows 365 partner connectors.

Click Add.
Select Citrix from the list. Set the toggle to On for "Allow people to use Citrix to connect to their Cloud PCs." Click Add.

The Citrix Connector is now enabled.

Connect Entra ID to Citrix Cloud

Important:

If your Citrix Cloud tenant is already connected to Entra ID, you can skip this section.

Open the Citrix DaaS web console.
Select Quick Deploy.

Select Microsoft Windows 365.

Click Connect.

Citrix Cloud Identity and Access Management will open in a new tab.

Click Add an identity provider.

Choose Azure Active Directory, provide an Identity provider name, and click Add.

Select the three dots next to Azure Active directory and select Connect.

Confirm your custom administrator sign-in URL if prompted.

Log into Entra ID with a Global Administrator account.

Review the requested permissions. Select Accept.

Citrix Cloud is now connected to your Entra ID tenant. Return to the previous and continue with the next step.

Configure Citrix Workspace:

Important:

You can skip the next step if your Citrix Workspace configuration is already configured.

Select Review.

Workspace Configuration will open in a new tab.

Note the Workspace URL, which will be used to access the Cloud PCs. Select Edit to customize your URL.

Enter the subdomain, review and accept the considerations, and click Save.

Select Authentication.

Choose the authentication option for your POC. Additional details on supported authentication methods are available here.

Activating Azure Active Directory for subscriber access will impact the subscriber and administrative experience. Select ‘I understand the impact on the subscriber experience,’ Select Confirm

[Optional) Configure Authentication with the Federated Authentication Service (FAS).

Select Customize.

Select Preferences.

Scroll to Automatically Launch Desktop, set it to Enabled, and click Save.

[Optional) Disable the Federated Identity Provider Sessions option in Workspace if:
1. Your users’ client devices are Entra joined, or Entra hybrid joined, and you want a single sign-on into Citrix Workspace (the IdP must be Entra ID).
2. Your users will use the Windows 365 web portal instead of accessing Citrix Workspace directly, and you want single sign-on into Workspace to avoid prompting users for credentials a second time. Note that this is only relevant if your Azure and Workspace IdPs are the same.

Close the Workspace Configuration tab and return to the Windows 365 Get Started checklist.

Connect Windows 365 to Citrix Cloud

Select Connect in step 3.

Login with an Azure account with Global Administrator privileges.
Review Permissions requested. Select Accept.

Return to the Windows 365 Get Started checklist.

Assign Citrix Licenses to Users

Click Assign in step 4, Assign Citrix licenses.

Click Assign licenses.

Select Groups, Users.

Search for the Groups or users to assign a Citrix license to and click Search.

Select the Groups or Users and click Save.

Validate your license assignments.

Note:

If the users selected already have Cloud PCs assigned, the Citrix Virtual Delivery Agent will be installed automatically and switch the user access to Citrix. If so, you can skip to the Access Your Cloud PC section.

Provision Cloud PCs

Log into the Microsoft Intune admin portal with an account with global administrator privileges.
Select Devices > Windows 365 > Provisioning policies > Create policy.

Enter a Policy name

Select your License type.

For our deployment, we select Microsoft Entra Join and Azure network connection for the network. The Azure network connection Azure East US was selected.

Check the Use Microsoft Entra single sign-on box and click Next.

Select your image type and click Next.

Select any additional configurations required for your Cloud PC and click Next.

Configure scope tags for the provisioning policy and click Next.

Select your User Groups to assign this policy and click Next.

Review your policy options, then click Create.

Your Cloud PCs will now be provisioned.

Review Cloud PC Citrix Policy

By default, the Cloud PCs are configured in a connector-less mode. A Citrix Policy is automatically created for these machines, which enables the Rendezvous Protocol. You can review and update this policy as required.

Click Policies.

Select CTX-Windows365-eastus policy and click Edit Policy.

Select View selected only.

The Rendezvous Protocol policy is Allowed.

Note:

Additional settings can be added to this policy per your requirements and best practices.

Click Assign Policy To. The policy is assigned to the Cloud PC Delivery Group.

Click Save.

Enable Citrix VDA Upgrade service

The Citrix VDA Upgrade service is a cloud-based feature of Citrix DaaS. With it, administrators can improve operational efficiency by shifting VDA updates from manual or complex processes to automated processes that Citrix manages.

Select Machine Catalogs, right-click on your Cloud PC catalog, and select Edit Machine Catalog.

Select VDA Upgrade Service.

Check Use VDA Upgrade Service, select Latest CR VDA, and click Save.

The VDA Upgrade service is now enabled for your Cloud PCs.

Access Your Cloud PC

Open a browser window and access your Citrix Workspace URL.
Use your Entra ID credentials to log in.
Your Cloud PCs are displayed and will begin to launch if you enabled Desktop Auto Launch earlier.

Summary

Following this proof-of-concept guide, you successfully integrated Windows 365 with Citrix DaaS, unlocking a superior desktop virtualization experience. This integration empowers your workforce with secure, high-performance access to their Cloud PCs from anywhere while simplifying IT management and reducing costs.

PoC Guide: Citrix ITSM Adapter service + ServiceNow

Thu, 01 Jan 1970 00:00:00 +0000

Overview

IT Service Management (ITSM) Adapter is a Citrix Cloud service that lets you extend the ServiceNow capabilities into your Citrix DaaS and on-premises environments. With the service, IT teams and end users can deliver and manage Citrix Virtual Apps and Desktops using ITSM workflows in ServiceNow through the Self-Service capabilities.

This PoC document shows you how to integrate the Citrix ITSM adapter service + ServiceNow for a test environment with out-of-the-box features for End Users and Administrators.

These features and roles include:

Also, don’t forget to review the features released in new versions, what's new, enhancements, and what's in the roadmap.

Conceptual Architecture

Before getting started with the configuration guide, let's have a better understanding of the Architecture:

In the diagram, you can see that we’re working with two cloud services. The first is ServiceNow, and the second is the Citrix Cloud control plane.

Beginning with the ServiceNow service, we're going to require two components: the Orchestrator plugging, which is going to be the component to access all the workflow design, and the Citrix ITSM connector plug-in, and it's going to make the connection with the Citrix Cloud control plane.

Installing the Citrix ITSM connector plug-in from the ServiceNow store creates two tables in the ServiceNow database instance. These tables are related to the Citrix licensing and the Citrix VDA information. On the other hand, from a Citrix Cloud control plane standpoint, the Citrix ITSM adapter is already installed, so you only need to enable the service for your integration. If you have an on-premises environment, perform a site aggregation to discover that workload. Last but not least, the communication between both services happens through an OAuth profile from ServiceNow that provides a client ID and secret password to register with the Citrix ITSM service.

Now that you better understand the Architecture and how Citrix ITSM works and communicates with your environments (Cloud and on-premises), it’s time to move forward with our Readiness Review.

Prerequisites

To set up the ITSM Adapter service, make sure you have the following things ready:

An account with system administrator permission to your ServiceNow instance
After the service is set up, you can implement role-based access control. For more information, see Access Management.
Register to Citrix Cloud control plane to get access to ITSM service and sign up for a free trial.
A Citrix Cloud administrator account with Full Access.
Connectivity between your ServiceNow instance and the IP address of the region where your Citrix Cloud account is located.

Scope

We’re going to summarize the integration in the following steps:

ServiceNow
- Enable Orchestration plug-in
- Install Citrix IT Service Management Connector from the ServiceNow Store
- Create an OAuth application.
Citrix Cloud / ITSM service console
- Enable ITSM service.
- Add your ServiceNow instance.
- Add the on-premises Citrix environment (Site aggregation)

Orchestration plug-in

Under the My Instance admin console, go to the Instance Action and click Activate Plugin. Search for the Orchestration plug-in and click activate. Once completed, you receive an email notification.

Install Citrix IT Service Management Connector from the ServiceNow Store

The Citrix ITSM plug-in for ServiceNow provides an easy way to extend ServiceNow’s capabilities into your Citrix infrastructure. While virtual app and desktop (Citrix Workspace) delivery allows organizations to be more flexible and end-users more productive with anywhere, any device access, this new plug-in further enhances the capabilities of Citrix environments with ServiceNow integration. With out-of-the-box workflows and the ability to create custom workflows, IT teams can now automate, monitor, and manage their Citrix environments, allowing them to focus on strategic projects while automating minor tasks.

Note:

Remember the Orchestration plug-in has a dependency, so make sure you activate the plug-in before installing the ITSM connector.

Go to the ServiceNow store, and on the search bar, type Citrix.
Select the Citrix IT Service Management Connector and click Get to start the installation process
Click Install.
Once completed, you can review the installation logs.
Finally, the ITSM connector shows as Installed.

So far, you’ve prepared your ServiceNow instance for the integration. A small piece (the OAuth client ID and Secret) is pending, but we go back later to the SNOW console to do that when needed.

Now is the time to start working on the Citrix Cloud console to activate the service and register your ServiceNow instance.

Registering SNOW with Citrix ITSM service

On the Citrix Cloud console, go to My Services (under the hamburger menu)
- Go to Services > ITSM.
- Click the + Add a ServiceNow instance tab.
- Copy the Redirect URL in the window (you need it to create the OAuth application in the ServiceNow console).

Create the OAuth Application

To add the Client ID and secret, you must create the OAuth application:
- Go to the ServiceNow Admin Console and search for OAuth > System OAuth and click New.
Select **Create an OAuth API endpoint for external clients.
Enter the following information:
- Name: any friendly name (Citrix Cloud)
- Client ID: it’s shown automatically.
- Redirect URL: Paste the URL copied from the Citrix Cloud Console on the ITSM window.
Click Submit on the Top right corner.
Return to the OAuth application under the OAuth console on ServiceNow. (we named it POC-ITSM App in the following example.)
- Select/open the new OAuth endpoint created.
- Copy the Client ID and Secret and ServiceNow URL.
- Return to the Citrix Cloud Console, past that information, and Connect.
- Click Allow when prompted to connect to the ServiceNow account on instance XXXX.
You get a message asking to Allow your ServiceNow instance to connect with Citrix Cloud. Click Allow.

Once completed, you can verify that your integration was completed.
At the ServiceNow console, go to Citrix IT Service Management Connector > Home. You see your Citrix Cloud connection Status as Connected
Go to the ITSM adapter service management console at Citrix Cloud Console. Click the Manage tab. You see your ServiceNow instance status as Registered.
You’ve completed the integration of Citrix ITSM service + ServiceNow. Now, start your POC. Login into your ServiceNow Admin Console. You see all the Citrix IT Service Management features in your ServiceNow console.
Under Citrix IT services Management > Services. You find the Out of the Box workflows.

Add and on-premises Citrix Site

You can add your site by doing a Site Aggregation for customers with on-premises environments. To Citrix Cloud. This does not modify how you manage your on-premises environments, as it only creates a connection to the ITSM service so your ServiceNow instance can discover and run Citrix + ServiceNow workflows.

It’s a straightforward process. For a detailed step-by-step, follow this Citrix Documentation.

We can summarize the process in the following steps:

Install a Cloud Connector on your on-premises hypervisor (Windows Server domain join VM).
Add your on-premises Delivery Controller to Citrix Cloud.
Complete the on-premises site registration. Enter the IP and FQDN of your Delivery Controller. Citrix Cloud establishes communication with it through the Cloud Connector.
Validate that your on-premises site is registered with Citrix Cloud. It shows up as Green.

Note:

After adding the on-premises site, it can take 24 hours until it shows up in the Citrix Cloud console

POC Guide: Citrix Profile Management with Workspace Environment Management

Wed, 08 May 2024 13:50:58 +0000

Overview

Modern Citrix Management through WEM tools provides advanced User Profile solutions to deploy Traditional file base and Container-based profiles in a simplified way through the built-in templates and granular configuration for your WEM configuration sets.

This guide shows how to deploy a Citrix Profile Management solution using the Workspace Environment Management and the WEM Tool Hub.

Prerequisites

You will use the Workspace Environment Management toolset to deploy your profile solution. These tools can be run from the same location, allowing you to centralize the configuration.

WEM Web console: The new Citrix Web console for WEM allows you to use the Out of the Box templates to set up your profile solution. Run Citrix Workspace Environment Management Web Console.exe for on-premises environments to install the web console services. By default, the infrastructure services are installed in the following folder:

C:\Program Files (x86)\Citrix\Workspace Environment Management Web Console.

WEM Tool Hub: WEM Tool Hub is a collection of tools that aims to simplify the configuration experience for Workspace Environment Management administrators. As part of the Profile configuration, you need a Storage repository to allocate your profiles. That’s where you will use the WEM Tool Hub to configure everything from the same place. This tool provides a configuration wizard to create the repository in your File Server, create the shared folder, and assign it to your users. Go to the WEM Utilities tab in the WEM web console to download it.

Profile Configuration

The first step is to enable” the Profile Management settings in the Workspace Environment Management web console. Go to Configuration Set name > Profiles > Profile Management Settings and click the Enable toggle. This will enable the configuration options and the Built-in Templates.

Once enabled, you can access Quick Setup in the top right corner. This is where you access the built-in Profile Templates. You have two options:
1. Restore a backup of a previous Profile configuration.
2. Start a new configuration with a template.
We will use Start with Template to configure a fresh Profile solution for our deployment.

After this, you start your configuration by selecting the type of Profile solution you want. In our case, we choose Container-based.

The Template-based deployment through Workspace Environment Management provides access to centralize your Profile configuration.

Setting up the Profile solution

The first step in setting up the profile solution is to set the basic settings. There are two mandatory inputs for the configuration and a few more optional settings:

Enable Profile Management: This option enables WEM to manage your profile settings.
Set path to user store: This is the store location where the profiles will be located.

Note:

To configure this, we will use the WEM Tool Hub advanced feature to centralize the configuration.

For File-Based Profiles, use the Basic Settings section to configure the user store path as seen here:

For Container Based Profiles, use the Profile Container section to configure the Profile Container Content as seen here:

Install and Configure the WEM Tool Hub

Find the WEM Tool Hub install file you downloaded earlier. Install and Open the WEM Tool Hub and select User Store Creation Tool.

This feature will start a configuration wizard to create the Store for the Profiles. It walks you through the steps where you enter the required information:
1. Where would you like to create the user store? Specify whether you want to use an existing machine or another, such as a File server. Enter the Server name and Admin credentials to create the connection.
2. Specify the Folder Path. You can select an existing folder or be notified if you are trying to create a new one with an existing name.
3. (Optional) Create a Shared Folder. WEM Tool Hub allows you to create a shared folder without accessing the file server.
4. User Groups: Specify what Active Directory groups will be assigned to this Store.

Once you enter the required information, a folder is created to use as your User Store Path. Copy the information and add it to the Profile configuration.

Profile Container Configuration

Once you create the Profile Container Folder in the WEM Tool Hub and enter the path in the WEM configuration template, you can continue fine-tuning your Profile solution.

You have advanced options to manage your Profile:

Enable Folder and file Exclusions.
Enable file Inclusions.
Enable VHD Auto expansion: If enabled, when the profile container reaches 90% utilization, it automatically expands by 10 GB, with a maximum capacity of 80 GB. Depending on your needs, you can adjust the default auto-expansion settings using the following options: Auto-expansion trigger threshold (%), Auto-expansion increment (GB), and Auto-expansion limit (GB).

Set users and groups access to profile containers:

Profile Handling

These optional settings allow you to specify how to manage the User Profile. Depending on your profile needs, you can choose the following options:

Delete locally cached profiles on logoff: This setting sets a delay before deleting cached profiles. The time is set in seconds, and the value can be between 0 and 600 seconds.
Enable Template Profile: Profile Management can use a centrally stored template when creating profiles. The template can be a standard roaming, local, or mandatory profile on any network file share.

There are three options:

Template Overrides local profile.
Template overrides roaming profile.
Use template profile as Citrix Mandatory profile.

Note:

In Path to the template profile, enter the location of the profile you want to use as a template or mandatory profile. This path is the full path to the folder containing the NTUSER.DAT registry file and any other folders and files required for the template.

Advanced Settings

Profile configuration through Workspace Environment Management allows you to apply advanced settings. In this section, we set up the following features:

Microsoft Applications Profile Containers: This part allows you to configure your profile container for Outlook, OneDrive, and Universal Windows Platform
Microsoft Outlook search index: The user-specific Microsoft Outlook offline folder file (*.ost) and Microsoft search database are roamed along with the user profile, improving the user experience when searching mail in Microsoft Outlook.
OneDrive container: Profile Management roams OneDrive folders with users by storing the folders on a VHDX disk. The disk is attached during logins and detached during logoffs.
MSFT - UWP: Universal Windows Platform roaming.

Advanced VHD settings: Here, you can define the size of the containers and enable features such as Disk compaction and Multi-session write-back profile
- Multi-session write-back for profile containers. If enabled, profile Management saves changes in multi-session scenarios for FSLogix Profile Container and Citrix Profile Management profile containers. If the same user launches multiple sessions on different machines, changes made in each session are synchronized and saved to the user’s profile container disk.
- Customize storage path for VHDX files. This option lets you specify a separate path to store VHDX files. By default, VHDX files are stored in the user store.
- VHD disk compaction. If enabled, VHD disks are automatically compacted on user logoff when certain conditions are met. This policy lets you save the storage space consumed by the profile container, OneDrive container, and mirror folder container. You can adjust the default VHD compaction settings and behavior depending on your needs and available resources.

Profile Validation

Once a user session is initiated, Workspace Environment Management will create the Profile container in the predefined store location created with the WEM Tool Hub.

Summary

This guide walked you through the installation and configuration of Citrix Profiles for a Citrix DaaS or Citrix Virtual Apps and Desktops deployment, utilizing Workspace Environment Management tools to centralize the configuration and management. During the process, we used the WEM Tool Hub to create the profile store and templates for the Workspace Environment Management Web console. Finally, we validated the creation of the profile.

POC Guide: Citrix Session Recording

Thu, 01 Jan 1970 00:00:00 +0000

Overview

This Proof of Concept guide is designed to help you quickly set up and configure Citrix Session Recording and the Citrix Session Recording Service. At the end of this Proof of Concept guide, you can record and play back user sessions from both on-premises and Citrix Cloud.

Conceptual Architecture

All Citrix Session Recording components reside in your secure resource location. The Session Recording agents are installed on either a single-session OS, multi-session OS, or Remote PC Access VDA. The Session Recording Server and the Session Recording Policy Console are installed on separate Windows servers. The Session Recording Player is installed on a workstation. The Session Recording Agent, policy console, player, and database communicate with the Recording Server. End-user devices with the Citrix Workspace app connect to the Citrix VDA, where the Session Recording Agent is installed.

Scope

In this Proof of Concept guide, you experience the role of a Citrix DaaS administrator and set up Citrix Session Recording within your on-premises Citrix DaaS resource location. You will optionally set up the Citrix Session Recording Service and connect your on-premises Session Recording servers to this service.

This guide showcases how to perform the following actions:

Install the Session Recording administration components in your Resource Location.
Install the Session Recording Agent on the VDA machine.
Connect the Session Recording servers to the Session Recording Service.
Create a Session Recording policy.
Replay a recording with the on-premises and cloud-hosted Session Recording player.

Prerequisites

All Session Recording server components are installed on a single server for this proof-of-concept. For production environments, Citrix recommends that each component resides on separate servers. This proof of concept requires the following:

An existing on-premises Citrix Virtual Apps and Desktops or Citrix DaaS Resource location.
Download the Citrix Virtual Apps and Desktops v2209 Product ISO from citrix.com.
Create one Windows 2019 Server within your Resource Location with Microsoft SQL Server 2019 Express Edition installed.
Create one Windows VDA within your Resource Location. This VDA can either be a Windows Server or Desktop VDA.

Install Session Recording Components

The first step is to install all of the Citrix Session Recording components required on the Windows 2019 server you have created.

Connect to the Windows 2019 server (for this POC, we connect via RDP)
Mount Citrix Virtual Apps and Desktops Product ISO and run AutoSelect. Click Start for Virtual Apps and Desktops
Click Session Recording
Accept the terms of the license agreement, then Click Next
Select Session Recording Administration and Session Recording Player then Click Next
Select all Features and Click Next
Enter your SQLEXPRESS Instance Name, leave the Database Name to default, and click Test connection. Once the Test is confirmed, enter your Session Recording Server computer account name, then Click Next.
Click Test connection Once the test passes, Click Next.
Review the Summary screen, then Click Install
The machine will require a restart after the prerequisites are installed. Select Close and allow the server to reboot.
Once rebooted, connect back to the server. Session Recording continues to install.
Once the Session Recording install completes, Click Finish

The Session Recording server components are now installed.

Install Session Recording Agent

The next step is installing the Session Recording Agent on the Windows VDA used in this POC.

Connect to your Windows VDA (for this POC, we connect via RDP).
Mount Citrix Virtual Apps and Desktops Product ISO and run AutoSelect. Click Start for Virtual Apps and Desktops
Click Session Recording
Accept the terms of the license agreement, then Click Next
Select Session Recording Agent, then Click Next
Enter the Session Recording server name, change Protocol to HTTP, then Click Text Connection. Once the test completes, Click Next.
Review the Summary page, then Click Install.
The Session Recording Agent begins to install.
Once the Session Recording Agent install has been completed, Click Finish.

The Session Recording Agent is now installed on your Windows VDA.

Add the Windows VDA to a new Machine Catalog and Delivery Group

Add the Windows VDA to a new Machine Catalog and Delivery Group within your Citrix Virtual Apps and Desktops or Citrix DaaS console.

Connect Session Recording Server to Citrix Cloud (Optional)

The Session Recording service provides an advanced administration experience and simplifies deployment. It supports centralized management of server settings, policies, and playback. The Session Recording service facilitates administrative tasks by providing a unified entry point to manage and observe the Session Recording servers across your organization. The optional next step is connecting the Session Recording server that you created to the Session Recording service. Before beginning these steps, ensure that Ports 8088 and 9090-9094 are open outbound for the Session Recording Server.

On your Session Recording Server, Log on to Citrix Cloud
Click Manage in the Citrix DaaS tile
Select Manage > Session Recording
Select Configuration > Server Management from the left navigation menu.
Select Create Site
Enter the Site name and optional Description, then Click Save.
Click the Server connection guide link to begin the process of adding your Session Recording Server to the service.
Download the Session Recording cloud client software. Click Download
To communicate with Citrix Cloud, you need to create a Secure Client for the Session Recording cloud. To configure this, open Identity and Access Management from the top left hamburger menu.
Select API Access
Copy your customer ID parameter to Notepad.
Enter a name in the Name your Secure Client input box, and Click Create Client
Copy both your ID and Secret and paste them to Notepad. Then Click Download, then Close.
The Session Recording POC Secure Client is now in your Secure Client list.
Open Command Prompt and run the following command: msiexec /i SRCloudClientService.msi CUSTOMERID="" CLIENTID="" CLIENTSECRET="" /qn+
Once the Session Recording cloud client install completes, Click OK.
Return to Citrix Cloud Session Recording Service console, and Select Continue configuration.
Your Session Recording Server is connected to the Citrix Cloud Session Recording service.

Configure and Enable Session Recording Policy

Once the Session Recording Server and Agent install are complete, you can now configure and enable the Session Recording policy.

Enable Session Recording on VDA

On the Windows VDA, open Session Recording Agent Properties from the Start Menu.
Select Enable session recording for this VDA machine, then Click Next. Choose Yes when prompted for a service restart.

Configure Session Recording Server

Connect to the Session Recording server via RDP
Open Session Recording Server Properties from the Start Menu
Click Add for File storage directories, then Click Browse.
Browse to C:/SessionRecordings, then Click OK.
Select OK
Select OK
Select Yes if prompted to restart the Citrix Session Recording Storage Manager service.

Configure Session Recording Policy

Open the IIS Manager on the Session Recording Server. Once open, select Sites > Default Web Site > SessionRecordingBroker, then Open SSL Settings.
Clear Require SSL and Click Apply.
Close ISS Manager, then restart the IIS server.
Open the Session Recording Policy Console. Change Protocol to HTTP, then Select OK.
When the Session Recording Policy Console opens, on the left navigation menu, Right-click on Recording Policies and Select Add New Policy.
Right-click on the New Policy created and Select Add Rule
Select Enable session recording with notification, and Click Next.
Click OK at the warning message.
Select Users or Groups, then Click Select Users or Groups in the Edit the rule criteria input box.
Click Add
Type the name of the AD User or Group, Select Check Names, then Click OK. (For our example, we are using a test user account we have created.)
Click OK
Click Next
Provide a name and description for the rule, ensure that Enable this rule is selected, then Click Finish.
Right-click on New Policy and Select Activate Policy.

Your Session Recording Policy is now active.

Launch a VDI Session

Launch the Windows VDA session as the user that you have added to the Session Recording Policy. A prompt notifies the user that the session is recorded. Quickly open an application, then log off the session.

Playback Session Recording (Session Recording Server)

Open Session Recording Player from the Start Menu.
On the Toolbar, select the timeframe dropdown and select In last 24 hours, then click the Binoculars icon. Find the recording of the session you just launched in the list. Select the recording file and right-click on the file and select Play.
Your recorded session will now play as seen below:

Playback Session Recording (Session Recording service)

Log into Citrix Cloud and go to Session Recording Service Console. Select Recordings then All Recordings
Click the Play button on your new recording to play back your session.

Summary

This guide walked you through setting up a Citrix Session Recording Server and connecting it to the Citrix Session Recording Service. You learned how to create a Session Recording policy and playback your recorded sessions. To learn more about Citrix Session Recording and the Session Recording service, visit the following:

Citrix Session Recording

Citrix Session Recording Service

POC Guide: Citrix Session Remote Start

Fri, 14 Feb 2025 13:00:00 +0000

POC Guide - Citrix Session Remote Start.pdf

Overview

Session Remote Start offers APIs that allow trusted third-party services to enumerate, launch, and log off Citrix sessions. It enables unattended logins triggered by events such as building badge scans and reduces delays in time-intensive environments. Optional login scripts can disconnect sessions after logon, keeping them available for users to reconnect as needed.

With seamless integration into existing Citrix components, Session Remote Start streamlines deployment enhances user experience and redefines how businesses manage virtual access, boosting overall productivity.

This proof-of-concept guide outlines the steps to install and configure Citrix Session Remote Start. It does not provide instructions for creating API-based applications to start Citrix sessions remotely. The following is covered in this guide:

Installation and configuration of Citrix Session Remote Start
Configuration of REST API credentials
Citrix StoreFront and Delivery Controller configuration
Configuration of Citrix Session Remote Start Group Policy
Telemetry configuration
Enumeration and Launch tests

Note:

Citrix Session Remote Start is currently in Tech Preview. This POC Guide will be updated accordingly during the Tech Preview period and when the feature becomes generally available.

Prerequisites

The following prerequisites are required to use Citrix Session Remote Start:

Windows Server 2019 or a later version.
- 4 vCPU
- 16 GB RAM
- Microsoft AD or Entra ID hybrid-joined.
Citrix Session Remote Start downloaded to the above Windows Server
Citrix StoreFront 2203 or a later version.
- StoreFront must be configured to use https
- A new dedicated store created for Session Remote Start users
Citrix Federated Authentication Service (FAS) 2203 or later version
SSL Certificate created for the Citrix Session Remote Start server

Citrix Session Remote Start Installation

Connect to your Citrix Session Remote Start server and extract the Citrix Session Remote Start zip file previously downloaded to the desktop.

Open the folder Citrix Session Remote Start folder on your desktop and double-click Citrix.Srs.Installer_x64.msi.

Click Next.

Accept the license terms, click Next.

Click Next.

Click Install.

The Citrix Session Remote Start installation begins.

When the installation completes, click Finish.

SSL Certificate

Open IIS Manager, select the Session Remote Start Server name, open the Default Web Site, and click Bindings.

Click Add.

In the Add Site Binding screen, add and select the following, then click OK.

Select the type as https.
Enter the IP address and hostname of Session Remote.
Set https port to 443.
Select Require Server Name Indication
Select the SSL certificate for the Session Remote Server

Click Close.

Select the Session Remote Start Site and double-click SSL Settings.

Click Require SSL, then click Apply.

Configure Session Remote Start

Session Remote Start configuration parameters are stored in the Web.config file found under the Session Remote Start installation directory ('C:\Program Files\Citrix\SessionRemoteStart\' by default).

Browse to 'C:\Program Files\Citrix\SessionRemoteStart.

Open the web.config file in Notepad.

Add your Web URL of the store explicitly created for Session Remote Start to the following setting: .

Add the FQDN of Session Remote Start server to the following setting:

Save and close the web.config file.

Configure REST API Credential

Connect to your Session Remote Start server as an administrator and open a PowerShell window.

Change the directory to the SessionRemoteStart on the desktop.

Run the create-cred.ps1 script, provide the username and password and click Enter.

Enter the credential target name, username, and password, and click Enter.

Open IIS and go to Application Pools.

Right-click SrsAppPool and select Advanced Settings.

Under Edit Application Pool, scroll down to Process Model > Identity and click the ellipsis (the button with the three dots.

Select Custom Account and click OK.

Enter the username and password created in Step 3 and click OK.

Click OK.

The identity field should now display the account you created in Step 3. Click OK.

Navigate to the %windir%/system32/inetsrv/config folder and open the applicationHost.config file.

Locate the element and confirm that the setProfileEnvironment attribute is not present.

Restart IIS.

Configure StoreFront and Delivery Controller

Connect to your StoreFront server and open the Citrix StoreFront Management Console.

Click Stores and select the store setup for Session Remote Start, click Manage Citrix Gateways in the Stores panel on the right.

Click Add.

Set Display name, set Citrix Gateway URL with https:///SessionRemoteStart/, and change Usage or role to Authentication only. Click Next.

Set Callback URL with https:///SessionRemoteStart. Click Create.

The Gateway is added. Click Finish.

Click Close.

Click Manage Authentication Methods.

Unselect User name and password, then select Pass-through from Citrix Gateway.

Expand settings. Click Configure Delegated Authentication.

Select Fully delegate credential validation to Citrix Gateway. Click OK.

Click OK.

Click Configure Remote Access Settings.

Select Enable Remote Access, select the Gateway just configured, and click OK.

Open File Explorer, go to the website directory of the main store users use for Citrix access: C:\inetpub\wwwroot\Citrix\%StoreName%\. Create a new folder called Backup.

Open the bin folder and copy the StoreCustomization_Input.dll and StoreCustomization_Enumeration.dll to the Backup folder you just created.

Copy the StoreFront Plugin folder from your Citrix Session Remote Start server to the desktop of your Citrix StoreFront server.

Open the StoreFront Plugin folder on your StoreFront server.

Copy the three dll files within this folder to: C:\inetpub\wwwroot\Citrix\\bin, ensuring the store is the main store used by users. Make sure to Replace the files in the destination.

Open System.

Click the Advanced system settings link.

Click Environment Variables.

Add New… in the System variables section. In the New System Variable window, add the Variable Name: srs_server_urls and Variable value: https:///SessionRemoteStart.

Click OK. Close all remaining windows by clicking OK.

Restart the IIS service on the StoreFront server.
Connect to your Delivery Controller. Open PowerShell and run the command:

asnp Citrix*

Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true

Configure Citrix Session Remote Start Group Policy

Copy the DisconnectSession.ps1 file from your C:\Users\administrator.WORKSPACES\Desktop\AD folder to a file share or Active Directory server.

Connect to your Active Directory Server and open the Group Policy Management console.

Right-click your domain, select Create a GPO in this domain, and Link it here…

Give your GPO a name, and click OK.

Right-click the new Group Policy and select Edit.

Expand User Configuration > Policies > Windows Settings > Scripts (Logon/Logoff). Right-click Logon in the right panel and select Properties.

Select the PowerShell scripts tab.

Click Add.

Click Browse.

Browse to where you save the DisconnectSession.ps1 file. Select DisconnectSession.ps1 and click Open.

Click OK.

Select Run Windows PowerShell scripts last and click OK.

Configure Telemetry

The following steps are required to make the IIS Application Pool have permission to collect performance monitor data.

On the Session Remote Start server, open and select System Tools > Local Users and Groups > Groups. Then right-click Performance Monitor Users on the right panel and select Add to Group….

Click Add.

Click Locations.

Select the Session Remote Start server, click OK.

Type IIS AppPool\SrsAppPool, click Check Names, then click OK.

Click OK.

Open PowerShell, and run the following command: iisreset

Enumeration Test

Open a browser and connect to https:///SessionRemoteStart/index.html. The following page should appear:

Enter login for a test or known user and click Enumerate Resources.

Available resources for the user should now be listed on the page.

Open Citrix Web Studio, browse to an appropriate Machine Catalog, and confirm no sessions exist.

Return to the enumeration test page and select the launch button for one of the enumerated applications or desktops. The launch complete message will appear:

5. Return to Citrix Web Studio and refresh. The application or desktop you launched will now show in a Prelogon state.

Citrix Session Remote Start has been configured correctly.

Summary

This guide walked you through the steps to deploy and configure Citrix Session Remote Start. This consisted of installing and configuring the Citrix Session Remote Start components and Citrix StoreFront, Citrix Delivery Controllers, Citrix Federated Authentication Service, Active Directory, and Group Policy. Once configured, the deployment was tested using the Citrix Session Remote Start provided test scripts.

For additional information, optional settings, and FAQs, reference the Citrix Session Remote Start documentation.

POC Guide: Citrix uberAgent + Splunk

Tue, 28 May 2024 16:15:00 +0000

Overview

Monitoring both on-premises and virtual environments is essential for every enterprise as part of the operational model. A reliable data source for security and user experience offers valuable insights for daily tasks, security diagnostics and investigations, user experience, and proactive and reactive solutions.

Citrix uberAgent is an advanced software solution meticulously crafted for monitoring desktops, virtual desktop infrastructure (VDI), and server-based computing environments. It goes beyond basic system metrics and delivers detailed insights into application performance, user experience, and system health.

This POC guide will walk you through the initial deployment process of uberAgent and show you how to facilitate data visualization using Splunk Enterprise (on-premises) or Splunk Cloud.

Solution Overview

Citrix uberAgent gathers security and performance information from the endpoint device (physical or virtual machines) and sends the data to your visualization solution. Out of the box, uberAgent provides 70+ Splunk dashboards to visualize data.

Architecture

It is recommended that you review the Citrix uberAgent Tech Brief, which provides details about the architecture and capabilities of Citrix uberAgent.

Prerequisites

uberAgent:

uberAgent requires a valid license file. Please see the licensing guide or contact your ATS or Citrix Sales.

Splunk:

Operating system: all that are supported by Splunk
Splunk version: Splunk Enterprise 7.0 or newer or Splunk Cloud

OS versions:

Windows 10 or later
Windows Server 2016 R2 or later
macOS Monterey or newer

Platforms supported:

Citrix Virtual Apps and Desktops, Citrix DaaS, Microsoft RDS, VMware Horizon View, and Remote desktop session hosts (e.g., Citrix, VMware Horizon View, Microsoft RDS) are explicitly supported. The same applies to any virtual desktop (e.g., Citrix Virtual Apps and Desktops, Citrix DaaS, or VMware View).

Browser extensions:

Google Chrome
Edge
Firefox

Installation

The installation consists of four configuration steps:

Create a Splunk Enterprise (on-premises) trial instance or register a Splunk Cloud trial.
Install uberAgent UXM and ESA applications in the Splunk instance.
Install uberAgent on the endpoint device (physical machine, virtual Server, or master/gold image).
Install uberAgent to monitor the Citrix Site.

Create Splunk Enterprise Trial Instance

Read on if you prefer an on-premises Splunk instance. If you want to go with Splunk Cloud, go to the next section.

Download Splunk Enterprise software from the downloads page. You can request a free trial or use your company's instance. We will use the trial version for this guide, which provides 500MB/day for 60 days.

Fill out the form to create your Splunk account to access the software.

Install Splunk on your dedicated server and follow the configuration wizard with default values.
Accept the “License Agreement” and click Next.

Enter the Username and Password to access your Splunk instance.

Click Install to begin the installation process. The installation process will take a few minutes.

Once the installation process is completed, click Finish. The Splunk Management Console will launch. Enter your username and password previously created.

Note:

(Optional) If you have a Splunk License, install it. Here is the link to the process:

https://docs.splunk.com/Documentation/Splunk/latest/Admin/Installalicense.

Install uberAgent UXM and ESA applications in the Splunk instance

The next step is to install the UXM (uberAgent User Experience) and ESA (uberAgent Security) applications in Splunk. This will add the uberAgent capabilities and out-of-the-box Dashboards to your Splunk instance.

The result is the following in your console:

Follow the link to download the uberAgent software from citrix.com.

Select the latest available version and download the software.

A .zip file with all uberAgent components for your endpoint devices and Splunk applications will be downloaded.

Extract the folder to your desired location.

Go to the uberAgent Components folder and identify the three files we will use to install the UXM (uberAgent User Experience) and ESA (uberAgent Security) applications in Splunk.

Open an Internet Browser and navigate to your Splunk console's Home Page by typing http://servername:8000. Then, log in to Splunk using your username and password.

In the left top corner, select Apps and click Manage.

On the next screen, click Install app from file in the top right corner.

Click Choose File

Select each uberAgent_####.tgz file

uberAgent_ESA_searchhead.tgz

uberAgent_indexer.tgz

uberAgent_searchhead.tgz

Click Upload

Once all three .tgz files are uploaded, go to Home > Settings > Server Control > Restart Splunk to restart the Splunk instance.

Validate that the UXM and ESA uberAgent applications are available. Then, click on each app to launch the Dashboard. There will not be any data initially.

Register Splunk Cloud Trial

If you want to use uberAgent with Splunk Cloud, continue here. If you prefer an on-premises Splunk Enterprise, refer to the previous section.

A Splunk Cloud trial is good for 14 days and 5 GB of ingested data per day.

Create an account at splunk.com by signing up at the top right.

Fill out the registration form and click Create Your Account at the bottom.

After the registration, log in to splunk.com and click Free Splunk at the top right.

Click Start Trial. Check your inbox for the credentials and log on to the Splunk Cloud instance.

Install the uberAgent indexer Splunk app

In the Apps menu of your Splunk instance, click on Find More Apps to get to the app installation.

Search for uberAgent and choose uberAgent indexer app.

Enter the credentials of your Splunk.com account and click on Agree and Install.

Click Done.

Create the uberAgent index

Click on Settings -> Indexes at the top right of your Splunk instance.

Click New Index. Add the uberagent index.

Note

All characters are lowercase.

Add the score_uberagent_uxm index.
Repeat step three and add the index score_uberagent_esa.

Install the uberAgent dashboard apps

In the Apps menu of your Splunk instance, click on Find More Apps to get to the app installation.

Search for uberAgent and select uberAgent UXM - Digital Employee Experience (DEX).

Repeat the steps to add the uberAgent ESA - Endpoint Security Analytics and uberAgent Helpdesk apps.

Enable data model acceleration

Click on Settings -> Data models at the top right of your Splunk instance.

The following steps must be performed on each data model, except uberAgentESA_System_SecurityInventory. Click Edit and choose Edit Acceleration.

Tick the box for Accelerate and click Save.

Add a Splunk HEC input

Click on Settings -> Data inputs at the top right of your Splunk instance.

Click on Add new for the type HTTP Event Collector.

Give it the name uberagent.

Select the uberagent index in the input settings.

Review the settings.

Copy the displayed token. We need the token in the next chapter.

Endpoint Device uberAgent Installation

Once you have the Splunk instance ready, install uberAgent on your endpoint device. Remember, the endpoint device can be a physical machine, virtual server, client, or master/gold image.

Citrix Virtual Apps and Desktops Integrated

uberAgent is a component of the Citrix Virtual Apps and Desktops (CVAD) meta-installer since version 2503. The installation process is straightforward, with administrators simply selecting uberAgent from the Optional Software screen during the CVAD VDA setup. Note that it is selected by default.

After the installation has finished, download the Config & Support Tool. Run the tool and select Configure uberAgent.

The following window lets you configure uberAgent and create a config archive, that you can distribute with Citrix Policies later.

Select Web/GitHub as configuration source. The correct link is automatically detected.

We recommend checking Use Data Volume Optimized Config for a PoC. It keeps the generated data volume low while showing sufficient details for the PoC phase. You may change to the normal configuration later.

Receiver Type: Splunk

Protocol:

Splunk Cloud: always HTTP
Splunk Enterprise: TCP or HTTP. TCP is sufficient for a PoC

Servers: your Splunk Cloud or Splunk Enterprise servers. You can specify multiple Enterprise servers comma separated. A port is mandatory. Format: http(s)://server/IP:port.

REST Token: the Splunk HTTP event collector token. Only required when the protocol is HTTP.

Disable Certificate Validation: Check if you are using Splunk Cloud trial or a self-signed certificate.

Use Default uberAgent Index: the default uberAgent index is named uberagent. If your Splunk team has other naming conventions, you can specify a different name by unchecking the box. Also see the documentation on the topic.

License: leave empty as the license file is distributed through Citrix policies.

Click on Create Config Archive.

Go to Citrix Web Studio and create a new policy. The uberAgent related settings can be found in the root and under VDA Data Collection.

Enable uberAgent data collection: enabled

Enhance Director with uberAgent data: enabled

uberAgent configuration archive path: local directory or file share where the above created config archive is stored. If you use a file share, the computer account needs read permissions on the share as uberAgent is running as SYSTEM.

uberAgent license path: local directory or file share where the license file is stored. If you use a file share, the computer account needs read permissions on the share as uberAgent is running as SYSTEM.

Assign the policy to your PoC VDAs.

The configuration has finished. As soon as the Citrix configuration is applied to the VDA, uberAgent starts sending data to Splunk. Note that your VDA must be a member of a delivery group to apply policies.

Standalone

Note

This section applies to uberAgent version 7.4.0.

If you not already have downloaded uberAgent, download it from citrix.com and extract the downloaded .zip file.

Install uberAgent as follows:

Open the uberAgent unzipped folder.
Go to uberAgent Components → bin → uberAgent-en-64.msi → right-click and Install

Note:

If you are using Citrix AppLayering, installing the agent in the Platform Layer is recommended.

Accept the license terms and click Next.

Continue with the default Destination folder.

Continue and select both options for Configuration Security.

Click Install.

Click Finish to complete the installation.

After the installation has finished, download the Config & Support Tool. Run the tool and select Configure uberAgent.

The following window lets you configure uberAgent and apply the configuration.

Select Web/GitHub as configuration source. The correct link is automatically detected.

Receiver Type: Splunk

Protocol:

Splunk Cloud: always HTTP
Splunk Enterprise: TCP or HTTP. TCP is sufficient for a PoC

Servers: your Splunk Cloud or Splunk Enterprise servers. You can specify multiple Enterprise servers comma separated. A port is mandatory. Format: http(s)://server/IP:port.

REST Token: the Splunk HTTP event collector token. Only required when the protocol is HTTP.

Disable Certificate Validation: Check if you are using Splunk Cloud trial or a self-signed certificate.

License: select your license file.

Click on Apply. The tool configures uberAgent, copies the license file to the correct location and starts the service.

Preparing a Citrix Master/Gold image

If you use an imaging method such as Machine Creation Services (MCS), Citrix Provisioning (PVS), or Citrix AppLayering, it is recommended that you generalize uberAgent to prepare the image for deployment.

Stop the uberAgent service (leave it Automatic).

Open a command prompt as an Administrator.

Run the following command: reg delete "HKLM\SOFTWARE\vast limits\uberAgent" /f /reg:64

(Optional): Delete the existing uberAgent.log file at C:\Windows\Temp.

Add uberAgent extension to Web Browsers

For this POC, we are going to add the Chrome browser extension. If you use Firefox or Edge, follow the links for reference.

There are two options to install the extension for Chrome:

Directly from the Chrome store
Group Policy

We are going to install this POC directly from the Chrome Store.

Launch Chrome and go to the following URL:

https://chromewebstore.google.com/detail/uberagent/jghgedlkcoafeakcaepncnlanjkbinpb?pli=1

Click on Add to Chrome.

Click on Add Extension.

After enabling the extension, you receive the notification uberAgent has been added to Chrome.

Now that the master/gold image and the Browser extension are ready, we can install uberAgent on the Citrix Delivery Controller for on-premises Citrix Virtual Apps and Desktops deployments or on the Cloud Connectors for Citrix DaaS deployments.

Monitor Citrix Virtual Apps and Desktops Sites

uberAgent detects whether it runs on a Citrix Delivery Controller (DDC) or a Citrix Virtual Desktop Agent (VDA). On DDCs, uberAgent automatically activates additional metrics like machine registration status, license usage, and published application inventory. There are some recommendations for installing uberAgent to monitor Citrix sites, including:

Install the uberAgent endpoint agent on at least one delivery controller per site.
Before installing the agent, run the following script template to grant the user account the required permissions. Before running it with elevated permissions, fill in your domain names and DDCs.
Required permissions:
- Each delivery controller’s computer account
- The local SYSTEM account.

Add-PSSnapin Citrix.DelegatedAdmin.Admin.V1

New-AdminAdministrator -Sid S-1-5-18 -Enabled $true

Add-AdminRight -Role 0a05f0c6-0153-4852-a55a-989d6a95c0eb -Administrator S-1-5-18 -All

New-AdminAdministrator -Name \ -Enabled $true

Add-AdminRight -Role 0a05f0c6-0153-4852-a55a-989d6a95c0eb -Administrator \ -All

For more details, please refer to the following documentation.

Monitoring Citrix DaaS Sites

Requirements:

Create a Citrix Cloud API client as described in our Citrix docs.
Go to citrix.cloud.com and log in with your credentials.
Install the Citrix Virtual Apps and Desktops Remote Powershell SDK on the endpoint on a separate server/machine.

Note:

The Citrix Cloud API client name is case-sensitive. Name it “uberAgent”.

Configuration:

Once you install the agent on the VM/Server, open the C:\ProgramData\vast limits\uberAgent\Configuration\uberAgent.conf file.
Search for CitrixCloud.
Replace the content as shown in the screenshot:

[CitrixCloud_Config]

API endpoint = https://api-us.cloud.com

CustomerId =

ClientId =

ClientSecret =

CollectCitrixCloudInformation=True

Restart the uberAgent service to complete the process.

Note:

The API endpoint URL depends on your region:

Americas: API endpoint = https://api-us.cloud.com

Europe: API endpoint = https://api-eu.cloud.com

After installing the uberAgent agent in your master/gold image, seal it and deploy it to your Citrix workload using your usual distribution method (MCS/PVS/AppLayering).

For more details, please refer to the following documentation.

Testing and Final Result

Once completed, validate that the machines where you installed the uberAgent agent are shown in the Splunk Dashboard uberAgent UXM under Machines tab > Machine Performance.

To complete the testing, start a machine, launch a new session, and open an application. Wait a few minutes to allow the agent to capture data. All data will be available in the Splunk Dashboards for uberAgent User Experience (UXM) and uberAgent Security (ESA).

POC Guide: Citrix Virtual Apps and Desktops

Thu, 12 Dec 2024 16:08:00 +0000

Overview

Citrix Virtual Apps and Desktops is a virtualization solution that provides access to applications and desktops security from anywhere on any device independent of the device’s operating system and interface. It also allows administrators to centrally manage application and desktop access via a web console for resources deployed on-premises or in a public cloud.

This proof of concept (POC) guide provides the steps to create a Citrix Virtual Apps and Desktops deployment to deliver single and multi-session Windows OS desktops and published applications. The environment will only be accessible within the internal network. If you require remote access during the POC, please follow the Configure NetScaler Gateway product documentation. The guide will provide the steps to:

Install and configure Citrix Virtual Apps and Desktops LTSR v2402.
Install and configure Citrix StoreFront.
Install and configure the Citrix Virtual Delivery Agent (VDA) on master images.
Create a Hosting Connection.
Create a machine catalog and delivery group to deliver multi-session desktops and applications.
Install Citrix Licenses for the POC environment.
Create an initial baseline Citrix policy for the POC environment.
Launch a session from Citrix Workspace app.

Note:

This guide sets up the Citrix infrastructure components on a single Windows server. This is only recommended for POC environments and should not be used by production users.

Prerequisites

The following prerequisites are required to build the Citrix Virtual Apps and Desktops POC environment. Please ensure all requisites are met before moving to the first installation phase.

A non-production supported virtualization (ESXi, XenServer, Hyper-V, Nutanix) or public cloud environment.
- For our POC environment, we are using XenServer v8.
Citrix Virtual Apps and Desktops v2402 ISO downloaded from Citrix Downloads.
A single domain-joined Windows Server v2019 or higher virtual machine (for Citrix infrastructure components).
- 2 vCPU, 8 GB RAM, 100 GB Storage.
A single Windows Server v2019 or higher virtual machine (for VDA).
A valid Citrix license or trial license file.

Install Citrix Virtual Apps and Desktops

Mount the Citrix Virtual Apps and Desktops ISO to your Citrix Virtual Apps and Desktops Windows Server created for the Citrix infrastructure components.

Connect to the server via RDP with an administrator login.

Run AutoSelect.exe to begin the Citrix Virtual Apps and Desktops installation.

We will be providing access to desktops and applications. Click Start for Virtual Apps and Desktops.

Select Delivery Controller.

Select “I have read, understand, and accept the terms of the license agreement,” and click Next.

We are installing the core Citrix infrastructure components on a single server for our POC. Select Delivery Controller, Web Studio, Director, and License Server, unselect Secure Private Access, and click Next.

We have only a single Delivery Controller for our POC. Click Next.

During the POC, we used Microsoft SQL Express on this server for our Citrix Databases, so we selected the option to install SQL Express here and left the Remote Assistance option checked. Click Next.

Select the default value “Automatically” to allow the install to configure the Windows Firewall rules on the server. Click Next.

Review the Summary page and click Install.

The installation process begins.

During the installation process, your server will reboot. The installation will continue once the server reboots and you are logged back in.

Click Next on the Diagnostics page.

Select “None of the above” on the License Server Data page and click Next.

Unselect “Launch Citrix Site Manager” and click Finish.

Configure Citrix Virtual Apps and Desktops Site

Launch Citrix Site Manager.

Click Deliver applications and desktops to your users.

Name your site and click Next.

Leave the defaults selected on the Databases window and click Next.

The database is validated.

Select “Use the free 30-day trial” and click Next.

Review the summary window and click Finish.

The Citrix Virtual Apps and Desktops site creation begins.

Note:

This process will take time as the required databases and site configurations are created.

Once completed, the Site Overview page will appear.

Close Citrix Site Manager.

Install Citrix StoreFront

Run AutoSelect.exe to begin the Citrix Virtual Apps and Desktops installation.

Click Citrix StoreFront.

Accept the license agreement and click Next.

Click Next on the Review prerequisites window.

Click Install.

The Citrix StoreFront installation begins.

Click Finish.

Click Yes to reboot the server.

Configure Citrix StoreFront

Open Citrix StoreFront.

Click Create a Store.

Click Next.

Enter a Store Name and then click Next.

The Delivery Controllers window opens. Click Add.

Leave the default selections for Display Name and Type. Click Add.

Enter your local server hostname and click OK.

Leave Transport type to HTTPS and Port to 443, then click OK.

Click Next.

We are not allowing remote access to our POC environment, so we click Next.

Note:

If your POC environment requires remote access, follow the instructions to configure NetScaler Gateway.

Choose your preferred authentication method for your POC. For our environment, we only require a username and password. Click Next.

Click Create.

The Store creation process begins.

The Citrix StoreFront store has been created successfully. Click Finish.

Click View or Change Stores to review your newly created store.

Citrix StoreFront configuration has been completed.

Note:

It is recommended that the Citrix StoreFront server be secured with HTTPS. In our POC environment, we use HTTP, which requires an extra step on the end user device to access. This step will be detailed later in this guide. To secure our StoreFront server with HTTPS, follow the product documentation.

Install the Citrix Virtual Delivery Agent

We will use Citrix Machine Creation Services (MCS) within our POC environment to provision virtual machines. We will create a master image and install the Citrix Virtual Delivery Agent (VDA) onto this master image. The master image contains the OS and applications to be used by end users.

Mount the Citrix Virtual Apps and Desktops LTSR v2402 ISO to your Windows Server VDA virtual machine.

Connect to your Windows Server VDA via RDP
Run AutoSelect.exe to begin the installation of Citrix Virtual Apps and Desktops.

Click Start for Virtual Apps and Desktops.

Click Virtual Delivery Agent for Windows Multi-session OS.

Select “Create a master MCS image” and click Next.

Click Next.

Select “Citrix Profile Management” and “Citrix Profile Management WMI plug-in” and click Next.

Select "Do it manually," enter the FQDN of the Delivery Controller server configured earlier, and click Test connection.

A green check confirms the Delivery Controller is available. Click Add.

Click Next.

Select “Use Windows Remote Assistance” or “Use Screen Sharing.” If your POC is configured within a public cloud (Azure, AWS, GCP), select “Is this VDA installed on a VM in the Cloud?”. Click Next.

Leave the default values selected on the Firewall window and click Next.

Review the summary page, then click Finish.

Click Next on the Diagnostics screen.

Ensure “Restart machine” is selected and click Finish.

Repeat this process for any other Virtual Delivery Agent master images you wish to create for your POC environment.

Create Hosting Connection

A Hosting Connection is required to allow communication between the Citrix Delivery Controller and the Virtual Delivery Agent hypervisor or hyperscaler host(s). We are using XenServer for our deployment, so we will create a hosting connection to our XenServer hypervisor. For details on creating a host connection to other hypervisors or hyperscalers, visit our product documentation.

Connect to your Delivery Controller and open Web Studio.

Enter your administrator credentials and click Sign in.

Click Hosting.

Click Add Connection and Resources.

Select your Connection type and enter the appropriate information for your hosting connection. Ensure “Citrix provisioning tools (Machine Creation Services or Citrix Provisioning” is selected, and then click Next.

Select the appropriate storage option for your hosting connection and click Next.

Select the Storage Selection options for your hosting connection and click Next.

Enter a name for the Network, select the correct network, and then click Next.

Review the summary page and click Finish.

The Hosting Connection is created.

Configure Machine Catalog

A Machine Catalog is a collection of virtual or physical machines managed as a single entity. Machines in a catalog have the same operating system.

Click Machine Catalogs.

Click Create Machine Catalog.

Click Next.

Choose the appropriate Machine Type for your POC. We are creating a Windows Server 2022 catalog, so we select “Multi-session OS” and click Next.

Select “Machines that are power managed,” “Citrix provisioning technology,” and “Citrix Machine Creation Services (MCS),” and then click Next.

Select “Master image”.

Expand Select an image, select your master image on the open blade, then click Done.

The master image is added. Choose the catalog's minimal functional level, in our case, 2206, and click Next.

Choose the number of virtual machines to create and the amount of RAM for the created virtual machines, then click Next.

Based on your identity type, select the appropriate options for the Machine Identities. Enter an account naming scheme, then click Next.

Click Enter credentials.

Enter your administrative credentials and click Done.

Click Next.

Review the summary, enter a Machine catalog name, and then click Finish.

The Machine Catalog creation process begins. Depending on the number of virtual machines you have chosen to create, this can take some time.

The progress window can be hidden, and the complete progress can be followed from the machine catalog screen.

Once completed, the Machine Catalog will be available with the provisioned virtual machines.

Configure Delivery Group

A Delivery Group is a collection of machines selected from one or more machine catalogs. It specifies which users can use the applications and desktops provided.

Click Delivery Groups.

Click Create Delivery Group.

Select the Machine Catalog created in the previous section and the number of machines for the Delivery Group, then click Next.
Leave the “Override site-wide setting” unchecked and click Next.

Choose the user access for the environment. You can restrict the delivery group's use to specific users or groups and allow sessions to roam with users if they change devices. Click Next.

Click Add > From Start menu.

Select the applications to publish, then click OK.

Click Next.

Click Add.

Enter a “Display name,” select the user permissions and options for the Desktops, and click OK.

Click Next.

Click Next.

Enter the name for the Delivery Group and click Finish.

The Delivery Group is created, and the machines are registered and ready for user access.

Install Citrix Licenses

Ensure you have a valid Citrix Virtual Apps and Desktops license file downloaded to your Citrix infrastructure server.
Click Licensing within Web Studio.

Click More and select Browse for License.

Select your license file from the Open dialog window and click Open.

Click Yes to add the license file.

The license file will be read.

Once complete, your Citrix Licenses will be listed.

Create Citrix Policy

Citrix Policies are a collection of settings defining how sessions, bandwidth, and security are managed for users, devices, or connection types. You can apply policy settings to physical and virtual machines or users. You can apply settings to individual users at the local level or in security groups in an Active Directory. The configurations define specific criteria and rules. The settings are applied to all connections if you don’t specifically assign the policies.

Click Policies.

Click Create Policy.

Expand ICA > File Redirection and select the following: Auto connect client drives, Client drive redirection, Client fixed drives, Client optical drives, and Client removable drives.

Click Disable and Prohibit on each of the selected policies.

Click Next.

Select All users and computers and click Next.

Click Enable policy, provide a Policy name, and click Finish.

Click Change Policy Priorities.

Click the up arrow next to Baseline Policy to move that policy to the top of the list.

Click Save.

Note:

Additional policy settings can be enabled within the baseline policy or a new Citrix Policy based on your requirements for your POC environment.

Install Citrix Workspace app

The Citrix Workspace app provides instant, secure, and seamless access to Citrix applications and desktops. It is optimized for all client OSs, such as Windows, macOS, Linux, iOS, and Android, and can also be accessed via a browser.

Download the appropriate Citrix Workspace app version required for your endpoint device from Citrix Downloads.

Run the CitrixWorkspaceApp installer.

Click Continue.

Accept the Citrix License Agreement and click Continue.

Select the appropriate options for your environment and click Install.

Citrix Workspace app installs.

As mentioned during the StoreFront configuration steps, this guide uses HTTP for the Citrix StoreFront server. Before configuring the Citrix Workspace app, the following registry entries must be configured.

Once completed, enter the Citrix StoreFront URL and click Continue.

Provide a username and password and click Log On.

Citrix Workspace app displays the applications and desktops you can launch.

Click on an application or desktop from Citrix Workspace app.

Summary

Following this guide, you successfully deployed a Citrix Virtual Apps and Desktops v2402 LTSR environment to deliver applications and desktops to your end users in a POC environment. Citrix provides many additional features to enhance your environment. Additional information on incorporating these features into your POC environment includes:

Citrix Workspace Environment Management (WEM)

Citrix Session Recording

Citrix Profile Management

Citrix VDA for macOS

Citrix App Layering

Citrix integration with Windows 365

uberAgent

PoC Guide: Configuring Google Cloud Identity and Microsoft Active Directory in Citrix DaaS

Thu, 01 Jan 1970 00:00:00 +0000

Overview

Google Cloud Identity is an Identity as a Service (IDaaS) solution that centrally manages users and groups. Google Cloud Identity can be configured to federate identities between Google and other identity providers, such as Active Directory and Azure Active Directory. Using the Google Cloud Identity provider in Citrix DaaS requires planning the deployment to ensure success.

This POC Guide focuses on using Google Cloud Identity and Microsoft Active Directory.

Microsoft Active Directory

There is no way to synchronize users from Google Cloud to Microsoft Active Directory. The synchronization is from Microsoft Active Directory to Google Cloud.

Configure Citrix DaaS

In this first step, configure Citrix DaaS by creating a resource location, deploying Citrix Cloud Connectors, and creating a Machine Catalog and Delivery Group. Lastly, validate the deployment using LDAP authentication so that everything works as expected.

Deploy two new domain-joined Windows Server 2022 virtual machines.
Configure the Resource Location in Citrix DaaS.
Create an on-premises Resource Location.
On your Windows Server 2022 virtual machines created, download, and install Citrix Cloud Connector.
Configure the Hosting Connection.
Create a Machine Catalog named "Windows 10 MCS Google IdP" with 2 VDAs.
Create a Delivery Group named "Windows 10 MCS Google IdP".
Publish Desktop "Windows 10 MCS Google IdP".
Change the Workspace URL.
Validate access using LDAP.

Connect Google as an Identity provider to Citrix Cloud

It is assumed here that you already use Google Cloud IdP and have users created in Google Cloud.

Create a service account

To complete this task, you need a Google Cloud Platform developer account.

Sign in to Google Cloud Console.
From the Dashboard sidebar, select IAM & Admin and then choose Service Accounts.
Select Create service account.
Under Service account details, enter the service account name and service account ID.
Select Done.

Create a service account key

On the Service Accounts page, select the service account you created.
Select the Keys tab, then select Add key > Create new key.
Leave the default JSON key type option selected.
Select Create. Save the key to a secure location that you can access later. You enter the private key in the Citrix Cloud console when you connect Google as an identity provider.

Configure domain-wide delegation

Enable the Admin SDK API:
Select APIs & Services > Enabled APIs & services from the Google Cloud Platform menu.
Select Enable APIs and services near the top of the console. The API Library home page appears.
Search for Admin SDK API and select it from the results list.
Select Enable.
Create an API client for the service account:
Select IAM & Admin > Service Accounts from the Google Cloud Platform menu, and then select the service account you created earlier.
From the service account's Details tab, expand Advanced settings.
Under Domain-wide Delegation, copy the Client ID and select View Google Workspace Admin Console.
If applicable, select the Google Workspace administrator account you want to use. The Google Admin console appears.
From the Google Admin sidebar, select Security > Access and data control > API controls.
Under Domain wide delegation, click Manage Domain Wide Delegation.
Select Add new.
In Client ID, paste the client ID for the service account you copied in Step C.
In OAuth scopes, enter the following scopes in a single comma-delimited line:

https://www.googleapis.com/auth/admin.directory.user.readonly,https://www.googleapis.com/auth/admin.directory.group.readonly,https://www.googleapis.com/auth/admin.directory.domain.readonly

Select Authorize.

Add a read-only API user account

Create a Google Workspace user account with read-only API access for Citrix Cloud in this task. This account is not used for any other purpose and has no other privileges.

From the Google Admin menu, select Directory > Users.
Select Add new user and enter the appropriate user information.
Select Add new user to save the account information.
Create a custom role for the read-only user account:
From the Google Admin menu, select Account > Admin roles.
Select Create new role.
Enter a name for the new role. Example: API-ReadOnly
Select Continue.
Under Admin API privileges, select the following privileges:
- Users > Read
- Groups > Read
- Domain Management
Select Continue and then select Create role.
Assign the custom role to the read-only user account that you created earlier:
From the custom role details page, in the Admins pane, select Assign users.
Start typing the name of the read-only user account and select it from the user list.

Select Assign role.
To verify the role assignment, return to the Users page (Directory > Users) and select the read-only user account.
The custom role assignment is displayed under Admin roles and privileges.

Connect Google to Citrix Cloud

The next step is configuring Citrix DaaS to use Google Cloud as Identity Provider. The first step is to configure Google Cloud Identity globally.

Sign in to Citrix Cloud.
From the Citrix Cloud menu, select Identity and Access Management.
Locate Google and select Connect from the ellipsis menu.
Select Import File and then select the JSON file you saved when you created the key for the service account. This action imports your private key and the email address for the Google Cloud service account that you created.
In Impersonated User, enter the name of the read-only API user account.
Select Next. Citrix Cloud verifies your Google account details and tests the connection.
Review the associated domains that are listed. If they're correct, select Confirm to save your configuration.

Enable Google for workspace authentication

Now that Google Cloud Identity is configured switch the Workspace configuration to use it.

From the Citrix Cloud menu, select Workspace Configuration > Authentication.
Select Google. When prompted, select I understand the impact on the subscriber experience, then click Save.

Configure Google Cloud Directory Sync

We must configure Google Cloud Directory Sync to synchronize users from Microsoft Active Directory to Google Cloud.

Download the tool from Google Cloud Directory Sync.
Install GCDS Tool.
Open the tool and configure it.
In Google Domain Configuration:
Provide a Google Domain name and click Authorize Now. A webpage will open and ask you to authenticate with your admin account and accept changes.
In LDAP Configuration:
Select the connection Type, provide the host name, define the port, and provide credentials. Click Test connection to validate.
In General Settings:
Have Users Accounts, Groups, and Custom Schemas checked.
In User Accounts:
In the User Attributes Tab: Click Use defaults, and select Don't suspend or delete Google domain users not found in LDAP.
In User Accounts:
In the Additional User Attributes Tab: Click Use defaults.
In User Accounts:
In Search Rules Tab: Click Use defaults.
In Groups:
In Search Rules Tab: Click Use defaults.
In Custom Schemas, click Add Schema.
Select Use rules defined in "User Accounts" and provide Schema Name citrix-schema.
Click Add Field and create the following
Click OK.
Click Sync and click Sync & apply changes.

Note:

Save your configuration by clicking the menu File > Save as. This creates an XML file. When you close the GCDS Tool, the configuration does not save by default. Select the menu File > Open Recent > youfile.xml on the next opening to retrieve your saved configuration.

Configure Google Password Sync

Now we configure Password Sync to synchronize passwords from Microsoft Active Directory to Google Cloud. This tool must be installed on all your Microsoft Active Directory Domain Controllers.

Download Google Password Sync
Install Google Password Sync.
Open Google Password Sync.
Click Next.
Provide Admin email address and select Load Credentials. When prompted, select the JSON File. Click Next.
Click Next.
Click Finish.

Note:

After Password Sync is installed and configured, it sends updated passwords to Your Google Account each time an Active Directory user changes his password in AD. To force synchronization of your Active Directory passwords to Google, restart the Password Sync service from the Services console:
A script can also be created to restart it with the following line: net stop "password Sync" && net start "password sync"

Sync user in Google

Now configure Google Cloud Directory Sync.

Click Sync & apply changes.
Click Continue.
Click Close.

Change user setting

When created by default, a new Google account user has a setting to change the password on the first login. If you do not change it, the AD and Google Passwords will differ after the initial login. To avoid this, please follow the steps below.

In the admin console, select the created user.
Ensure citrix-schema is present and information is filled (to ensure access to published resources).
Under Security, edit the Require password change.
Change from ON to OFF and Save.

Validation

Connect to the workspace URL. You get redirected to Google Authentication. Provide your email address and click Next.
Provide your password and click Next.
Click I understand.
The published resources appear. Click your desktop.
Desktop launch with SSO.

Connect Google to Citrix Cloud

Now, configure Citrix DaaS to use Google Cloud as Identity Provider. The first step is to configure Google Cloud Identity globally.

Sign in to Citrix Cloud.
From the Citrix Cloud menu, select Identity and Access Management.
Locate Google and select Connect from the ellipsis menu.
Select Import File and then select the JSON file you saved when creating the service account key. This action imports your private key and the email address for the Google Cloud service account that you created.
In Impersonated User, enter the name of the read-only API user account.
Select Next. Citrix Cloud verifies your Google account details and tests the connection.
Review the associated domains that are listed. If they're correct, select Confirm to save your configuration.

Enable Google for workspace authentication

Now that Google Cloud Identity is configured, we can switch the Workspace configuration to use it.

From the Citrix Cloud menu, select Workspace Configuration > Authentication.
Select Google. Select *I understand the impact on the subscriber experience, then click Save.

Create a Machine Catalog

There is no Microsoft Active Directory in this use case, so the VDAs are non-domain joined. More details can be found here

Validation

Connect to the workspace URL. You get redirected to Google Authentication. Provide your email address and click Next.
Provide your password and click Next.
Click I understand.
The published resources appear. Click Desktop.
Desktop launch with SSO.

POC Guide: Deploying a NetScaler VPX on Nutanix AHV

Thu, 04 Apr 2024 13:54:48 +0000

Overview

This proof of concept guide is designed to provide a step-by-step method to deploy an instance of the NetScaler VPX on Nutanix AHV and prepare it for use. NetScaler VPX running on Nutanix AHV is supported through the Citrix Ready Program. This guide will assist in deploying a VPX appliance using Prism Element with some basic best practices. This guide will NOT cover the specific needs for every deployment. It is recommended that deployments and testing are conducted to define the best method for a particular need.

Nutanix Acropolis Hypervisor (AHV) is a modern and secure virtualization platform that powers VMs and containers for applications and cloud-native workloads on-premises and in public clouds that can run any application at any scale.

Prerequisites

This guide assumes the following prerequisites have been completed:

Nutanix AHV is configured and ready for use
Nutanix Prism Element will be used for the deployment (not Prism Central)
Sufficient resources are available to support the recommended VM configuration
1. The NetScaler VPX requires a minimum of 2 vCPUs and 2 GB of RAM (4 GB RAM or more is recommended).
2. At least one vNIC (2 or more vNICs recommended for Management and Production networks)
3. At least 20 GB of disk space
A basic understanding of Nutanix AHV
A basic understanding of Nutanix Prism Element
Familiarity with the Acropolis Command Line Interface (ACLI)
Familiarity with the initial setup of a NetScaler VPX appliance.

Considerations for NetScaler VPX appliances

A proof of concept deployment is set up to try out different functions of the VPX appliance. With a POC deployment, customers can:

Try different features
Familiarize themselves with the environment
Try different configurations to see how they impact performance, usability, etc.

A POC is not intended for production workloads and should only be utilized for learning and feasibility purposes.

Therefore, a virtual appliance running with (2) vCPUs, (4) GB RAM, and 20 GB of disc drive should be sufficient. In a production environment, it is recommended to provision the appliance with adequate resources for the expected workload. With a virtual appliance on Nutanix AHV, scaling up or down on resources is very easy, making the virtual appliance very flexible. To determine the required resources for your workload, use the following NetScaler Form Factors Datasheet

Deploying the NetScaler VPX

Download the VPX virtual appliance (the example below shows the latest 14.1 version of the firmware, however other versions are available for AHV should this meet your business requirements)
Download the “Citrix ADC VPX for KVM” file.
On the first extraction, it will become a “tar” file. Extract that until you see the “.qcow2” and “.xml” files.
Login to Prism Element (not Prism Central)
From Home, select Settings
Choose Image Configuration
1. Give the image a name
2. Select the “DISK” image type
3. Pick a storage container
4. Choose “Upload a file” and navigate to the NetScaler VPX “.qcow2” file
5. Choose “Save” to create the image

7. Once the file uploads, you should see the image listed and the status should show as

“ACTIVE”, this may take some time as Prism Element processes the image file.

8. Navigate to VM and then click Create VM

9. On the Create VM Screen, remove the CD ROM Drive

10 Add a new disk

Select “Clone from the image service” from the drop-down menu
In the Bus Type, select “SCSI”
1. Note: The NetScaler VPX has been deployed with PCI, SCSI, SATA, and IDE bus disks without issue
Choose the NetScaler image that was uploaded
Choose “Add”

11. The disk will then be added

12. Add VLANs as necessary. A minimum of two VLANs (Management and LAN) are

recommended

13. Do not set affinity now, as it will be set later in this guide

14. Choose "Save"

Once the VM is listed and shows as powered off, we must add a serial port. The VM appliance will not boot without a serial port connection, and Nutanix AHV does not add a serial port by default.

To add the Serial Port
1. SSH into the CVM using the username “nutanix” and the password you set for that account (You can find a list of CVM IP addresses in the “Hardware” section of the Prism Element console)
2. Enter the ACLI
```
acli
```
3. Enter the following command to create the serial port where is the name you gave to the VPX Appliance
```
vm.serial_port_create  type=kServer index=0
```

At this point, you can snapshot the VM to be used as a template later should you wish to deploy more instances (an HA pair, for example).

Initial Configuration

Power on the VM
Launch the VNC console

Watch the VM Boot

Log in with the default credentials of nsrootnsroot You will be prompted to change the password. It is recommended that you change it at this time
Manually run the “config ns” command from the CLI
1. Assign the IP
2. Enter the NetMask
3. Choose “Apply changes and exit”

6. Restart the VM

When the appliance reboots, log back into the CLI and add the default route using the command below, replacing with the default route assigned to the network that your NSIP resides on.

add route  0.0.0.0 0.0.0.0

Save the configuration using the command below to ensure the default route persists during a reboot

save ns config

Now you can connect to the GUI

After this point, the configuration proceeds like any other NetScaler setup.

Additional Considerations

High CPU usage

CPU usage will show high by default on NetScaler VPX appliances. If you desire to enable CPU sharing, then you should enable CPU Yield.

From the GUI
1. Navigate to Settings and click the “Change VPX Settings link
2. Change “CPU Yield” to Yes
3. Save the configuration

2. From the CLI

set ns vpxparam -cpuyield YES

Running a pair of appliances for high availability (HA)

If you are going to run an HA pair of appliances, it is recommended that you set anti-affinity rules so the appliances will always be run on separate AHV hosts

To accomplish this:

Login to the CVM via SSH
Create the VM group where is the name you give to the group of NetScalers you deployed on AHV
```
vm_group.create 
```
Add the existing NetScalers to the group where is the name from the previous step, and and are the NetScaler VMs to be added to the group
```
vm_group.add_vms  vm_list=,
```
Set the Anti-affinity rule where is the name given in step 2 above
```
vm_group.antiaffinity_set 
```

Disaster Recovery and GSLB

Suppose multiple sites are to be used, and Global Server Load Balancing (GSLB) is utilized for access. In that case, it is recommended that an HA pair of NetScalers be deployed on AHV at both locations. You can then use Nutanix technologies such as DR replication to ensure the availability of your NetScaler pair should you experience a cluster outage. More information on Nutanix DR replication can be found here.

Resources

NetScaler Form Factors Datasheet

FAQ on Deploying a NetScaler VPX