citrix receiver for iphone -...

Citrix Receiver for iPhoneAdministration

Contents

Requirements for Citrix Receiver for iPhone.................................................3Configuring Access Gateway and Secure Gateway for Citrix Receiver foriPhone.....................................................................................................5

To configure the Secure Gateway for Citrix Receiver for iPhone. . . . . . . . . . . . . . . . . . . . . . . . . . . . .5To configure Access Gateway Standard Edition for Citrix Receiver for iPhone. . . . . . . . . . . . . .7To configure Access Gateway Advanced Edition for Citrix Receiver for iPhone. . . . . . . . . . . . .9To configure Access Gateway Enterprise Edition for Citrix Receiver for iPhone. . . . . . . . . . .15

Providing Access Information to End Users................................................19Troubleshooting Citrix Receiver for iPhone................................................20Known Issues for Citrix Receiver.............................................................. 21

Contents

ii

Requirements for Citrix Receiver foriPhone

To use Citrix Receiver, end users need an iPhone or iPod touch mobile device withiPhone Software Update installed (version 3.0 or 2.2.1).

For more information about software updates for iPhone and iPod touch, visit the AppleWeb site.

To provide published resources to Citrix Receiver users, you need:

w A server farm running one of the following:

• Citrix Presentation Server 4.0, with a Program Neighborhood Agent siteconfigured (supported only if the iPhone connection does not use a SecureGateway or Access Gateway)

• Citrix Presentation Server 4.5, with a Program Neighborhood Services siteconfigured

• Citrix XenApp 5.x, with a XenApp Services site configured

w The root certificate for the farm to which users will connect (needed only if theWeb server hosting the farm's Program Neighborhood Services site or XenAppServices site requires a secure connection).

For information about requirements for deploying Citrix Presentation Server or CitrixXenApp and publishing resources, refer to the XenApp Administration section for yourXenApp version in Citrix eDocs. For information about deploying or configuring ProgramNeighborhood Services or XenApp Services sites, refer to the Web Interface section ofeDocs.

XenApp ServiceFor connections using a Secure Gateway or Access Gateway, support for Citrix Receiverfor iPhone requires XenApp Service 5.x, formerly known as PNAgent, which allows youto configure the XenApp Services site, as well as a Secure Gateway or Access Gatewayconfiguration for the following products:

w XenApp 4.5 (formerly Presentation Server 4.5)

w XenApp 4.5 with Feature Pack 1

w XenApp 5.0

w XenApp 5.0 with Feature Pack

Web InterfaceTo deploy or configure XenApp Services sites on the Web Interface, use Web Interface5.x.

3

Updating Citrix ReceiverIf a previous version of Citrix Receiver 1.x is installed on your iPhone or iPod touch, thesoftware updates automatically from the App Store.

SSL CertificatesTo connect to a XenApp farm, users’ iPhone or iPod touch devices require aConfiguration Profile be installed that includes the certificate for the Web serverhosting the farm’s Program Neighborhood Services site or XenApp Services site. You canobtain this certificate from your browser’s certificate store.

For more information about creating Configuration Profiles and distributing them tousers, visit the Apple Web site.

ConnectivityCitrix Receiver supports HTTP, HTTPS, and ICA-over-SSL connections to a XenApp serverfarm through the following products or components:

w Citrix Access Gateway Enterprise Edition 8.1, 9.0, and 9.1

w Citrix Access Gateway Standard Edition 4.5.8, 4.6 and 4.6.1 (beta build14.1)

w Citrix Access Gateway Advanced Edition 4.5.8 and HF4 (AAC450W004)

w Citrix Secure Gateway 3.0 when used in proxy mode

Authentication through Access GatewayCitrix Receiver supports authentication through Access Gateway using the followingmethods:

w Domain authentication

w RSA SecurID

w Domain authentication paired with RSA SecurID

For more information about using these authentication methods with Access Gateway,see the configuration topics in this section of Citrix eDocs, as well as the section forAccess Gateway.

Requirements for Citrix Receiver for iPhone

4

Configuring Access Gateway and SecureGateway for Citrix Receiver for iPhone

Citrix Receiver for iPhone v1.x supports secure connections to an enterprise installationof Citrix Access Gateway and Citrix Secure Gateway.

The process to enable connections from the Citrix Receiver for iPhone is very similar toconfiguring an Access Gateway or Secure Gateway to accept Citrix XenApp connections,but with small differences.

Traditionally, when configuring an Access Gateway or Secure Gateway for XenAppconnections, a Web Interface site provides information about the publishedapplications that a user has rights to and presents them with a Web page with icons toclick.

The Citrix Receiver for iPhone uses a XenApp services site (previously known as aPNAgent site) to gather information and allow it to appear on the Citrix Receiver foriPhone’s App list.

Both traditional Citrix XenApp connections (using Web Interface) and the CitrixReceiver for iPhone (using XenApp Services) can co-exist on the one Citrix AccessGateway installation or Citrix Secure Gateway installation.

For more information about configuring connections, including videos, blogs, and asupport forum, refer to http://community.citrix.com/iphone.

To configure the Secure Gateway for CitrixReceiver for iPhone

Before beginning this configuration, install and configure the Secure Gateway to workwith Web Interface. You can adapt these instructions to fit your specific environment.

Citrix Receiver for iPhone supports only version 3.0 for the Secure Gateway. If you areusing a Secure Gateway connection, do not configure Citrix Access Gateway settings onthe Receiver.

Support for Citrix Receiver for iPhone requires XenApp Service 5.x, formerly known asPNAgent, which allows you to configure the XenApp Services site and the SecureGateway configuration.

1. In the XenApp console, create a XenApp Services site (such as http://XenAppServerName/Citrix/PNAgent or http://XenAppServerName/CustomPath) foriPhone users.

5

http://community.citrix.com/iphone

The Citrix Receiver for iPhone uses a XenApp Services site (formally PNAgent site)to get information about the applications a user has rights to and present them tothe Citrix Receiver running on the iPhone.

This is similar to the way you use the Web Interface for traditional SSL-basedXenApp connections for which a Secure Gateway can be configured. XenApp 5.xXenApp Services sites have this configuration ability built in.

Note: If you have already configured a Web Interface site for ICA connections ona Secure Gateway, create the XenApp Services site on the same server hostingthe Web Interface site.

To create a XenApp Services site for Citrix Receiver for iPhone to use:

a. Configure the XenApp Services site to support connections from a SecureGateway connection. The configuration of this site is similar to the WebInterface site.

b. In the XenApp Services site, select Manage secure client access > Edit secureclient access settings.

c. Change the Access Method to Gateway Direct.

d. Enter the FQDN of the Secure Gateway.

e. Enter the Secure Ticket Authority (STA) information.

Note: For the Secure Gateway, Citrix recommends using the Citrix default pathfor this site (http://XenAppServerName/Citrix/PNAgent). The default path enablesyour users to specify the FQDN of the Secure Gateway they are connecting toinstead of the full path to the config.xml file that resides on the XenApp Servicessite (such as http://XenAppServerName/CustomPath/config.xml).

2. On the Secure Gateway, use the Secure Gateway Configuration wizard to configurethe Secure Gateway to work with the server in the secure network hosting theXenApp Service site. After selecting the Indirect option, enter the FQDN path ofyour Secure Gateway Server and continue the wizard steps.

3. Test a connection from a user device to guarantee that the Secure Gateway isconfigured correctly for networking and certificate allocation.

4. On the iPhone or iPod touch device, for the Citrix Receiver application:

a. open Account Settings, and in the Address field, enter the matching FQDN ofyour Secure Gateway server:

w If you created the XenApp Services site using the default path (/Citrix/PNAgent), enter the Secure Gateway FQDN: https://FQDNofSecureGateway.company.com

w If you customized the path of the XenApp Services site, enter the full path ofthe config.xml file, such as: https://FQDNofSecureGateway.company.com/CustomPath/config.xml

b. In the Citrix Access Gateway settings, turn off Access Gateway.

Configuring Access Gateway and Secure Gateway for Citrix Receiver for iPhone

6

Note: If you configured your Access Gateway with No Authentication Required toreplace your Secure Gateway, turn on Citrix Access Gateway settings on the Receiver,enter the gateway type and No Authentication as Gateway Authentication on theReceiver for iPhone.

To configure Access Gateway Standard Editionfor Citrix Receiver for iPhone

Support for Citrix Receiver for iPhone requires XenApp Service 5.x, formerly known asPNAgent, which allows you to configure the XenApp Services site and the AccessGateway configuration.


The Citrix Receiver for iPhone uses a XenApp Services site (formally PNAgent site)to get information about the applications a user has rights to and present them tothe Citrix Receiver running on the iPhone.

This is similar to the way you use the Web Interface for traditional SSL-basedXenApp connections for which an Access Gateway can be configured. XenApp 5.0XenApp Services sites have this configuration ability built in.

Note: If you have already configured a Web Interface site for ICA connections onan Access Gateway, create the XenApp Services site on the same server hostingthe Web Interface site.


a. Configure the XenApp Services site to support connections from an AccessGateway connection. The configuration of this site is similar to the WebInterface site.



d. Enter the FQDN of the Access Gateway appliance.


Note: For Access Gateway Standard Edition, Citrix recommends using the Citrixdefault path for this site (http://XenAppServerName/Citrix/PNAgent). The defaultpath enables your users to specify the FQDN of the Access Gateway they areconnecting to instead of the full path to the config.xml file that resides on theXenApp Services site (such as http://XenAppServerName/CustomPath/config.xml).

7

2. Configure Authentication realms to authenticate users connecting to the AccessGateway using the Access Gateway Plug-in.

Active Directory authentication and RSA SecurID are the two supportedauthentication methods for v1.0.x of the Citrix Receiver for iPhone:

• If double source authentication is required (such as RSA SecurID and ActiveDirectory), RSA SecurID authentication must be the primary authenticationtype. Active Directory authentication must be the secondary authentication type.

• RSA SecurID can use either RADIUS or an sdconf.rec file to enable tokenauthentication.

• Active Directory authentication can use either LDAP or RADIUS.

Test a connection from a user device to guarantee that the Access Gateway isconfigured correctly in terms of networking and certificate allocation.

3. To establish communication with XenApp servers and the Web Interface, you needto configure the Access Gateway to recognize the servers. You can configure thesettings using group properties on the Access Gateway. Configure the AccessGateway to allow incoming XenApp connections from the Citrix Receiver andspecify the location of your newly created XenApp Services site.

a. In the Administration Tool, click the Access Policy Manager tab.

b. Right-click a user group and then click Properties.

c. On the Gateway Portal tab, click Redirect to Web Interface.

d. If the Path field for XenApp Services for Web Interface contains an existingconfiguration for a Web Interface site for ICA connections on the AccessGateway, do not modify your existing configuration, but make sure that yourXenApp Services site is located on the same server that is hosting the WebInterface site. If the Path field is empty, meaning there is no existingconfiguration for ICA connections, type /Citrix/PNAgent.

e. In Web server, type the IP address or FQDN of the server running the Web Interface.

f. On the Global Cluster Policies tab, select Enable logon page authentication.

Note:

• The check box Single sign-on to the Web Interface is specifically for WebInterface and does not affect connections using Citrix Receiver for iPhone. Ifyou configured the Access Gateway to use a Web Interface site for otherusers, continue to maintain and use it for the Web Interface.

• To enable Citrix XenApp connections on an Access Gateway that haspreviously been configured to accept connections using the Access GatewayPlug-in, select Use the multiple logon option page. For more information,refer to Configuring a Portal Page with Multiple Logon Options in the CitrixAccess Gateway Standard Edition Administrator’s Guide. Productdocumentation is available in the Citrix Knowledge Center at: http://support.citrix.com/pages/docs/.


8

http://support.citrix.com/pages/docs/


• In the Access Gateway Administration Tool, on the Authentication tab, clickthe Secure Ticket Authority tab and add the STA details. Make sure the STAinformation is the same as the XenApp Services site.

An important note about the use of certificates:

If the server certificate used on the Access Gateway is part of a certificate chain(with an intermediate certificate), make sure that the intermediate certificatesare also installed correctly on the Access Gateway. For information about installingcertificates, see Citrix Access Gateway Standard Edition Administrator's Guide.


a. In Account Settings, in the Address field, enter the matching FQDN of yourAccess Gateway server:

If you created the XenApp Services site using the default path (/Citrix/PNAgent), enter the Access Gateway FQDN such as: FQDNofAccessGateway.

If you customized the path for the XenApp Services site, enter the full path tothe config.xml file, such as: FQDNofAccessGateway/CustomPath/config.xml.

b. In the Citrix Access Gateway settings, turn on Access Gateway, set theGateway Type to the Standard edition, and select the authentication method.

To configure Access Gateway AdvancedEdition for Citrix Receiver for iPhone

Citrix Receiver supports the Access Gateway Advanced Edition 4.5 with Hotfix 4(AAC450W004).



The Citrix Receiver for iPhone uses a XenApp Services site (formally PNAgent site)to get information about the applications a user has rights to and presents them tothe Citrix Receiver running on the iPhone.

This is similar to the way you use the Web Interface for traditional SSL-basedXenApp connections for which an Access Gateway can be configured.


a. Configure the XenApp Services site to support connections from an AccessGateway connection. For more information, see the Access Gateway StandardEdition Integration Guide for Citrix XenApp and Citrix XenDesktop.

9





Note: The configuration of this site is similar to the Web Interface site.

2. Configure the Access Gateway appliance to use the Access Gateway AdvancedEdition.

3. In the Administration Tool, click the Access Gateway Cluster tab and open thewindow for the appliance.

4. On the Advanced Options tab, click Advanced Access Control.

5. Configure the settings for the server running Advanced Access Control.

6. On the server running Advanced Access Control, from your Logon Point, verify thatthe authentication method you prefer is set up and working. In the Logon PointProperties dialog box, click Authentication, and select a supported authenticationmethod for iPhone:

• For single-factor authentication, select Active Directory, LDAP, or RADIUS (whichcan be used for RSA SecurID or Active Directory authentication).

• For double-source authentication, under Active Directory, select RSA SecurID,which can be used with either RADIUS or an sdconf.rec file to enable tokenauthentication.


10


7. On the server running Advanced Access Control, create and deploy a second Logonpoint (you can verify the existence of the logon point by using this address in theWeb browser through the Access Gateway, such as https://FQDNofAccessGateway/CitrixLogonPoint/IPhone).

Citrix recommends using iPhone as the name for this logon point because theiPhone Receiver uses this name as the default logon point; otherwise, enter thefull URL, such as https://FQDNofAccessGateway/CitrixLogonPoint/<2ndLogonPointName>/) in the iPhone Receiver settings.

a. Create a Web resource (iPhonePNA) for the XenApp Service site of the iPhone,created in Step 6.

b. On the Web Resource Properties page for URL Addresses, set the home pageand display order for the iPhone logon point. Ensure that the AuthenticationType is No authentication. Also, ensure the XenApp Service sites are availablein the URL Addresses list.

c. Select the new Logon Point and set the following properties:

• On the Select Home Page tab, select the option to display the home pageapplication and set the display order so that the Web resource (iPhonePNA)home page has the highest priority.

11

• On the Authentication tab, select the method to authenticate users connectingto the Access Gateway using the Access Gateway Plug-in.

• On the Session Settings tab, clear the check box for Time to prompt userbefore password expires.

• On the Visibility tab, select Allow external users access to this logon point.

For more information about creating policies for the Access Gateway and XenApp,see the Access Gateway Advanced Edition Administrator's Guide for AAC450W004.

Product documentation is available in the Citrix Knowledge Center at: http://support.citrix.com/pages/docs/.

8. In the console under Policies, create a filter applying to this logon point. Right-click Filters, and select Create filter.


12



a. In Filter Properties, click the Logon Points tab.

b. In the Selected logon points list, add iPhone.

9. Create a policy for this Logon Point, such as iPhone-policy, and set the followingPolicy Properties:

a. On the Resources tab, select the check boxes for Web Resources > iPhonePNAand for Allow Logon.

13

b. On the Settings tab, ensure that the value for Web Resources > Access and

Network Resources > Access are set to Allow. This setting allows users toaccess the Web resource and allows the Logon to this logon point.


14

c. On the Filter tab, select the iPhone filter to apply to the policy.


If the server certificate used on the Access Gateway is part of a certificate chain(with an intermediate certificate), make sure that the intermediate certificatesare also installed correctly on the Access Gateway. For information about installingcertificates, see Citrix Access Gateway Advanced Edition Administrator's Guide.


a. In Account Settings, in the Address field, enter the matching FQDN of yourAccess Gateway server:

If you used iPhone as the iPhone Logon Point name, enter the FQDN of AccessGateway, such as: FQDNofAccessGateway

If you used anything other than iPhone as the iPhone Logon Point name, enterthe following path in the Address field: AGA-FQDN/CitrixLogonPoint/<secondLogonPointName>.

b. In the Citrix Access Gateway settings, turn on Access Gateway, set theGateway Type to Advanced edition, and select the authentication method.

To configure Access Gateway EnterpriseEdition for Citrix Receiver for iPhone



The Citrix Receiver for iPhone uses a XenApp Services site (formally PNAgent site)to get information about the applications a user has rights to and presents them tothe Citrix Receiver running on the iPhone.

This is similar to the way you use the Web Interface for traditional SSL-basedXenApp connections for which an Access Gateway can be configured.


a. Configure the XenApp Services site to support connections from an AccessGateway connection. For more information, see the Access Gateway EnterpriseEdition Integration Guide for Citrix XenApp and Citrix XenDesktop.



15



Note: The configuration of this site is similar to the Web Interface site.

2. Configure authentication policies to authenticate users connecting to the AccessGateway using the Access Gateway Plug-in. Bind each authentication policy to avirtual server.

Active Directory authentication and RSA SecurID are the two supportedauthentication methods for v1.x of the Citrix Receiver for iPhone:

• If double source authentication is required (such as RSA SecurID and ActiveDirectory), RSA SecurID authentication must be the primary authenticationtype. Active Directory authentication must be the secondary authentication type.

• RSA SecurID uses a RADIUS server to enable token authentication.

• Active Directory authentication can use either LDAP or RADIUS.


3. Create a session policy on the Access Gateway to allow incoming XenAppconnections from the Citrix Receiver, and specify the location of your newlycreated XenApp Services site.

• Create a new session policy to identify that the connection is from CitrixReceiver for iPhone. As you create the session policy, configure the followingexpressions and select Match All Expressions as the operator for the expressions:

REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver

REQ.HTTP.HEADER User-Agent CONTAINS CFNetwork

REQ.HTTP.HEADER User-Agent CONTAINS Darwin


16

• In the associated profile configuration for the session policy, if this is not aglobal setting (you checked the Override Global check box), ensure the ICAProxy field is ON.

In the Web Interface Address field, enter the URL including the config.xml forthe XenApp Services site that the iPhone users use, such as http://XenAppServerName/Citrix/PNAgent/config.xml or http://XenAppServerName/CustomPath/config.xml.

• Bind the session policy to a virtual server.

• Create authentication policies for RADIUS and Active Directory.

• Bind the authentication policies to the virtual server.

For more information about creating policies for the Access Gateway and XenApp,see the Citrix Access Gateway Enterprise Edition Administrator's Guide and theCitrix Access Gateway Enterprise Edition Integration Guide for Citrix XenApp andCitrix XenDesktop.

Product documentation is available in the Citrix Knowledge Center at: http://support.citrix.com/pages/docs/.


If the server certificate used on the Access Gateway is part of a certificate chain(with an intermediate certificate), make sure that the intermediate certificatesare also installed correctly on the Access Gateway. For information about installingcertificates, see Citrix Access Gateway Enterprise Edition Administrator's Guide.


17



a. In Account Settings, in the Address field, enter the matching FQDN of yourSecure Gateway server, such as FQDNofAccessGateway.

b. In the Citrix Access Gateway settings, turn on Access Gateway, set theGateway Type to Enterprise edition, and select the authentication method.


18

Providing Access Information to End Users

When users launch Citrix Receiver for the first time, they are required to enterinformation about the XenApp farm hosting the resources they want to access. Toensure users can connect successfully to the XenApp farm, distribute the followinginformation:

w The location of the XenApp Services site or Program Neighborhood Services sitehosting resources; for example:

https://servername/Citrix/PNAgent/config.xml

w Domain name

w The product edition and authentication method, if using Access Gateway

For specific details about configuring the Citrix Access Gateway or Secure Gateway forCitrix Receiver for the iPhone, refer to the configurations topics in this section ofeDocs. For other information, see http://community.citrix.com/iphone.

Users can turn on the Sign In Automatically option so this information is rememberedthe next time they start Citrix Receiver.

If the Sign In Automatically option is turned on, users cannot access the AccountSettings screen. To access the Account Settings screen, users can turn off this option bytapping Settings > Citrix. Then, they restart the Citrix Receiver to view the AccountSettings screen.

19

http://community.citrix.com/iphone

Troubleshooting Citrix Receiver for iPhone

Disconnected SessionsUsers can disconnect from a Citrix Receiver session in the following ways:

w Pressing the home button on their iPhone or iPod touch device

w Tapping the Back to Apps button in Citrix Receiver

If this happens, the session remains in a disconnected state. Although the user canreconnect at a later time, you can ensure disconnected sessions are rendered inactiveafter a specific interval. To do this, configure a session timeout for the ICA-tcpconnection in Terminal Services Configuration. For more information about configuringTerminal Services, refer to the Microsoft Windows Server product documentation.

Connectivity FailureUsers who continue to have connectivity issues can create a temporary user account atthe Citrix Cloud at http://community.citrix.com/display/xa/Citrix+Receiver+Demos+in+the+Citrix+Cloud.

The Citrix Cloud offers users the ability to experience the power of Citrix solutionswithout having to set up and configure their own environment. The Citrix Cloud demoenvironment uses a number of key Citrix solutions including Citrix XenServer, CitrixXenApp, Citrix NetScaler, and Citrix Access Gateway.

Troubleshooting Citrix Receiver for iPhone

20

http://community.citrix.com/display/xa/Citrix+Receiver+Demos+in+the+Citrix+Cloud

http://community.citrix.com/display/xa/Citrix+Receiver+Demos+in+the+Citrix+Cloud

Known Issues for Citrix Receiver

Applications published with 40-bit, 56-bit, and 128-bit encryptionWhen using Citrix Receiver to access an application published with 40-bit, 56-bit, and128-bit encryption, the application does not open or operate as expected. This is dueto the lack of RSA Crypto-C libraries for the iPhone operating system. Applicationspublished with basic encryption open and operate normally when accessed with CitrixReceiver.

Using non-ASCII characters with published applicationsWhen using Citrix Receiver to access a published application, the following limitationsexist:

w If the application is published with a name containing non-ASCII characters, theapplication does not open

w Entering non-ASCII characters, such as Korean characters, in published applicationsdoes not work as expected

To mitigate these limitations, ensure that:

w Your farm consists of one of the following configurations:

• Citrix Presentation Server 4.5 with a Program Neighborhood Services siteconfigured on a non-English operating system

• Citrix XenApp 5.0 with a XenApp Services site configured on a non-Englishoperating system

w The Microsoft IME toolbar is not minimized in the published application

To enter non-ASCII characters in a published application using the iPhone’s QWERTY/Pinyin keyboard, instruct users to perform the following steps:

1. Using Citrix Receiver, connect to the published application.

2. Tap the Microsoft IME toolbar and select the language you want to use; forexample, JP.

3. Select the language mode in which to enter non-ASCII characters; for example,Hiragana mode.

Setting screen the resolution for published applicationsDo not publish applications with a screen resolution of 1024 x 1024 pixels or more dueto restrictions on the Apple operating system. Citrix recommends publishingapplications at 1024 x 768 pixels or less.

21

citrix receiver for iphone -...

Documents