Citrix 2.8 App Controller User Manual

App Controller 2.8 enables centralized management of web, SaaS, mobile, and ShareFile access for users. Users can connect from their devices to access various applications through Citrix Receiver or Worx Home.

PDF

Document

Docs.Citrix.com

App Controller 2.8

http://docs.citrix.com/content/docs/en-us/appcontroller/2-8.html

Jul. 03, 2015 citrix.com

App Controller 2.8

citrix.com

About This Release

With App Controller, you can provide the following benefits for each application type:

SaaS applications. Active Directory-based user identity creation and management, with SAML-based single sign-on (SSO).

Intranet web applications. HTTP form-based SSO by using password storage.

iOS and Android apps. Unified store to which you can install MDX apps for iOS and Android devices, and security management for MDX policies, encompassing WorxMail and WorxWeb. You can wrap iOS and

Android apps with the MDX Toolkit to create MDX apps.

ShareFile access. Delivery of files by configuring ShareFile settings and the ShareFile application that provides seamless SAML SSO, and Active Directory-based ShareFile service user account management.

XenMobile App Edition enables the delivery of web, SaaS, mobile iOS and Android apps, along with Windows-based applications from XenApp and virtual desktops from XenDesktop. You manage application configuration and policy settings by using App Controller, with the following capabilities:

Centralized user account creation and management for web and SaaS applications, and ShareFile access that provides users with a seamless single sign-on (SSO) experience.

The use of Active Directory as the identity repository. Active Directory is then used as the basis for authorizing users to external applications and services.

A unified enterprise app store to enable the publishing and distribution of Android and iOS apps for authorized users to download and install on mobile devices.

Centralized policy controls to secure the applications and data, with easy removal of user accounts, erase and lock of Citrix-delivered applications and data, and consolidated auditing and reporting of application access.

You can configure applications and ShareFile access by using the App Controller web-based management console.

Within the management console, you can configure the following:

Roles that include Active Directory groups

Applications for SSO only

Applications for SSO, user account management, and the creation of new user accounts

Apps for Android and iOS devices, including WorxMail and WorxWeb apps

Approval workflows to authorize access to applications or to create user accounts on application servers

Categories to organize applications in Citrix Receiver and Worx Home

HTTP Federated Formfill connectors

SAML 1.1 or 2.0 connectors that support the identity provider (IdP) flow

Role-based management and delivery of mobile applications

Role-based ShareFile document management

Device inventory that lists user devices that connect to App Controller

This section introduces App Controller 2.8, announces what's new in this release, discusses compatibility between App

Controller, Worx Home, and Citrix Receiver, and lists known issues for App Controller.

Key Features

The most typical deployment configuration for App Controller is to locate App Controller in the secure network. Users can connect to App Controller to access applications.

The key features of App Controller are:

Access to web and SaaS applications that includes:

Federated support for SAML 1.1 and SAML 2.0 applications

Password storage and formfill support for password-based web applications

User account management from Active Directory group membership for SaaS applications

User account management workflows that allow users to request application accounts and for individuals in your organization to approve the requests

Access to Android and iOS mobile apps that includes:

The ability to publish Android and iOS apps that users can download and install on their mobile devices from Citrix Receiver, including WorxMail and WorxWeb

Security controls for Android and iOS apps to ensure application and data security citrix.com

Management of mobile apps on user devices through Receiver and Worx Home that enables you to control the mobile apps without managing the mobile device

The ability to wrap mobile apps with MDX policies

Access to ShareFile that includes a centralized device listing for users that allows you to erase application and ShareFile data on lost or stolen devices

Device inventory that includes:

The ability to configure App Controller to communicate with and enroll devices in XenMobile Device

Manager

The ability to view all devices that have connected to App Controller

The ability to erase and stop erasing data on the user device

The ability to lock and unlock managed apps on the user device

The ability to remove devices from the list

Support options that include:

GoToAssist phone, email, and chat options

Ability to add or modify support settings

What's New

App Controller 2.8 supports the following new features:

App Controller as a Secure Ticket Authority (STA). This capability lets users open applications in

Receiver, such as WorxMail that they want to leave open securely for long periods of time. To enable this feature, App Controller issues the tickets with policies that enable lifetime use unless the ticket expires. You can configure the lifetime of the secure ticket with a different value for each application.

For example, you may configure a secure ticket for WorxMail to remain valid for 7 days, in which case users must enter their credentials after a 7-day interval. Or, you may require a different application to have a secure ticket that remains valid for 24 hours, in which case users must enter their credentials at least one time every 24 hours to continue to have access to resources on the internal network. Tickets may be forced to expire if a user is deprovisioned, the users' permission to use an app is revoked, a device is locked or wiped, or an app is removed or upgraded.

When remote users start an MDX application that routes through NetScaler Gateway to the internal network, App Controller issues a ticket that is similar to the STA from XenApp. You configure time-outs for the connection in NetScaler Gateway. This new security ticketing feature provides support for ticketing sessions from Receiver for iOS, Receiver for Android, and Worx Home, as well as for thirdparty applications that leverage the ticketing capability and are wrapped with the MDX Toolkit. When you configure secure ticketing for an application, App Controller acts as a STA server and issues MDX tickets for Citrix Receiver or Worx Home to establish secure connections.

Active Directory settings.

When you use the First Time Use wizard to configure App Controller 2.8 and configure Active Directory settings, you can enter a group domain name (DN) that speeds the synchronization of Active Directory membership with App Controller.

Branding. You can import a logo for your organization into the App Controller management console to appear in the Worx Store on devices running Worx Home, Receiver for Android or Receiver for iOS.

Clustering. You can configure clustering for App Controller 2.8 from the command-line console. You configure several hosts, or service nodes , that run App Controller without connections to a database. The service nodes connect to the host, or cluster head , that runs App Controller and hosts the centralized database. All of the service nodes that run on that cluster share the database. The cluster head is often deployed with a backup host that acts as a passive, standby cluster head. The management console for a service node displays only the Overview and Release Management pages in System Configuration.

Data security for mobile apps. When you upload iOS or Android apps to App Controller, you can configure encryption settings for the app. When you upload an iOS app, you can allow offline or online access, enable encryption, and configure database and file exclusions. Android apps allow a greater level of encryption for public and private files, storage locations, and exclusions. Android apps allow for offline access only.

Google Play store credential storage.

You can enter users' Google Play store credentials in order to display an app description and icon in the management console and in the Worx Store.

Note: Google store credentials are mandatory when you configure an app for an Android Public App Store in the management console.

GoToAssist support options in Worx Home. You can configure some or all of the following four pre-defined settings in the management console to enable GoToAssist phone, email or web options to appear within

Worx Home.

A phone number for IT Help

An email address to use for organizations that don't offer GoToAssist

A web address that users click to open a GoToAssist chat session citrix.com

An email address for opening a GoToAssist ticket

Policies updates for Android devices. When users wrap applications by using the MDX Toolkit, you can configure the following new policies:

Private file encryption

Private file encryption exclusions

Non-standard external storage locations

Access limits for public files

Public file encryption

Public file encryption exclusions

Public file migration

Certificate label

For details on these policies as well as the entire list of policies for Android apps, see Configuring MDX

Policies for Android Apps in App Controller .

Receiver deployments that include StoreFront. You can delegate authentication to StoreFront, while enabling App Controller to continue to serve as the single place for managing enterprise application delivery and a single point of access to all users, across devices. This mode is recommended for advanced authentication scenarios that rely on the Public Key Infrastructure (PKI). To enable connections through

Receiver to managed applications, you can now configure the following trust settings in App Controller:

StoreFront for authentication. You can deploy StoreFront behind App Controller so that user connections route through App Controller and then to StoreFront, which acts as the authentication server.

NetScaler Gateway in the DMZ and StoreFront for authentication. You can configure remote connections to route through NetScaler Gateway in the DMZ and then to an application running on a server in your network. In this release, you can also configure this deployment, but also enable StoreFront to act as the authentication server. In this way, Receiver routes a connection through App Controller, which proxies the connection to StoreFront for authentication. Next, the connection is proxied through NetScaler

Gateway, which finally routes the request to App Controller.

SSL offloading. When you configure network connectivity, you can enable SSL offloading to move SSL decryption and encryption tasks to terminate on a NetScaler Gateway virtual server that you configure in the

DMZ. To enable SSL offloading, you need to configure the NetScaler Gateway virtual server with an appropriate SSL certificate to ensure that the communication with devices running Receiver and Worx Home continue to be secured with the Secure Sockets Layer (SSL) protocol.

Support for Worx Mobile Apps on Android or iOS devices. When users start the app on an Android or iOS device, Worx Mobile Apps starts rather than Receiver. Users continue to use Receiver to open HDX apps.

XenDesktop and XenApp integration. When users connect to App Controller, they can view their web, SaaS,

MDX and WorX mobile apps, in addition to their XenDesktop and XenApp applications and desktops. Users can view these apps in either the Web Interface or in Receiver if the Windows-based apps are delivered from StoreFront. When you configure StoreFront in front of App Controller and you configure Receiver to communicate with StoreFront, users continue to have a seamless experience.

XenMobile Device Manager trusted communication. You can establish trusted communication between App

Controller and XenMobile Device Manager by configuring a host, port, and shared key in the App Controller management console. You can also require that Worx users enroll in Mobile Device Manager. This configuration facilitates API calls between the App Controller and Device Manager for information sharing, as well as for the management of native mobile applications through the Apple Push Notification Service

(APNS).

citrix.com

System Requirements

You can install App Controller on the following:

XenServer 5.6 with a minimum of Service Pack 1

XenServer 6.0

XenServer 6.1

Microsoft Server 2012 with Hyper-V enabled

Microsoft Hyper-V Server 2012

VMware ESXi 4.x

VMware ESXi 5.0.1

VMware ESXi 5.1

XenServer, Hyper-V, and VMware ESXi must provide adequate virtual computing resources to App Controller as listed in the following table.

XenServer and VMware ESXi Requirements

XenServer and VMware ESXi must provide adequate virtual computing resources to App Controller as listed in the following table.

Memory 4 GB

Virtual CPU (VCPU) 2 VCPUs

Virtual Network Interfaces 1

Microsoft Hyper-V Requirements

Microsoft Hyper-V must provide adequate virtual computing resources to App Controller as listed in the following table.

Disk space (this is maximum disk size to which the App Controller disk can increase)

Memory

VCPU

Virtual Network interfaces (available for each App Controller VM)

50 GB

4 GB

Active Directory

When you add users to Active Directory, you must enter the first name, last name, and email in the user properties. If you do not configure users in Active Directory with this information, App Controller cannot synchronize these individuals.

When users attempt to start an app, users receive a message that they are not authorized to use the app.

App Controller Management Console Requirements

To use the management console effectively, keep the following minimum display requirements and recommendations in mind:

Citrix recommends using a Firefox, Chrome, or Internet Explorer 9 browser.

The management console display size is 1024 x 800.

When running the management console on a laptop, hide all toolbars to provide more screen space for the console.

In Internet Explorer or F

To use the management console effectively, keep the following minimum display requirements and recommendations in mind: irefox browsers, to view the management console as full screen, press F11.

citrix.com

App Controller Compatibility

App Controller works with the following Citrix products:

Citrix product Release versions

Netscaler Gateway

Access Gateway 10

StoreFront

10.1, Build 118.5

10, Builds 71.6104.e and 73.5002.e

1.2 and 2.0

Compatibility with Worx Apps

App Controller supports the following versions of Worx Home, WorxMail, and WorxWeb. Users with mobile devices can connect from an external location to access email and intranet web servers. To allow users to connect, you must deploy

NetScaler Gateway in the DMZ to support Micro VPN capability.

Citrix product

Worx Home for iOS

Worx Home for Android

WorxMail for iOS

WorxMail for Android

WorxWeb for iOS

WorxWeb for Android

Release versions

8.5

1.2

1.1

1.1.1

Compatibility with Citrix Receiver

App Controller supports the following versions of Citrix Receiver. Users can connect from the internal network or from an external network. If users connect from the Internet, you must have NetScaler Gateway deployed in the DMZ.

Receiver

Receiver for Windows

Receiver for Mac

Receiver for iOS

Receiver for Android

Receiver for Web

Release versions

3.4

11.7

5.8

3.4

1.1, 1.2, and 1.3

If users connect remotely with Receiver for Web Version 1.1, the connection must route through NetScaler Gateway.

citrix.com

Known Issues

Prerequisite

Important Notes

1. User account requests by using the workflow template with the App Controller workflow feature is not supported for users who connect with Receiver for Web.

2. User account requests by using the subscription workflow template with the App Controller workflow feature is not supported on Receiver for Mac 11.4. Users need to upgrade to Receiver for Mac 11.6 or 11.7.

3. The internal URL redirection feature, in which Receiver checks a keyword to determine if the URL requires a connection with the NetScaler Gateway Plug-in, is not available with Receiver for Web. The feature is supported only with Receiver for Windows Versions 3.1, 3.2, 3.3, or 3.4.

4. If you configure proxy servers to use both HTTP and HTTPS, App Controller uses the secure proxy server for all application connectors. If you configure only HTTP, or only HTTPS, App Controller uses the configured proxy server for all application connectors.

5. App Controller contains the management console. To open the management console, in a Web browser, enter https:

//<App ControllerFQDN>:4443/ControlPoint where <App Controller FQDN> is the fully qualified domain name (FQDN) or IP address of App Controller. The default user name is administrator and the password is password.

Installing App Controller

You can find installation instructions for App Controller in Citrix eDocs at Installing App Controller 2.8

Migrating to App Controller 2.8 From Earlier App Controller Versions

You can upgrade from AppController 2.5, or 2.6 to App Controller 2.8. Upgrades from AppController versions before 2.5 are not supported.

Before you start the upgrade, do the following:

1. Take a snapshot of the virtual machine (VM) in the XenCenter or vSphere console or in Microsoft Hyper-V.

2. Make sure that App Controller has an active network connection with valid credentials to Active Directory.

If you do not have an active network connection to Active Directory, the upgrade fails and reverts back to the previous version.

3. After the upgrade is complete, either close and then open the web browser, or clear the browser cache.

If your configuration is large, the upload might take several minutes. Do not interrupt the upgrade process before it is complete.

When the upgrade file successfully uploads, you receive a prompt to restart App Controller. If you choose to restart App

Controller at a later time, you need to restart by using the command-line console.

For more information about upgrading App Controller, see xmob-appc-maintain-upgrade-app-con.html#clg-appcmaintain-upgrade-app-c-con .

For information about upgrading a high availability pair, see Configuring High Availability .

Known Issues

1. If users cancel downloading an app from Worx Home, users cannot start the download again. Users must log off and then log on again to Worx Home. [#386565]

2. When you updated to App Controller 2.8, you must clear your browser cache after the upgrade. If you do not clear the cache, the management console from the previous App Controller version appears. [#388937]

3. When you add the CitrixAccessGateway application to App Controller and administrators attempt to test single-sign-on for user names and passwords with Unicode characters, the test users cannot log on to NetScaler Gateway. The single-sign-on test page for administrators does not support UTF-8 characters. [#389870]

4. When you upload Worx Store or Worx Home to App Controller, you can configure devices to be excluded. Worx Store requires a specific iOS device type, such as iPad 3 or iPhone 5. Worx Store looks for an exact pattern match. For citrix.com

4. example, if you want to exclude all iPads, you need to specify iPad 1, iPad 2, and so forth. Worx Home does not require the device version to make exclusions. If you specify either iPad 5 or iPad, Worx Home excludes all iPads.

[#392624, #399530]

5. When you configure ShareFile and save the settings, App Controller does not reconcile identical duplicate email addresses in Active Directory that are assigned to different users. You must manually reconcile one of the user accounts and make sure Active Directory does not contain duplicate email addresses. [#398666]

6. To allow secure communication by using SSL between App Controller and XenMobile Device Manager, you must install a certificate signed by a public Certificate Authority (CA) on Device Manager, such as VeriSign or Thawte. If you use a private certificate signed internally, you cannot secure communication between App Controller and Device

Manager. [#399847] citrix.com

Plan

As you plan to deploy App Controller, you should take the following considerations into account:

App Controller network settings, including the IP address, default gateway, DNS servers, NTP servers, web proxy, and Active Directory.

The deployment of web, SaaS, Android, and iOS applications that users need to access, including applications that you host in your internal network or applications that reside on the Internet. The applications include WorxMail and WorxWeb.

The deployment of App Controller only, in which users can connect to their web, SaaS, and mobile Android and iOS apps directly from App Controller.

The deployment of App Controller for high availability, in which you deploy two App Controller virtual machines (VMs) to fail over if one VM fails.

The deployment of App Controller with StoreFront that allows user access to Windows-based applications from XenApp and to virtual desktops from XenDesktop.

The deployment of NetScaler Gateway with App Controller and StoreFront that allows remote users to connect to network resources.

An App Controller configuration that includes ShareFile to allow users to easily view, edit, synchronize, and share files from any devices with document-level control. For more information, see the ShareFile documentation in Citrix eDocs.

This topic includes a checklist that helps you define the information you need about the following:

Active Directory settings

Applications for single sign-on (SSO)

Authentication through StoreFront

Clustering AppController virtual machines

Deployment settings for NetScaler Gateway and StoreFront

High availability

Mobile apps, including WorxMail and WorxWeb

Network connectivity

Ports

Role and category names

ShareFile settings

User devices

App Controller Pre-Installation Checklist

This checklist lists the tasks you should complete and the configuration values you should note before you install App

Controller 2.8.

Citrix recommends that you print and complete this checklist. The checklist has an extra column that you can use to check off each task as you complete it and to record information.

For instructions about installing and configuring App Controller, see Installing App Controller 2.8

App Controller Basic Network Connectivity

Note the App Controller host name.

Configure up to two DNS servers.

Note the IP address of App Controller.

Reserve one IP address if you install one instance of App

Controller.

Reserve three IP addresses if you configure high availability on App Controller.

Â citrix.com

Note the IP address for the Network Time Protocol (NTP) server.

If your deployment supports remote access to App Controller through NetScaler Gateway, note the following:

One public IP address configured on NetScaler

Gateway

One external DNS entry for NetScaler Gateway

Note: You only need an external DNS entry if you deploy NetScaler Gateway in your network.

App Controller resides in the internal network. If users connect to applications in the secure network from the Internet, NetScaler Gateway must reside in the DMZ.

Note the default gateway IP address.

Note the web proxy server IP address, port, proxy host list, and the administrator user name and password.

Note: You can user either the sAMAccountName or the User

Principal Name (UPN) when configuring the user name for the web proxy.

Certificates

App Controller requires secure server, root, and SAML certificates for communication with other Citrix products and

SAML applications. When you configure App Controller for the first time, you can add or create certificates on the Active

Directory page in the initial settings wizard in order to communicate with secure LDAP.

Create a Certificate Signing Request (CSR) and submit to a

Certificate Authority (CA) for signing.

Install a signed, secure SSL server certificate that is used for secure connections to the management console and for communicating with XenMobile MDM Edition, NetScaler

Gateway, StoreFront, and Web Interface.

Note: This certificate requires a private key. App Controller creates the private key when you run the CSR.

Install a secure SSL server certificate for communicating between App Controller and applications that require an SSL certificate for user account management. This is for secure

LDAP communication with App Controller.

Install a secure SAML certificate for communication between

App Controller and SAML applications that require an SSL certificate, such as GoogleApps. You can install one SAML certificate on App Controller.

Communication

Open the following ports to allow communication with App Controller.

Active Directory uses port 389.

Open port 636 if you use secure LDAP.

citrix.com

Open port 3268 for an LDAP connection to the Microsoft

Global Catalog.

Open port 3269 for a secure LDAP connection to the

Microsoft Global Catalog.

Open the following ports to allow administrator and server access:

Administration ports

App Controller command-line console, port 22. Open this port if you use Secure Shell (SSH) to connect to the command line.

App Controller management console, port 4443.

Server connections

Remote connections through NetScaler Gateway, port

443

DNS name resolution, port 53

SMTP mail server connection, port 25

Active Directory Settings

You use Active Directory to obtain groups. When you obtain groups, you can create roles and then assign applications to the role. By default, the AllUsers role in App Controller maps to the Everyone group in Active Directory.

Note the Active Directory IP address and port.

If you use port 636, install a root certificate from a CA on

App Controller.

Note the Active Directory domain name.

Note the Active Directory service account.

The Active Directory service account is the account that App

Controller uses to query Active Directory.

Note the Base DN.

This is the directory level under which users are located; for example, cn=users,dc=ace,dc=com.

Note: If your Active Directory database is large, you can configure multiple Base DNs to which App Controller binds and in which the server searches to find user objects. For example, you can use the following: ou=Finance,dc=ace,dc=com; ou=Sales, dc=ace,dc=com

Note the Group Base DN

This is the directory level under which users are located. You can use the same value that you used for Base DN.

Note a user account for testing.

This is an Active Directory account that you can use to log on and test SSO.

citrix.com

Device Management

You can configure App Controller to connect to XenMobile Device Manager.

Note: Before you configure settings in App Controller, configure App Controller settings on Device Manager.

You can also use App Controller to manage user devices. You can lock and erase data in App Controller.

Note the Device Manager host name.

Note the Device Manager port.

Note the shared key from Device Manager.

Note if devices require enrollment in Device Manager before connecting to App Controller.

Mail Server Settings

You can configure a mail server on App Controller through which App Controller can send notification emails. Typically,

App Controller uses these emails during a workflow to secure approvals or to notify users of new accounts and passwords that you configure App Controller to create for them. You configure the mail server settings when you first install App Controller and configure network settings in the management console. You can change workflow email settings at any time by using the Settings tab in the management console.

Note the email server name, such as mail.mycompany.com.

Note the SMTP port number.

Note the email address from which App Controller sends emails.

Store Settings

You can configure user credentials and the device ID for the Google Play Store. Users need to download the application

Device ID from the Play Store to obtain the device ID.

Note the user name for the Google Play Store.

Note the password.

Note the device ID.

Roles

Roles in App Controller represent a set of one or more groups in Active Directory. You can control the list of applications that users can view based on their group membership in Active Directory. When adding a role, you select the groups from Active Directory to include in the role. Then, you can add applications to the roles to provide access to a specific group of users. When you configure applications in App Controller, you select the role. If you do not select a role for the app, App Controller uses the default role AllUsers.

Important: You must create a role before you configure ShareFile settings. The role should contain the same number of members for which you obtain licenses. For example, if you have 100 licenses, the role should contain the same amount of users. If you use the AllUsers role, which might have more Active Directory accounts than licenses, synchronizing accounts in

ShareFile and App Controller might fail. If you previously selected the AllUsers role or a role with too many Active Directory accounts, you must manually remove the role from ShareFile and then add the new role.

List the names of roles you want to add in App Controller.

citrix.com

Categories

You can group applications into categories, such as Finance, Sales, and Marketing. Users see the categories when they log on with Worx Home or Citrix Receiver for Windows or Mac computers. Users can add or subscribe to their applications from the category that appears in Worx Store.

List the category names you want to create for Worx Home or Receiver.

Application Information

You can configure single sign-on (SSO) to applications in App Controller.

List the names of SAML applications for your organization.

List the names of Formfill applications for your organization.

List the names of mobile apps to upload to App Controller, including WorxMail and WorxWeb apps.

Note the logon web address of applications that do not have a default web address, such as Google Apps.

Use test credentials to test SSO to applications.

SAML Application Information

You can use the following table to enter information for your SAML applications.

Note the name of your SAML apps.

Note the supported SAML version.

Note the ACS URL.

Note the Entity ID.

Note the RelayState URL.

Note any additional parameters (and values expected) required as part of the SAML assertion.

Mobile App Management for iOS Apps

You can use the following guidelines for preparing MDX apps for iOS. You wrap mobile apps with the MDX Toolkit available from the Citrix Downloads page.

You must use a Mac OS X computer running Version 10.7 or

10.8 for iOS apps.

Obtain the Citrix MDX Toolkit available from the Citrix

Downloads page.

Â citrix.com

Obtain an Apple account from the Apple developer registration site.

Obtain a Distribution Certificate from Apple.

Obtain the iOS Distribution Provisioning Profile from the Apple

Developer web site.

Install the Xcode command line tools from the Apple Xcode web site.

Mobile App Management for Android Apps

You can use the following guidelines for preparing MDX apps for Android.

You must use a Mac OS X computer running Version 10.7 or

10.8 for Android apps.

Obtain and install the Java Development Kit (JDK) minimum

Version 1.7.

Obtain and install the Android Software Development Kit

(SDK).

Obtain the Citrix MDX Toolkit available from the Citrix

Downloads page.

Obtain a digitally signed certificate with a private key that is held by the application's developer. For more information about the certificate, see Signing Your Applications on the

Android Developers web site.

Mobile Links

You can configure mobile links to retrieve the name and description of apps from Google Play or the Apple App Store.

When you configure mobile links, the apps appear in Worx Home with the Google Play or App Store name.

List the mobile apps for which you want to retrieve information from

Google Play or the App Store.

Web Links

You can configure web addresses in App Controller. The links can be to Internet sites, or to intranet sites in the internal network. The links appear in Worx Home when users log on.

List the web sites to which you want to allow user access.

Data Management

You can configure ShareFile in App Controller to provide user access to documents and data. In previous App

Controller versions, when you configured ShareFile, the domain sharefile.com was automatically appended to the domain name. In this release, the domain sharefile.com does not automatically append to the ShareFile domain name.

You must enter the entire ShareFile domain name.

Note the full ShareFile domain name.

Note the roles from Active Directory that provide user access.

citrix.com

Note the ShareFile administrator account user name and password for user management.

High Availability

You can configure two App Controller VMs for high availability. If the primary App Controller fails, the secondary App

Controller can accept user connections. Each App Controller VM must be in the same subnet. You can configure high availability by using the command line on the Console tab in XenCenter.

For more information about configuring high availability, see Configuring High Availability .

Identify the primary App Controller IP address and subnet.

Identify the secondary App Controller IP address and subnet.

Configure a virtual IP address on NetScaler Gateway.

Configure the SSL handshake between App Controller VMs.

Clustering

You can form an App Controller cluster by grouping virtual machines (VM) together. One VM acts as the cluster head and connects to the database. The other VMs in the cluster communicate with the cluster head to obtain data. You can create, join, or leave a cluster. Citrix recommends deploying two App Controller VMs in a high availability pair first and then configure both VMs in the high availability pair as cluster heads. Then, you can add additional App Controller VMs as service nodes.

Note the cluster head IP address

Note the cluster head shared key.

Note the IP addresses of other App Controller VMs in the cluster.

Note: You add the shared key from the cluster head to these VMs.

Connect Users

You can configure App Controller to authenticate users. When users connect by using Worx Home, Citrix Receiver to

App Controller, they receive the mobile, web, and SaaS apps you configure in App Controller. Users can also connect to

StoreFront which provides the additional capability of access to published applications in XenApp and virtual desktops.

If users need to connect to apps hosted in your internal network from a remote location, you can route user connections through NetScaler Gateway. In App Controller 2.8, StoreFront must reside behind App Controller. You must also enable legacy mode in StoreFront or in the Web Interface.

Note the access method, App Controller, StoreFront, or NetScaler

Gateway for user connections.

Note the StoreFront URL and legacy path.

Note the NetScaler Gateway host name and external URL.

The external URL is the web address with which users connect.

Note the NetScaler Gateway callback URL.

Logging

citrix.com

Upgrade

Role details

Lock

Unlock

Erase

Stop erasing

Apps

Workflow details

User

You can configure a syslog server or transfer the logs to a server in the internal network.

Note the IP address or fully qualified domain name (FQDN) and port of the syslog server.

Note the server name to which you want to transfer logs.

Note the user name and password of the server to which you want to transfer logs.

Note the directory path where you store the logs.

Icons in the App Controller Management Console

The App Controller management console includes icons that users click to perform different tasks. The following table defines each icon.

Icon Icon name Definition

Enable Indicates that an app is disabled. When clicked, enables the app.

Disable

Edit

Remove

Sync

Indicates that an app is enabled. When clicked, disables the app.

Used to edit a role or application.

Used to remove an application, remove an application from a role, or to remove a category, workflow, or user device.

Used to synchronize application users with Active Directory for accounts that are configured for user account management. Also opens a Storage Zone dialog box in Roles to enable you to find a particular storage zone and provide credentials.

Used to upgrade a mobile application with a new version.

In Roles , you can view the Active Directory groups that belong to a configured role or you can delete the role.

Used to lock a user device.

Used to unlock a user device after you have locked it.

Used to erase data and documents from a device.

Used to stop the process of erasing data and documents from the device.

In Workflows , shows the apps with which the workflow is associated, if any.

In Workflows , lets you view the levels of manager approval and additional approvers for a configured workflow.

In Roles , lets you view members of the Active Directory groups.

citrix.com

Deploy

App Controller works with NetScaler Gateway and StoreFront to allow users to connect to web, SaaS, mobile applications, and Windows-based applications and desktops.

You install App Controller in your internal network. In this deployment, users can connect directly to App Controller to obtain their web, SaaS, Android and iOS apps, along with documents from ShareFile. If you also deploy StoreFront, users connect to StoreFront to obtain their Windows-based apps and desktops. StoreFront communicates with App

Controller to deliver apps and documents. In this scenario, StoreFront must reside behind App Controller in the secure network.

You can deploy App Controller with NetScaler Gateway to allow remote users to connect to apps in the internal network.

You install NetScaler Gateway in the DMZ and then you configure the appliance for user connections. Users connect with Worx Home to gain access to their mobile apps. Users connect with Receiver to access Windows-based apps.

You can also deploy App Controller for high availability. In this deployment, two App Controller virtual machines (VMs) work together to provide uninterrupted service to users. If one VM becomes unavailable for any reason, the other VM takes over and services user requests.

This section illustrates how you can deploy the App Controller VM on XenServer, VMware ESXi, or Microsoft Hyper-V in your internal network. It also illustrates the App Controller high availability configuration.

Deploying App Controller in Your Network

You can deploy the App Controller virtual machine (VM) on XenServer or VMware ESXi located in your internal network.

Users can connect to App Controller from an external connection (the Internet) or from the internal network. If users connect from the Internet or a remote location, the connection must route through NetScaler Gateway. App Controller resides in the internal network behind the firewall.

The following figure shows how you can deploy App Controller in an enterprise network. User connections from the

Internet route through NetScaler Gateway directly to App Controller. The figure also shows how users connect from the internal network directly to App Controller. Users can then access web, SaaS, and native mobile apps located in the internal network.

Figure 1. App Controller Network Deployment citrix.com

You can include StoreFront in your deployment, which allows users access to published applications from XenApp and virtual desktops from XenDesktop, along with apps configured in App Controller. When users log on with Citrix Receiver, all of their apps appear in the store. The following figure shows how you can deploy NetScaler Gateway, App Controller, and StoreFront in your network.

Figure 2. CloudGateway Deployment with NetScaler Gateway, App Controller, and StoreFront citrix.com

Deploying App Controller in a High Availability Configuration

You can deploy two App Controller virtual machines (VM) as a high availability pair. A high availability configuration prevents downtime and ensures that the services provided by App Controller remain available, even if one App

Controller VM is not working.

The following figure shows a high availability deployment in which one App Controller VM is not receiving connections.

Figure 3. App Controller High Availability Deployment citrix.com

citrix.com

Install and Setup

The App Controller virtual machine (VM) runs on Citrix XenServer, Microsoft Hyper-V, or VMware ESXi. You can use

XenCenter or vSphere management consoles to install App Controller 2.8.

Before installing App Controller, you must do the following:

Install XenServer or VMware ESXi on a computer with adequate hardware resources.

Install XenCenter or vSphere on a separate computer. The computer that hosts XenCenter or vSphere connects to XenServer or VMware ESXi host through the network.

Install Windows Server 2008 R2 or Windows Server 2012 with Hyper-V enabled, role enabled, on a computer with adequate system resources. While installing the Hyper-V role, be sure to specify the network interface cards (NICs) on the server that Hyper-V will use to create the virtual networks. You can reserve some NICs for the host.

This section details the following steps for installing App Controller on XenServer, Hyper-V, or VMware:

Downloading the virtual image.

Installing the VM on XenServer and setting the properties for App Controller in XenCenter.

Installing App Controller on VMware ESXi and using vSphere to allocate virtual hardware components to

App Controller, such as memory and virtual CPUs.

Installing App Controller on Hyper-V.

Configuring the IP address and subnet mask, default gateway, DNS servers, and Network Time Protocol

(NTP) servers for App Controller by using the XenCenter or vSphere command-line console.

When you finish configuring App Controller network settings by using the command-line console, you log on to the App

Controller management console. Then, you configure the following network settings:

Active Directory configuration from which you obtain groups for App Controller

Administrator settings

Workflow email settings

Optionally, you can change the settings you configured by using the command-line console in the wizard. These settings include:

App Controller system settings, such as IP address, subnet mask, and the default gateway

NTP and DNS server settings and the time zone

After you configure App Controller system settings, to complete the configuration, App Controller retrieves the groups and members of the groups from the specified Base DN in Active Directory. When the retrieval is complete, App

Controller logs off. You can log on again to continue configuring App Controller features.

Downloading the Virtual Image for App Controller

You can download the App Controller virtual image from the Citrix web site. The virtual image contains the package that you need in order to install App Controller on XenServer, VMware, or Hyper-V.

For the XenServer installation, the virtual image is a file with the file name extension of .xva.

For the VMware installation, the virtual image is a file with the file name extension of .ova.

For the Hyper-V installation on Microsoft Server 2008 R2, the virtual image is a ZIP file with the file name extension of .

vhd.

To download App Controller 2.8

1. Go to the Citrix web site .

2. Click My Account (Log In) and log on.

3. Click Downloads .

4. Under Select a Product , click XenMobile.

5. In Select Download type , click Product Software and then click Find .

6. On the XenMobile page, click XenMobile 8.5 App Edition .

7. On the XenMobile 8.5 App Edition page, click the appropriate App Controller virtual image in order to install App

Controller on XenServer, VMware, or Hyper-V.

8. Follow the instructions on your screen to download the software.

citrix.com

Setting the App Controller IP Address for the First Time

After you install the App Controller virtual machine (VM) and configure the initial settings by using the command-line console, you can configure additional App Controller network settings in the App Controller management console. To open the management console, type

https://AppControllerIPaddress:4443/ControlPoint

in the address bar of the web browser. For example, type

https:// 10.20.30.40:4443/ControlPoint

. The user name is administrator and the password is password. When you log on to the management console for the first time, the Configure wizard appears prompting you to configure settings that include the following:

Administrator password

Note: Make sure that the email address is part of the base DN that you configure in the Active Directory settings.

App Controller host name, IP address, subnet mask, and default gateway

Note: You can also configure an IP address for App Controller if you want a different IP address than what you configured by using the command-line console.

Active Directory settings

Certificates

Note: In the Configure wizard, you can add, create, or remove certificates on the Active Directory page. The option to configure certificates from the Active Directory page only appears when you configure App

Controller for the first time in the management console. After you run the Configure wizard for the first time, you can then manage certificates from the Settings tab in the management console.

Network Time Protocol (NTP) server and time zone

DNS server settings

Workflow email settings

Important: For workflows to work correctly, when you add users to Active Directory, you must enter the first name, last name, and email in the user properties. If you do not configure users in Active Directory with this information, App Controller cannot synchronize these individuals. When users attempt to start an app, users receive a message that they are not authorized to use the app.

After you configure and save the remaining network settings in the management console, App Controller retrieves users from Active Directory and then logs off. If you changed the password, log on again with the new password.

Important: If you have a large number of users or groups, it might take a few hours for App Controller to retrieve users. You cannot make any changes to App Controller until this process is complete. If you close the browser, interrupt the synchronization and then restart the Configure wizard in another web browser, your settings are not saved. Citrix recommends that you allow the Active Directory synchronization to complete. When you configure the App Controller settings for the first time, you can enter a group domain name (DN) that speeds the synchronization of Active Directory membership with App Controller.

If you need to make changes to system settings at a later time, you can access the Settings tab. You can configure or reconfigure the following on the Settings tab:

Active Directory settings, such as IP address, administrator email and password, and base DN

Administrator settings that allows you to change the password for the management console and the command line console

Support options that allows you to configure GoToAssist user assistance settings.

Branding that allows you to upload your own Portable Network Graphics (png) to mobile devices

Certificates where you can install root, intermediate, and server certificates on App Controller

Deployment settings for StoreFront or NetScaler Gateway

Domain Name Server such as a DNS or WINS server

GoToAssist settings for email or phone support

Log transfer that sends logs to a server in your network

Network connectivity that are the App Controller network settings

NTP server that contains the settings for a Network Time Protocol server

Receiver email template where you can send emails to your users to download Receiver

Receiver updates

Release management that allows you to upload software upgrades, patches, and application connectors

Store credentials where you can save the user name, password, and device ID for the Google Play Store

SysLog server settings

Workflow email which is the administrator email settings for workflows

XenMobile MDM where you configure connection settings to XenMobile Device Manager

Changing the App Controller Settings

1. In the App Controller management console, click Settings at the top of the page.

2. citrix.com

2. In the left pane, under System Configuration , click one of the options to configure the settings.

After you complete App Controller configuration, you can configure roles, users, applications, and application categories for single sign-on (SSO). You can do the following:

Refresh users from Active Directory.

Add roles to map which Active Directory groups receive access to applications.

Add web and SaaS applications to App Controller from the provided connector catalog.

Upload mobile apps to App Controller.

View a user device inventory in which you can erase and stop erasing application data and documents from a device, lock and unlock a device, or delete a device from the inventory.

Retrieve mobile app information by configuring mobile links.

Add links to commonly used web sites including Internet and intranet sites.

Create access to applications that are not in the catalog for SSO by using either HTTP Federated Formfill or

SAML connectors.

Download certificates for use with some SAML applications.

Create user accounts automatically based on Active Directory group membership.

Assign users to applications based on their role within the organization.

Add categories to which you can add applications.

Connect StoreFront to App Controller. When users connect with Citrix Receiver, they can see the application list, subscribe to applications, and access applications seamlessly.

Configure ShareFile settings for user data and documents.

Download a CR (.cr) file that configures Receiver on the user device. You can send this file to users in an email. The .cr file contains all of the settings that Receiver needs to connect to App Controller.

citrix.com

Installing App Controller on XenServer

After you download the virtual image (VM) from the Citrix web site, install App Controller on XenServer. After installation, set the properties for App Controller in XenCenter.

To install App Controller on XenServer

1. Start XenCenter on your computer.

2. In the navigation pane, click the name of the XenServer on which you want to install App Controller and then connect.

3. On the File menu, click Import .

4. In the Import wizard, in Filename , browse to the location to which you saved the .xva image file and then click Open .

5. Follow the instructions in the wizard to import the App Controller image.

After you click Finish in the wizard, you can click the Logs tab to view the status of the import process. When the import process is complete, you configure the initial settings for App Controller by using the command-line console. For more information, see Setting the App Controller IP Address for the First Time .

To set the properties for App Controller

When you import App Controller, the number of virtual CPUs (VCPUs) is set to 2. You cannot change this setting. The default memory setting is 4096. You can leave the memory setting or change it by using the Memory tab in XenCenter.

citrix.com

Installing App Controller by Using VMware ESXi

To install App Controller on VMware ESXi, you must first install VMware on a computer with adequate hardware resources. To perform the App Controller installation, you use vSphere. You install vSphere on a remote computer that can connect to the VMware host through the network. After you install App Controller, you can create virtual hardware components on VMware and then use vSphere to allocate them to App Controller.

When you install App Controller on VMware ESXi, you use the vSphere client. You select the OVF template to start the

Deploy OVF Wizard. Follow the directions in the wizard to import the App Controller OVA (.ova) file. You provide a name for App Controller and then configure additional settings to import the file to VMWare ESXi.

After the import is complete, you set the App Controller properties in vSphere. These settings include:

Allow the virtual machine to start and stop automatically with the system.

Set the startup order for App Controller.

Set the memory size to 4096.

Set the number of VCPUs to 2.

For more information about VMWare ESXi and the vSphere client, see the manufacturer's documentation.

citrix.com

Installing App Controller on Microsoft Hyper-V

To install App Controller on Microsoft Hyper-V, you must first install Microsoft Server 2012 with Hyper-V enabled or

Microsoft Hyper-V Server 2012 on a computer with adequate hardware resources. To perform the App Controller installation, you use the Hyper-V Manager, which is a Microsoft Management Console (MMC) snap-in. Hyper-V

Manager is installed automatically when you enable the Hyper-V role.

You download a compressed ZIP file to install App Controller on Microsoft Hyper-V. You extract the files and then use

Hyper-V Manager to install App Controller.

Note: Make sure that you extract the files in the ZIP folder into a different folder before you specify the path to the folder.

After you import the virtual machine, you need to configure the virtual network adapter by associating the adapter to the virtual networks created by Hyper-V. App Controller 2.8 requires one virtual network adapter.

In Hyper-V Manager, you select the server on which you want to install App Controller and then import the virtual machine. When the import starts, your are prompted to specify the path of the folder that contains the App Controller software files.

After the import is complete, you set the App Controller properties in Hyper-V Manager. These settings include:

Allow the virtual machine to start and stop automatically with the system.

Set the startup order for App Controller.

Set the memory size to 4096.

Set the number of VCPUs to 2.

For more information about Microsoft Hyper-V and the Hyper-V Manager, see the manufacturer's documentation.

citrix.com

Configuring and Synchronizing with Active Directory

App Controller uses Active Directory groups and users. You configure Active Directory when you log on to the App

Controller management console for the first time. With Active Directory, you can:

Create roles in App Controller that map to one or more Active Directory groups.

Create and remove user application accounts based on their Active Directory group membership by using applications assigned to roles.

Create workflows for manager approval of user accounts for applications.

Important: When you add users to Active Directory, you must enter the first name, last name, and email in the user properties. If you do not configure users in Active Directory with this information, App Controller cannot synchronize these individuals. When users attempt to start an app, users receive a message that they are not authorized to use the app. Also, when you configure Active Directory settings in App Controller, in Service account , enter an administrator email that is configured in Active Directory. If the administrator email does is not in the Active Directory path that you enter as the base

DN, then first time use of App Controller will fail.

When App Controller synchronizes with Active Directory, either after the first time you configure Active Directory in App

Controller or if you manually synchronize with Active Directory, the length of time it takes synchronize depends on the size of Active Directory. If you have a large number of users and groups, this process can take a few hours. During this time, you cannot configure any other settings in Active Directory. If you enter a group DN when you first configure Active

Directory, the synchronization occurs more quickly. For example, you enter cn=Users,dc=

servername

,dc=net

, where cn=users

is the group base DN and

servername

is the name of the Active Directory server. When the initial synchronization is finished, App Controller logs off from the management console and returns to the management console logon page.

App Controller supports three types of Active Directory synchronization:

Initial synchronization. When you log on to the management console for the first time, you configure Active

Directory settings in the initial wizard along with network and email settings. When you save the settings,

App Controller synchronizes with Active Directory.

Periodic synchronization. App Controller contacts Active Directory every five minutes to determine if there are any changes in Active Directory. App Controller looks for users added, removed, and modified in Active

Directory. App Controller also looks for group membership changes and new and removed groups.

Manual synchronization. You can synchronize with Active Directory at any time by using the Refresh from

Active Directory link on the Settings tab in the App Controller management console. When you synchronize,

App Controller updates all users from Active Directory and determines any changes to the user records. This synchronization can take as long as the initial synchronization and depends on the size of Active Directory.

This synchronization also returns changes to users and groups, including group membership.

You can change the Active Directory domain name in App Controller by using either the initial wizard or by using the

Active Directory link on the Settings tab. If you change the domain name, App Controller synchronizes with Active

Directory in the new domain, which can take some time depending on the size of Active Directory.

To manually synchronize with Active Directory

1. In the App Controller management console, click Settings at the top of the page.

2. In the left pane, under Quick Links , click Refresh from Active Directory .

A message appears when synchronization is complete.

citrix.com

Changing the Administrator Password

When you log on to the App Controller management console for the first time, you enter the user name

administrator

and the password, which is

password

. You can change the administrator password in the Configure dialog box when you first log on by using a web browser.

You can also change the administrator password at a later time from the System Configuration panel.

Note: When you change the administrator password in the management console, the password also changes in the command-line console.

1. Log on to the management console and then click the Settings tab.

2. Under System Configuration , click Administrator .

3. In the details pane, next to Administrator , click Edit .

4. In Old password , type the current password.

5. In New password and Confirm password , type the new password.

6. Click Save .

citrix.com

Updating App Controller

When new versions of the App Controller software are available, you can upgrade to a new version. You can also update App Controller with new application connectors or a system patch.

Software updates can include the following:

New version of App Controller

App Controller service pack

App Controller system patch

App Controller ships with a standard set of single sign-on (SSO) connectors that are included in the application connector library. In addition to the standard set of connectors that are delivered as part of App Controller, you can install connector library updates by installing connector packs. The connector pack can include application connectors for new applications added to App Controller or modifications to existing connectors. Connectors can also be released as part of a service pack, system patch, or a new release of App Controller.

You can install new versions of the App Controller software, new application connectors, or system patches by using the

Release Management option in the App Controller management console.

Note:

If you deploy App Controller as a high availability pair, you upgrade the primary virtual machine (VM) first and then the secondary VM. For more information, see xmob-appc-ha-wrapper-con.html#clg-appc-hawrapper-con .

When you install an upgrade, a patch, or you update the application connectors, and then you want to install another patch, you must restart App Controller before installing the second patch.

To update App Controller

You can use this procedure to upgrade your existing App Controller deployment with new versions of the software, install new application connectors, and install system patches that become available for App Controller.

1. In the management console, click the Settings tab.

2. Under System Configuration , click Release Management .

3. In the Release Management table, click Upgrade.

4. In the Upgrade dialog box, click Browse and then navigate to the installation package on your computer.

5. Click Open and then click Upload .

The file uploads to App Controller.

6. If prompted, restart App Controller.

App Controller might not require a restart after the update installs. In this case, a message indicates that the update installation is successful.

citrix.com

Licensing

AppController requires you to purchase one of the following XenMobile App Edition licensing options:

User licensing. This option enables a dedicated user connection to a XenMobile App Edition virtual appliance. An assigned user receives access to XenMobile App Edition from an unlimited number of user devices.

Concurrent licensing. This option enables a single device to connect to any application or data by using a single instance of XenMobile App Edition. Through this option, multiple devices can share licenses. This option is recommended for occasional or anonymous use.

When you purchase a license, you also choose from the following two options:

Perpetual. This option enables user access to XenMobile App Edition on a perpetual basis. All Perpetual licenses include an initial 12-month membership in the Citrix Subscription Advantage program, which entitles you to receive future software version updates.

Annual. This option enables user access to XenMobile App Edition on an annual basis. The license is valid for 12 months from the purchase date. The agreement includes the right to receive App Controller updates for that period. To extend an Annual license, you must purchase and install a new license prior to the expiration of the current license. If you do not purchase a new license, when the license period expires, you might not be able to access App Controller.

After you install App Controller in the network, you are ready to obtain your license files from Citrix. You log on to the

Citrix web site to access your available licenses and to generate a license file. When the license file is generated, download it to a computer. For more information about obtaining your license files, see Citrix Licensing System . When you download the license file, you need to select the Host ID as the Host ID type .

citrix.com

Creating a Cluster

You can install multiple instances of the App Controller virtual machine (VM) to create a cluster. One App Controller VM acts as the cluster head. This App Controller is considered to be the host and, as such, hosts the database for all of the

VMs in the cluster.

Note: The App Controller cluster head requires 4 VCPUs.

All other App Controller VMs in the cluster are called service nodes. Each service node has a local database that is used by the service node only. Updating user information from the service node to the cluster head requires writing to the database. A service node connects to the database on the cluster head by using a secure channel.

App Controller VMs deployed as service nodes obtain their configuration from the App Controller that acts as the cluster head. Citrix recommends deploying two App Controller VMs in a high availability pair. With high availability, one of the paired VMs serves as the primary node, acting as the cluster head, while the other is the secondary node, monitoring the primary. If the primary fails, the secondary assumes the role of the cluster head.

You use the command-line console to configure App Controller clustering. You can create a cluster, join an App

Controller VM to a cluster, and remove a VM from the cluster.

When you add an App Controller service node to the cluster and then log on by using the management console, only the Dashboard and the home page appear.

Configuring Load Balancing for an App Controller Cluster

As shown in the following figure, App Controller works with NetScaler to provide load balancing to all of the service nodes in the cluster. All VMs run behind a load balancer that is responsible for terminating SSL connections from Citrix

Receiver. You install certificates for App Controller on the load balancer.

Figure 1. Deploying App Controller with NetScaler in a Cluster

Citrix recommends that you configure the following three virtual servers on NetScaler for load balancing:

One virtual server as a Content Switching load balancer

One virtual server for rule-based load balancing

One virtual server for custom serverID persistence load balancing

You configure the Content Switching load balancer to route requests with the session ID in the URL to go through the custom serverID load balancer. All other requests go through the rule-based load balancer. You need to configure cookie (LB1) and serverID (LB2) persistency policies on the virtual servers. If the session ID parameter is not in the request URL, the request is sent to LB1 for cookie persistency. If the session ID is present, the request is sent to LB for serverID persistency.

The load balancer needs to query the cluster node to determine if the cluster is running, to obtain information about the load, or to perform health checks by sending user requests to App Controller VMs that are working correctly. Health checks provide greater application availability by ensuring user requests are directed only to correctly behaving servers.

When user connections go through the load balancer to an App Controller service node, the cluster uses HTTP connections. You can use HTTPS if you want additional security.

Note: App Controller clustering uses TCP port 9737

For more information about load balancing, see Load Balancing in the NetScaler documentation.

citrix.com

Creating a Cluster

When you create a cluster in the command-line console, the cluster node identifier, the current App Controller role, and a prompt to enter the shared key appear. You create the shared key on the cluster head and then use the same shared key for each VM in the cluster.

You must configure the host name on the cluster head. This information is replicated to the service nodes automatically as part of configuration sharing. The host name appears in the request URLs to be distributed in the cluster. Each service node in the cluster must also have the same shared key to establish secure tunnels. If the shared key on the cluster head and service node do not match, the two VMs cannot communicate.

The shared key must be eight characters with at least one uppercase letter, one lowercase letter, one numeric, and one special character that includes one of the following symbols: [!#$&].

After you enter the shared key, you restart App Controller. After App Controller restarts and you log on again to the command-line console, a message appears that states that the App Controller VM is now the cluster head.

If you have two App Controller VMs in a high availability pair, use the virtual IP address when you configure the service node. Both VMs function as a cluster head. For example, if the primary VM in the high availability pair fails for any reason, the secondary VM takes over and serves user requests.

Adding Service Nodes to the Cluster

When you join an App Controller VM to a cluster, you provide the IP address and shared key of the cluster head. After you enter this information, you restart App Controller. When App Controller restarts, you can use the command-line console to show the following cluster information:

Cluster node ID

Current role as the service node

Cluster head IP address

Shared key

Adding and Removing App Controller Nodes in a Cluster

To join App Controller virtual machines (VMs) together in a cluster, you first designate one VM as the cluster head. To do so, you use the command-line console to create the cluster. Then, you can add other VMs to the cluster. These VMs are designated as service nodes. You can log on to the command-line console in one of the following ways:

XenCenter Console tab.

vSphere Console tab.

Hyper-V Powershell.

Secure Shell (SSH) connection, such as from PuTTY.

To create the cluster head

1. Log on to the App Controller command-line console.

2. In the main menu, type 2 and then press ENTER.

3. Type 4 and then press ENTER.

4. In Cluster Head IP Address , type the IP address of the App Controller VM that is acting as the cluster head.

5. In Cluster Shared Key , enter the shared key for the cluster and then press ENTER.

6. When prompted, type y to restart App Controller.

To join a node to a cluster

You can remove an App Controller VM from the cluster at any time.

1. Log on to the App Controller command-line console.

2. In the main menu, type 2 and then press ENTER.

3. Type 5 and then press ENTER.

4. In Do you want to leave the cluster , press y and then press ENTER.

5. When prompted, type y to restart App Controller.

citrix.com

Configuring High Availability

If you deploy two App Controller virtual machines (VM), you can deploy them in a high availability configuration. You configure one App Controller VM as the primary role and the other VM as the secondary role. In this deployment, the primary App Controller VM listens for requests, and serves user requests. The secondary VM synchronizes its data with the data on the primary App Controller VM. The two VMs work as an active-passive pair, in which only one VM is active at a time.

If the current primary App Controller VM stops responding for any reason, the current secondary App Controller VM takes over and becomes the active VM. The new primary App Controller begins to serve user requests.

You configure each instance of App Controller with an individual IP address. Each App Controller in the pair is also assigned with the same virtual IP address, which is used by the active App Controller. Users connect to the primary App

Controller VM by using a fully qualified domain name (FQDN) that resolves to the virtual IP address.

In App Controller 2.8, you use the Console tab in XenCenter or a Secure Shell (SSH) client, such as PuTTY, to prepare two App Controller VMs for high availability. When you configure high availability, you configure the following settings:

Select the role preference that defines the primary and secondary VM.

Select the virtual IP address (primary only) and peer IP address along with a shared key.

Enable or disable high availability.

Show the status of each VM in the pair.

Force failover to the secondary VM from the current primary VM.

How App Controller High Availability Works

When you configure App Controller for high availability, the two virtual machines (VMs) communicate by using port

9736. Each VM in an App Controller high availability pair generates a heartbeat message at one second intervals. You can view the status of the VMs by using the App Controller command line. The heartbeat service running on the two

VMs monitors the health of each App Controller system and the health of the high availability pair.

If the primary App Controller VM fails for any reason, the secondary VM immediately takes over as the primary VM. If the active VM does not respond or reports a failure, the passive VM acquires the virtual IP address and becomes active.

When the failed VM comes back online, it joins with the current active VM and becomes the passive VM. The passive

VM then synchronizes with the data from the active VM.

Prerequisites

Before you configure an high availability pair, do the following:

Install the same build version for each App Controller virtual machine (VM).

Install both VMs in the same network subnet.

Assign IP addresses from the same subnet to each VM in the pair.

The basic steps for configuring high availability are as follows:

Identify which VM is the primary role and which VM is the secondary role.

Configure the virtual IP address, the peer IP address, and shared key on the primary VM.

When you finish configuring high availability on the primary VM, configure the peer IP address and shared key on the secondary VM.

To prepare each VM for high availability in App Controller 2.8, you use the command-line console to configure the settings. You can log on to the command-line console by using the Console tab in XenCenter or vSphere. You can also log on to App Controller by using a command-line tool, such as PuTTY. You must enable SSH in App Controller to use

PuTTY.

To configure the primary App Controller

1. Log on to the primary App Controller by using the command line.

2. At the command prompt, press 1 to enter high availability and then press ENTER.

3. At the command prompt, press 1 and then press ENTER to set the VM role preference as the primary.

4. At the command prompt, press 2 and then press ENTER to set the virtual IP address (on the primary only), peer IP address, and shared key.

5. Press y to commit the changes.

6. At the command prompt, press 3 and then press ENTER to enable high availability.

citrix.com

To configure the secondary App Controller

1. Log on to the secondary App Controller by using the command line.

2. At the command prompt, press 1 to enter high availability and then press ENTER.

3. At the command prompt, press 1 and then press ENTER to set the VM role preference as the secondary.

4. At the command prompt, press 2 and then press ENTER to set the peer IP address and shared key.

Make sure the shared key matches with the one configured for the primary.

5. Press y to commit the changes.

6. At the command prompt, press 3 and then press ENTER to enable high availability.

When you configure high availability on for the primary App Controller VM, the option to force failover to the secondary

VM appears.

To force failover to the secondary appliance

1. Log on to the primary App Controller by using the command line.

2. At the command prompt, press 1 and then press ENTER.

3. At the command prompt, press 5 and then press ENTER to force failover to the secondary App Controller.

citrix.com

Migrating an High Availability Pair to App Controller 2.8

You can upgrade two App Controller virtual machine (VMs) in a high availability pair from App Controller 2.6 to App

Controller 2.8. You can migrate each VM by using one of two methods:

Upgrading each VM in the pair.

Installing two new instances of App Controller on your hypervisor.

App Controller provides 50 gigabytes (GB) of disk space. If you upgrade each VM in the pair, each instance has 50 GB of disk space.

If you install new instances of App Controller, you can use the same IP addresses that you used for App Controller 2.6.

When you install new instances, you install and configure the VM by using the instructions in Installing App Controller 2.8

. Then, you can use the command-line console to create the high availability pair with App Controller 2.8.

To upgrade App Controller in a high availability pair

In this procedure, the primary node is called A and the secondary node is B.

1. Shut down node B in the high availability pair.

2. Upgrade node A by using the instructions in To update App Controller .

3. When the upgrade is finished, restart node A and then shut down node A.

4. Start node B, repeat Step 2 for node B and then restart node B. When you restart node B, it becomes the primary node.

5. Start A node. When you start node A, it becomes the secondary node.

After you upgrade and restart both nodes, the VMs automatically join to create the high availability pair.

citrix.com

Backing Up and Restoring Snapshots in an High Availability Pair

You can back up and restore snapshots in a high availability pair. To do so, you need to make sure the configuration on both App Controller virtual machines (VMs) is the same. You export the snapshot from the current, primary App

Controller. Then, you shut down the secondary App Controller. Then, you import the snapshot to the primary node and restart App Controller.

To back up and restore snapshots in a high availability pair

1. Export the snapshot from the current primary node in the pair.

For more information, see To export a snapshot .

2. Shut down the secondary node in the pair.

3. Import the snapshot to the single master node.

For more information, see To import a snapshot

4. Restart App Controller.

5. On the primary App Controller, log on to the command-line console and verify that the IP address is correct. If the IP address is correct, proceed to Step 7. If not, perform Step 6 and then Step 7.

6. Disable high availability by using the command-line console.

a. At the command prompt, type 1 to enter high availability.

b. At the command prompt, type 3 and then press ENTER to disable high availability.

c. Type y to confirm you want to disable high availability.

d. At the command prompt, type 0 and then press ENTER to return to the main menu.

e. At the command prompt, type 0 and then press ENTER to enter Express Setup.

f. At the command prompt, type 1 and then press ENTER to configure the IP address and subnet mask.

g. At the command prompt, type 5 and then press ENTER to save your changes.

When you press ENTER, App Controller restarts. Log on to the command-line console again to complete the following steps.

h. At the command prompt, type 0 and then press ENTER to return to the main menu.

i. At the command prompt, type 1 and then press ENTER to enter high availability.

j. At the command prompt, type 3 and then press ENTER to enable high availability.

k. Type y to confirm you want to enable high availability.

7. Start the secondary App Controller.

When you start the secondary App Controller, both nodes in the high availability pair are synchronized.

citrix.com

Configuring a Web Proxy Server

You can configure a web proxy server from the App Controller command-line console to allow access to the Internet from App Controller. To configure the web proxy server, you configure the IP address, port, and optionally, a non-proxy host list, user name, and password. When you commit the changes, App Controller restarts. After you configure the web proxy server, when you use the management console to manage user accounts from the Apps & Docs tab for SaaS apps or for ShareFile, App Controller uses the proxy server settings for outbound connections.

When you configure the web proxy server, you configure the settings for an unsecure (HTTP) web proxy server. When configuration of these settings is complete, you then configure the settings for a secure (HTTPS) web proxy server.

Note: The web proxy does not work with Google Apps or the Salesforce application if you configure the web proxy with authentication.

To configure a web proxy server

1. In XenCenter or vSphere, select the App Controller virtual machine, click the Console tab and then log on to App

Controller.

4. Enter the following web proxy information:

IP address

Port

Proxy host exclusion list (optional)

User name

Note: When you configure the web proxy, you can use either SAMAccount or the User Principal

Name (UPN) as the format for the user name. App Controller supports special characters in the user name.

Password citrix.com

Configuring Certificates

In App Controller, certificates are used to create secure connections and authenticate users.

To establish a secure connection, a server certificate is required at one end of the connection. A root certificate of the

Certificate Authority (CA) that issued the server certificate is required at the other end.

Server certificate. A

server certificate

certifies the identity of a server. App Controller requires this type of digital certificate.

Root certificate. A

root certificate

identifies the CA that signed the server certificate. The root certificate belongs to the CA. The user device requires this type of digital certificate to verify the server certificate.

You can configure certificate chains, which contain intermediate certificates, between the server certificate and the root certificate. Both root certificates and intermediate certificates are referred to as trusted certificates .

When establishing a secure connection with a web browser on a user device, App Controller sends its certificate to the user device.

When receiving a server certificate, the web browser (for example, Internet Explorer) on the user device checks to see which CA issued the certificate and if the CA is trusted by the user device. If the CA is not trusted or if it is a test certificate, the web browser prompts the user to accept or decline the certificate (effectively accepting or declining the ability to access the site).

Note: You can only install Privacy Enhanced Mail (PEM) and Personal Information Exchange (.pfx) certificate files on App

Controller.

App Controller requires root and server certificates to communicate in the following ways:

Between App Controller and the App Controller management console

Between applications and App Controller

Between App Controller and StoreFront

You might need to install several certificates on App Controller to facilitate secure communication. Each certificate serves a specific communication purpose.

App Controller requires the following three certificates:

Secure SSL server certificate that is used for secure connections to the management console and for communicating with StoreFront

Secure SSL server certificate for communicating between App Controller and applications that require an

SSL certificate for user account management

Secure SSL certificate for communication between App Controller and SAML applications that require an

SSL certificate

If you configure a SAML application in App Controller, such as Google Apps, you might need to upload a SAML certificate to App Controller. For more information about SAML certificates, see the application documentation.

citrix.com

Installing a Signed Server Certificate and Private Key on App Controller

App Controller includes a server certificate that is not signed by a trusted Certificate Authority (CA). You need to install on App Controller a digital X.509 server certificate that belongs to your company and is signed by a CA. Your company can operate as its own CA, or you can obtain a digital signed server certificate from a commercial CA, such as VeriSign or Thawte.

App Controller accepts a Privacy Enhanced Mail (PEM) format certificate file. PEM is a text format that is the Base-64 encoding of the Distinguished Encoding Rules (DER) binary format. The PEM format specifies the use of text BEGIN and END lines that indicate the type of content that is being encoded.

You can install a secure digital certificate and private key on App Controller in the following two ways:

Generate a Certificate Signing Request (CSR) by using the App Controller management console.

When App Controller generates the CSR, App Controller creates a certificate and private key. The private key remains on App Controller and the certificate contents are copied and submitted to a CA web site for signing. When the signed certificate is returned, you install the certificate on App Controller. During installation, the signed certificate is paired with the password-protected private key. Citrix recommends that you use this method to create and install secure certificates.

Install a PEM certificate and private key from a Windows-based computer. By using this method, you upload a signed certificate and private key together. The certificate is signed by a CA and is paired with the private key.

To install a certificate and private key from a Windows-based computer

If you are using a load balancer or you have a signed digital certificate with a private key that is stored on a Windowsbased computer, you can upload the certificate to App Controller. If the App Controller virtual machine (VM) is not located behind a load balancer, the certificate must contain the fully qualified domain name (FQDN) of App Controller. If the App Controller VM is located behind a load balancer, each appliance must contain the same certificate and private key.

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. Click Import and then select Server (.pfx) .

4. In the Import a certificate dialog box, click Browse , navigate to the certificate and then click Open .

When you upload the certificate to App Controller, you are asked for a password to encrypt the private key.

citrix.com

Overview of the Certificate Signing Request

Before you can upload a certificate to App Controller, you need to generate a Certificate Signing Request (CSR) and private key. You generate the CSR in the Certificate Signing Request dialog box that you open from the Certificates panel in the App Controller management console. After you create the .csr file, you copy the certificate contents and submit them to the Certificate Authority (CA) web site for signing. The CA signs the certificate and returns it to you at the e-mail address you provided. When you receive the signed certificate, you can install it on App Controller.

To provide secure communications by using SSL or TLS, App Controller requires a server certificate. A summary of the steps for obtaining and installing a server certificate on App Controller are as follows:

Generate a CSR in the management console.

Important: When you create the CSR, do not create another CSR. There is a private key associated with the

CSR that you send to the CA for signing. If you create another CSR, the private key for the first CSR is erased and you will not be able to install the signed certificate on App Controller. When you install the signed certificate, App Controller automatically pairs it with the private key.

Copy the certificate contents and submit them to a CA Web site for signing.

When you receive the signed certificate file from your CA, upload the certificate on the Certificates panel in the management console. The certificate is automatically converted to the Privacy Enhanced Mail (PEM) format, which is required by App Controller.

Password-Protected Private Keys

Private keys that are generated with the CSR are stored in an encrypted and password-protected format on App

Controller. When creating the CSR, you are asked to provide a password for the private key. The password is used to protect the private key from tampering and is also required when restoring a saved configuration to App Controller.

Passwords are used whether the private key is encrypted or unencrypted.

To create a Certificate Signing Request

To provide secure communication by using SSL or TLS, a server certificate is required on App Controller. Before you can upload a certificate to App Controller, you need to generate a Certificate Signing Request (CSR) and private key.

1. In the App Controller management console, click the Settings tab.

2. In the left panel, under System Configuration , click Certificates .

3. In the Certificates panel, click New and in Certificate Signing Request , type the required information:

In Key Length (required), select the encryption strength.

In Common name (required), type the host name or the fully qualified domain name (FQDN) of App

Controller as it appears on the Network Connectivity panel.

In Email , type the email address for the contact person at your company.

In Description , type a description for the CSR.

In Company name , type the name of your company or organization.

In Department name , type the name of the department that will use the certificate.

In City , type the name of the city in which your company or organization is located.

In State , type the full name of the state where your company is located.

In Country Code (required), select the code for your country, such as United States.

4. Click Save .

App Controller creates the CSR. A dialog box that contains the contents of the CSR opens

5. Copy the certificate contents from the dialog box and then paste the content into the appropriate area on the

Certificate Authority web site.

The certificate provider returns a signed certificate to you by e-mail. When you receive the signed certificate, install it on App Controller.

You can create up to three CSRs. You can view or delete existing CSRs, and you can also choose to sign a CSR so that you can use the certificate immediately.

citrix.com

To import a signed server certificate to App Controller

When you receive the signed certificate from the Certificate Authority (CA), you can upload the certificate to App

Controller. The file can be a Privacy Enhanced Mail (PEM) or Personal Information Exchange (PKCS#12) file, which includes both a server certificate and its password-protected private key.

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. Click Import and then select Server (.pem) to import a CA signed root certificate.

4. In the Upload dialog box, click Browse , navigate to the certificate and then click Open .

citrix.com

Installing Root Certificates on App Controller

After the Certificate Authority (CA) signs your server certificate, the CA returns it to you. If the CA provides the server certificate in PEM format, the CA might also send the root certificate. You need to install the root certificate on App

Controller along with the server certificate.

You might also need to install root certificates for applications you configure on App Controller. Each root certificate must match the fully qualified domain name (FQDN) of the server running the application.

To install a root certificate

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. Click Import and then select Trusted (.pem) to import a CA-signed root certificate.

4. In the Upload dialog box, click Browse , navigate to the certificate and then click Open .

citrix.com

To view the details of a certificate

If you encounter any problems with a certificate, you might want to verify the issuer of the certificate. You can see this information, as well as other details about every certificate you install on App Controller, in the App Controller management console.

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. Under All Certificates , select a certificate and then click Details .

4. In the dialog box that opens, view certificate details, subject name, and issuer name for the selected certificate and then click Close .

citrix.com

To export a certificate

You might need to export certificates when migrating to a new App Controller VM, backing up an App Controller VM, and sharing certificates between a pair of App Controller VMs used for high availability. You can export an existing server certificate and its corresponding password-protected private key to a file. You can only export certificates in

Privacy Enhanced Mail (PEM) format. You can also export a SAML certificate for use with applications that required an

App Controller SAML certificate, such as Google Apps.

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. In the table, select the certificate to export and then click Export .

4. In the Export Certificate dialog box, in Password and Confirm Password , type the password that will be used to encrypt the exported certificate and then click OK .

citrix.com

Configuring Certificates for SAML Applications

Some SAML applications, such as ShareFile, Google Apps, and Echosign, require a certificate to communicate with

App Controller. After you add the application in App Controller and configure application settings, you download a SAML certificate from App Controller. When you configure settings in the SAML application, you upload the certificate to the application. By doing so, you ensure secure connections between the application and App Controller.

App Controller supports installation of one SAML certificate on App Controller. When you first install App Controller, a

SAML certificate is created and appears in the Certificates panel.

The SAML certificate is called AppController.example.com

. If you want to use a custom SAML certificate, you need to upload a .pem certificate that contains only the certificate and private key.

Important: Do not include any chain certificates with the SAML certificate.

When you install the new SAML certificate, App Controller removes any previously installed certificates, including the

AppController.example.com SAML certificate created during App Controller installation. Only one SAML certificate can reside on App Controller.

You can download a SAML certificate by using one of the two following methods:

If you download the SAML certificate for backup, Citrix recommends creating a password to encrypt the certificate with a private key.

If you download the SAML certificate for use with SaaS applications, do not include the password. Private keys should not be included with the certificate in this instance.

To download a SAML certificate

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. Under Certificates > All Certificates , select the SAML certificate and then click Export .

4. In the Export Certificate dialog box, in Password and Confirm Password , enter the password for the certificate.

Only supply the password if you are backing up the certificate and storing it on your computer.

5. To export the private key with the certificate, click Export with private key and then click OK to save the certificate to your computer.

Select this option only if you are backing up the certificate.

6. Navigate to the location on your computer where you want to save the certificate and then click Save .

citrix.com

To install a certificate for an application

To allow users to establish communication with an application that communicates over SSL, such as Active Directory over secure LDAP, you need to install a root certificate on App Controller and then associate the certificate with the application. The root certificate validates the application server's identity and allows users to access the application. You must install a root certificate for each application you add to App Controller.

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Certificates .

3. Click Import and then click Saml (.pem) .

4. In the Upload dialog box, click Browse , navigate to the certificate on your computer, and then click Open .

citrix.com

Configuring Connections to ShareFile

ShareFile is a cloud-based file sharing service. The service provides a custom-branded, password-protected space where users can easily and securely exchange their data and documents.

ShareFile enables users to send large files by email, securely handle file transfers to third parties, and access a collaboration space from desktops or mobile devices. ShareFile provides users with a variety of ways to work, including a Web-based interface, desktop tools, and integration with Microsoft Outlook.

When you configure ShareFile in App Controller, you configure settings to connect to the ShareFile account and administrator service account for user account management. Then, you can connect to ShareFile from the App

Controller management console to configure administrator settings.

App Controller supports ShareFile StorageZones, which extend the ShareFile Software as a Service (SaaS) cloud storage by providing your ShareFile account with private data storage. ShareFile StorageZones also provides users with secure access to SharePoint sites and network file shares through StorageZone Connectors. For more information about ShareFile StorageZones, see the ShareFile documentation in eDocs.

Users connect to their documents and files by using the ShareFile application. To allow user access, you must configure the ShareFile application in App Controller.

The following steps enable user access to ShareFile:

1. Upload a SAML certificate to App Controller. For details, see Configuring Certificates for SAML Applications .

2. Configure the ShareFile administrator settings from the Apps & Docs tab in the App Controller management console.

3. Configure the ShareFile application on the Apps & Docs tab in the App Controller management console. For more information about configuring ShareFile application connectors, see List of Application Connectors with Additional

Parameters .

When you configure ShareFile application in App Controller, you can configure the following:

ShareFile domain, such as mycompany.sharefile.com

Roles for users from Active Directory

Workflows for user account management

Service account for user account management

If you have not created one or more roles in App Controller, when you configure ShareFile, you can select Not Assigned

. After you create roles, you can add the role to the ShareFile settings.

Important: The role you select should contain the same number of members for which you obtain licenses. For example, if you have 100 licenses, the role should contain the same amount of users. If you use the AllUsers role, which might have more Active Directory accounts than licenses, synchronizing accounts in ShareFile and App Controller might fail. If you previously selected the AllUsers role or a role with too many Active Directory accounts, you must manually remove the role from ShareFile and then add the new role.

To configure ShareFile administrator settings in App Controller

1. In the App Controller management console, click the Apps & Docs tab.

2. Under Apps & Docs > DOCS , click ShareFile .

3. In the details pane, next to ShareFile Configuration , click Edit .

4. In Domain , enter your Sharefile domain name, such as

acmesharefile.

sharefile.com.

You must enter the full domain name for Sharefile, such as mysharefile.sharefile.com.

5. In Assigned role , select the role to which you want to assign ShareFile.

Note: You must select a role. Citrix recommends that you do not use the AllUsers role for ShareFile. For more information, see Configuring Roles .

6. Under Service Account for Provisioning , configure the following settings for user account management: a. In User name , type the email address of the ShareFile service account.

The service account is the ShareFile administrator account.

b. In Password , type the password of the ShareFile service account.

7. Click Save .

After you configure ShareFile settings in App Controller, you can then configure settings on the ShareFile server by connecting to the ShareFile administrative account. These settings include:

User accounts

Administrators and super groups citrix.com

Super groups contain individuals who have administrative access and can change ShareFile settings.

These individuals are referred to as super users .

Distribution groups

Folders

ShareFile accounts on devices

For more information about configuring these settings, see the ShareFile documentation .

The Advanced Configuration link only appears after you configure ShareFile in the App Controller management console.

To connect to the ShareFile administrative account

1. In the management console, click the Apps & Docs tab.

2. Under Apps & Docs > DOCS , click ShareFile .

3. In the right pane, next to ShareFile Configuration , click Advanced Configuration .

The ShareFile settings page opens in a new browser window.

citrix.com

Connect Users

App Controller, along with StoreFront, enables the delivery of business applications on any device to any user and provides single sign-on (SSO) to Windows, web, mobile, and Software as a Service (SaaS) applications. You configure prepackaged SaaS and enterprise web application connectors in App Controller for SSO. You can also upload mobile apps to App Controller that appear in the store. Users can connect to App Controller with Citrix Receiver to access their apps and documents.

In an environment in which Receiver, StoreFront, and App Controller are deployed, the store is the service in StoreFront that aggregates applications from XenApp farms, XenDesktop sites, and App Controller. When users log on to

Receiver, applications from the store appear in Receiver. For more information about adding applications in App

Controller, see Configuring Applications for Single Sign-On .

When users log on by using Receiver for Web, a list of available applications appears in the web browser. If users log on by using any version of Receiver, they can access stores and see their applications in the self-service view or they can get their applications from the Start menu on a Windows-based device.

Application synchronization is enabled automatically. StoreFront 1.2 requires a SQL database. If you install StoreFront

1.2 as a standalone installation, the database must be on the same device as StoreFront. If you have multiple server groups, you can install the database on a separate server. If you install StoreFront 2.0, the database is not required.

If your users connect from a remote location, you can configure user connections to applications in App Controller through NetScaler Gateway. You create trust settings between App Controller and NetScaler Gateway.

This section contains information about the following:

Configuring App Controller to communicate with StoreFront.

Configuring App Controller to allow connections from NetScaler Gateway.

citrix.com

Sending App Controller Application Lists to Citrix Receiver

When you send App Controller application lists to Citrix Receiver, you can configure the access level users have for apps, desktops, and documents published in App Controller or StoreFront. You can configure one of the two following scenarios:

Users can connect with Receiver or Worx Home to App Controller only. In this scenario, users have access only to their mobile, web, and SaaS apps, stores, and web links that you configured in App Controller. When users start Receiver on their device, Receiver contacts App Controller to obtain a list of available resources.

Users can connect with Receiver to App Controller and to StoreFront. In this scenario, users have access to apps and documents from App Controller, as well as to published resources from XenApp and XenDesktop.

StoreFront aggregates applications from App Controller, XenApp farms, and XenDesktop sites. When users connect with Receiver, the resources you define in App Controller and StoreFront appear in the Receiver store.

This scenario works as follows:

StoreFront sends a request message to App Controller.

In the response to the request, App Controller sends the list of enterprise web applications and SaaS applications that are managed by App Controller.

As part of the request, StoreFront includes the user identifier (user ID or network ID) of the user who started

Receiver.

When App Controller receives the request data along with a user ID, App Controller returns the list of applications that are applicable to the role of the user as defined in App Controller.

If the user is not assigned to a specific role and is part of the AllUsers role, the applications that are not assigned to any role appear for that user.

If you configure categories in App Controller, the categories appear as icons in Receiver. For more information about categories, see Configuring Categories .

Receiver provides a mechanism through which users can request an account for an application. When the process is complete, App Controller creates the user account. The application then appears in Receiver.

For users to receive their application list, you need to do the following:

Create an authentication service for StoreFront.

Create a store in StoreFront.

Add stores to Receiver.

For more information about configuring StoreFront, see the StoreFront documentation in the eDocs library.

You can configure connections to StoreFront in App Controller by using Deployment settings on the Settings tab. You can choose one of the following Citrix Receiver deployment scenarios:

Default. The default setting configures connections to App Controller from Receiver.

StoreFront. When you add the StoreFront web address, App Controller creates the authentication token validation service setting and trust settings to allow users to successfully connect by using Receiver to all of their resources in App Controller, XenApp, and XenDesktop.

Authentication Server. This setting enables all connections to route through App Controller and then to

StoreFront.

NetScaler Gateway. When you choose this setting, NetScaler Gateway resides in the DMZ. When users connect with Receiver, the connection first goes to App Controller which proxies the connection to

StoreFront. StoreFront then authenticates users. Next, the connection is proxied through NetScaler Gateway and App Controller.

To configure App Controller to connect to StoreFront

1. In the management console, click the Settings tab to open System Configuration.

2. In the left pane, under System Configuration , click Deployment .

3. In the details pane, next to Deployment , click Edit .

4. Under StoreFront , in Enable , select Yes .

5. To have StoreFront authenticate users and then pass the connection App Controller, in Use as auth server , select Yes

6. In Web address , type the web address of StoreFront and then click Save .

citrix.com

If you want to use a different port number, type the web address as https://domainName.com:portNum. If you don't specify a port number, App Controller uses port 80 for HTTP and port 443 for HTTPS as the default port numbers.

When you save the StoreFront Web address, App Controller automatically creates the authentication token validation service URL of StoreFront.

Enabling Access to Windows-Based Apps from Worx Home or Receiver

You can configure trust settings in App Controller 2.8 to allow users to access their mobile, web, SaaS and Windowsbased apps through Receiver or Worx Home. For more information about configuring the trust settings, see To configure App Controller to connect to StoreFront .

1. In the management console, click the Apps & Docs tab.

2. In the left pane, under XenApp/XenDesktop , click Windows Apps .

3. Next to Win Apps Configuration , click Edit .

4. In Host , type the PNA site of the Web Interface or the fully qualified domain name (FQDN) or IP address of

StoreFront.

For example, enter storefront.johndoe.local.

5. In Port , enter the port of the Web Interface or for the server running StoreFront. The default port number is 443.

6. In Relative Path , enter the path to the Web Interface or StoreFront.

For example, for the Web Interface, enter /Citrix/PNAgent/config.xml

. For StoreFront, enter

/Citrix/Store/PNagent/config.xml.

7. Select Allow secure access to specify an HTTPS connection.

Keep in the mind the following scenarios that occur when you configure the preceding settings and deploy StoreFront on the Settings tab in the management console:

If you enable StoreFront, disable authentication in App Controller and then provide the StoreFront web address in App Controller, users can connect to their Windows-based apps. On the Apps & Docs tab, you configure Windows App settings by following the procedure in this topic. In this scenario, users can connect to App Controller with Worx Home and access mobile, web, SaaS, and Windows-based apps. If users connect with Receiver for Windows or Receiver for Mac, they can access apps in either StoreFront or App

Controller.

Note: If you have users who connect from a remote location and you disable StoreFront authentication as in the first scenario, NetScaler Gateway authenticates users. To allow NetScaler Gateway to authenticate users, you need to configure authentication settings on NetScaler Gateway and configure App Controller to connect to NetScaler Gateway. For details, see Configuring Authentication on NetScaler Gateway and App

Controller and NetScaler Gateway .

If you enable StoreFront and enable authentication in App Controller, you cannot configure Windows-based apps on the Apps & Docs tab. In this scenario, users cannot access Windows-based apps. When users connect, StoreFront authenticates users. If users connect with Worx Home to App Controller, they have access to mobile, web, and SaaS apps only. Users who connect with Worx Home do not have access to

Windows-based apps in StoreFront. Users who connect with Receiver must connect to StoreFront directly to access Windows-based apps.

If you disable StoreFront and disable authentication in App Controller, and you configure Windows App settings, users can access HDX apps when they connect with Worx Home and Receiver.

citrix.com

Connecting Users to Citrix Receiver

You can configure an email template to send an automatic email to users that lets them know that they can use Citrix

Receiver to access their documents and apps. You can also manually send the email to a group of users by providing their email addresses at any time.

The email template includes a link to the site where users can download Receiver. You can also attach a configuration file to the email. The file contains the settings that enable users to configure Receiver on their device.

To send the Receiver email

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Receiver Email Template .

3. In the right pane, next to Automatically send invite , click Edit .

4. In Send invite to employees as they are added to XenMobile App Controller , click Yes .

5. Do one or both of the following: a. To send the email automatically, you can edit the information in Subject and Message and then click Save .

b. To send the email manually, under Manually send invite , type the email addresses of the individuals to whom you want to send the email and then click Send .

Separate email address with commas.

6. To include the configuration file in the email, select

Downloading the Receiver Configuration File

The Citrix Receiver configuration file is an XML file that contains all the settings users need to connect to the App

Controller or StoreFront store. You can download the configuration file and save it to your local computer. Then, you can provide the file as a download link from your web site or you can email the file to users.

1. In the App Controller management console, click the Settings tab.

2. Under System Configuration , under Quick Links , click Download .cr file .

3. In the Opening receiverConfig.cr

dialog box, click Save File and then click OK The file downloads to your computer.

citrix.com

App Controller and NetScaler Gateway

Users can connect to enterprise web applications by using either the NetScaler Gateway Plug-in or Citrix Receiver.

Some web applications require the use of the NetScaler Gateway Plug-in to establish the full VPN tunnel in order to access applications in the secure network. If the enterprise web application requires a VPN connection, Receiver for

Windows and Receiver for Mac can detect if the NetScaler Gateway Plug-in is running. If the plug-in is not running,

Receiver can prompt the user with the option to start the plug-in.

If users connect with Receiver for iOS, you configure Secure Browse in NetScaler Gateway to allow VPN connections from these mobile devices. For more information about Secure Browse, see Allowing Access from Mobile Devices .

If users connect by using Receiver for Web and attempt to start an application that requires a VPN connection, the application does not start until users establish a VPN connection through NetScaler Gateway.

There are two steps for allowing connections to applications in the secure network through NetScaler Gateway:

Configuring NetScaler Gateway settings.

Specifying the application to accept connections from remote users.

To route user connections through NetScaler Gateway, you provide the following information:

Name for the appliance. This can be any name you choose.

FQDN for the callback URL that verifies that the request came from NetScaler Gateway. You use the same

FQDN to which users connect. App Controller appends the FQDN automatically with the authentication service URL. For example, the URL appears as https://NetScalerGatewayFQDN

/CitrixAuthService/AuthService.asmx.

Fully qualified domain name (FQDN) to which users connect, such as https://

NetScalerGatewayFQDN

Optionally, you can configure the following settings:

A logon type, such as domain only, security token only, both domain and security token.

No password requirement regardless of the logon type you choose.

An option to connect to StoreFront through a connection that first routes through App Controller and

NetScaler Gateway which proxies the connection.

You can select the web applications that require remote user connections through NetScaler Gateway. When you configure an application in App Controller, you select a check box that identifies that the web application is hosted in the internal network. This adds the VPN keyword to the application and allows the connection request through NetScaler

Gateway.

citrix.com

Configuring Applications and Trust Settings for NetScaler Gateway

If you have an application that runs on a server in your internal network and users who connect from the Internet, you can configure trust settings in App Controller to route the connection through NetScaler Gateway. You also configure the application connector to indicate that the application is hosted in your internal network. When users connect to the application, NetScaler Gateway routes the request to App Controller. The application then starts on the user device. For more information about configuring application connectors in App Controller, see Configuring Single Sign-On by Using

Application Connectors .

To configure connections to NetScaler Gateway

1. In the App Controller management console, click the Settings tab.

2. Under System Configuration , click Deployment .

3. In the details pane, under NetScaler Gateway , click Edit .

4. In Configure authentication from NetScaler Gateway if devices need to access App Controller remotely , select Yes to allow remote users to connect.

Note: If this is the first NetScaler Gateway or virtual server you are configuring, this setting moves to Yes automatically. If this is not the first NetScaler Gateway or virtual server you are configuring, you must manually select

Yes .

5. Click the plus (+) symbol to add an appliance. When you click the plus symbol, the fields in the next several steps appear.

6. In Alias , type a name that is easily recognizable.

7. In Display name , type the NetScaler Gateway name.

8. In Callback URL and External URL , enter the NetScaler Gateway web address. For example, enter https:

//mynetscalergateway.com.

You can specify the port number in the web address, such as https://mynetscalergateway.com:443.

When you add the web address to Callback URL , App Controller appends the URL automatically with the

NetScaler Gateway authentication service URL. For example, the URL appears as https://

NetScalerGatewayFQDN

/CitrixAuthService/AuthService.asmx.

9. Optionally, in Logon type , select one of the following:

Domain only. This setting requires users to enter their Active Directory credentials.

Security token only. This setting requires users to enter the code from a security token, such as an

RSA token.

Domain and security token. This setting requires users to enter domain credentials and the code from a security token.

Certificate. This settings requires a client certificate for authentication.

Certificate and Domain. This setting requires a client certificate and users to enter their Active

Directory credentials.

Certificate and security token. This setting requires a client certificate and for users to enter the code from a security token, such as an RSA token.

10. Optionally, select the Do not require passwords check box if you do not want to require users to enter a password.

11. Optionally, select Set as default to make this NetScaler Gateway the default appliance.

Note: You cannot delete the default NetScaler Gateway. You can either disable NetScaler Gateway entirely or make another NetScaler Gateway the default appliance.

12. Click Save .

To configure an application to allow NetScaler Gateway connections

1. In the management console, click the Apps & Docs tab.

2. Do one of the following: a. To edit an app, in the right pane, click an application from the list of All Apps and then click the pencil icon to edit the application.

b. To add an app, in the left pane, under Applications , click Web & SaaS , click the plus sign and then click an application from the catalog.

3. On the Details page, select App is hosted in internal network .

4. Click Next , configure settings on each subsequent page and then click Save .

citrix.com

Configuring App Controller to Provide STA Tickets for WorxMail

App Controller provides a ticketing service that is similar to the Secure Ticket Authority (STA) in XenApp and

XenDeskop. WorxMail uses the ticketing service to allow users to stay connected for long periods of time without requiring them to authenticate multiple times.

App Controller and NetScaler Gateway work together to provide the ticketing service for users' connections. You configure settings on NetScaler Gateway and then configure policy settings for WorxMail on App Controller.

To allow connections through NetScaler Gateway, you must configure the following on the appliance:

Virtual server that uses the SOCKS protocol for ICA connections

STA

When you configure the STA on NetScaler Gateway, you add the App Controller IP address or fully qualified domain name (FQDN) as the STA to the URL. For example, https://

myApp_Controller

/ where

myApp_Controller

is the IP address or FQDN of App Controller. You also need to define ports 80 and 443 to allow connections. For more information about configuring the STA in NetScaler Gateway, see Configuring the Secure Ticket Authority on NetScaler

You configure the following settings in App Controller:

WorxMail Exchange Server that is the FQDN of the Exchange server in the internal network.

WorxMail user domain that is your domain name.

Background network services that is a list of servers and ports. An empty list implies that users do not have access to background services.

Background services ticket expiration that is the amount of time before the ticket expires. Enter the number of days that the ticket is valid.

Background network service gateway is the alternate virtual server address and port on NetScaler Gateway that is used to connect by using the SOCKS protocol.

Tickets issued by App Controller are not intended for one time use. The setting Background services ticket defines how long the ticket is valid. When WorxMail sends the ticket to NetScaler Gateway for SOCKS connectivity, WorxMail might append a

#fqdn:port

parameter to the end of the ticket to identify to which server and port App Controller prefers to connect.

To configure WorxMail ticketing in App Controller

This procedure assumes that you have already installed WorxMail in App Controller.

1. In the App Controller management console, click the Apps & Docs tab.

2. Do one of the following:

To open WorxMail for iOS, in the navigation pane, click iOS MDX .

To open WorxMail for Android, in the navigation pane, click Android MDX .

3. In the details pane, click WorxMail and then click the pencil icon in the dialog box.

4. Click Next until you come to the Policies page.

5. Under Application Settings , do the following: a. In Worx Exchange Server , type the path to your Exchange server in the secure network.

b. In Worx user domain , type the domain name.

c. In Background network services , enter the servers and ports. You can use the format

serverFQDN:port

serverIPaddress:port

. Use a comma as a separator between servers and ports.

d. In Background services ticket expiration enter the number of days the ticket is valid. The default is 168 hours (7 days).

e. In Background network service gateway enter the FQDN or IP address of the NetScaler virtual IP address and the port number.

6. Click Save .

citrix.com

Configuring Connections to Device Manager

You can configure settings in App Controller enable a connection between App Controller and the XenMobile MDM component, Device Manager. Device Manager enables you manage mobile devices, set mobile policies and compliance rules, gain visibility to the mobile network, provide control over mobile apps and data, and shield your network from mobile threats. App Controller works with Device Manager to help provide managed apps to your unified app store. To configure connections to Device Manager, you need to configure App Controller settings in Device Manager first. For more information about Device Manager, see Device Manager .

Before you test the connection, you configure the following settings in App Controller:

Device Manager IP address or fully qualified domain name (FQDN)

Port on which App Controller and Device Manager communicate

Shared key that you configured on Device Manager

Instance path with is the path for service providers that use the Multi-Tenant Console or XenMobile MDM

Cloud Edition. The default path is /zdm.

You can make the connections between App Controller and Device Manager secure. You can also require user device enrollment with Device Manager.

After you configure settings in App Controller, test the connection in App Controller and Device Manager.

To configure connections to Device Manager

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click XenMobile MDM .

3. In the details pane, next to XenMobile Device Manager Configuration , click Edit .

4. In Host , enter the Device Manager IP address or FQDN.

5. In Port , leave the default of 80 or enter your own.

6. In Shared Key , enter the key you configured on Device Manager.

7. Select Allow secure access to secure the connection between App Controller and Device Manager.

8. Select Require Device Manager enrollment to require that all user devices are enrolled and managed by Device

Manager.

9. Click Test Connection to test the connection to Device Manager.

If the test fails, make sure your settings in App Controller and Device Manager match.

10. Click Save .

citrix.com

Configuring Logs

You can use the command-line console to configure logs to troubleshoot issues that may arise with App Controller. You can use the command-line console from the Console tab in either XenCenter or in vSphere. If you enable Secure Shell

(SSH) access, you can also open any command prompt, such as PuTTY, and log on to App Controller.

You can revert back to the default log level control, create a new log, or display the current log.

If you need to troubleshoot an issue, you can create logs for debugging by using class and group log levels. You set these parameters with Citrix Technical Support personnel.

You can configure logs by using the Logging menu. In the menu, you can:

Set class and group logging levels to include any of the following information:

Info

Warn

Debug

Fatal

Error

Reset the logging level to the App Controller default setting.

Create a new log file.

Show the log file.

To configure logs by using the command-line console

1. In the command-line console, in the Main

2. In the Troubleshooting

3. In the Logs menu, do one of the following:

Logs menu.

Troubleshooting menu.

(from 1 through 1,000) of the log you want to view.

citrix.com

To transfer logs to a network server

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, under System Configuration , click Log Transfer .

3. In the details pane, next to Log Transfer , click Edit .

4. In Server , type the path to the server in your network on which you want to store the logs.

5. In User name , enter the email address of the administrative account of the log server.

6. In Password and Confirm password , type the password for the administrative account.

7. In Transfer protocol , select the network protocol with which to transfer the logs.

8. In Port , enter the port number for the server in your network.

9. In Remote Directory , type the path to the directory of the server on which you want to store the logs.

10. Select Counters Export to add the counters for the Dashboard into the log file. The counters are added to the log file one time each hour.

11. In Archive Frequency (hours) and Transfer Frequency (hours) , enter the number of hours between log transfers.

12. Select Transfer archived log files automatically to transfer the files to the server automatically.

13. In Log Type , select one, some, or all of the following options:

Audit

Counters

Info

Note: If you select Audit , the Counters and Info logs are also sent to the network server.

14. Click Save .

citrix.com

To configure a syslog server in App Controller

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, under System Configuration , click SysLog .

3. In the details pane, next to SysLog , click Edit .

4. In Server , enter the path to the server where you want to store the log files.

You can use either the host name or the IP address.

5. In Port , accept the default port number of 514 or enter the port number for your syslog server.

6. In Facility , select the number to correspond with the part of the system from which the message originates.

7. Select either Info or Audit logs or select both options and then click Save .

Info logs are actions taken by App Controller. This level is useful for troubleshooting problems.

Audit logs contain a chronological record of system activities for App Controller.

Note: If you select both options, the logs contain all of the App Controller action information, as well as the chronological record of system activities.

citrix.com

Troubleshooting App Controller

App Controller provides tools to help you gather information to solve issues that may arise with your deployment. From the Troubleshooting menu from the Main Menu in the command-line console, you can use the following tools:

[0] Back to Main Menu. Return to the main command-line menu.

[1] Network Utilities. View routing tables, network information, and use traceroute and the PING command to check network connections.

[2] Logs. Configure log levels and download log reports to your computer.

[3] Support Bundle. Create a support bundle that contains system information, logs, database information, core information, trace files, and the latest configuration information for App Controller. You can select either the Secure Copy protocol (SCP) or the File Transfer Protocol (FTP) to transfer the support bundle to the remote server for your support personnel.

Capturing Network Settings for Troubleshooting

You can use the command-line console to view the following network details:

Network information for each network adapter on App Controller

The App Controller routing table that lists routes to network destinations

The Address Resolution Protocol (ARP) table information for App Controller

Detection of other networks by using the PING command

Network routes by using traceroute

The DNS name associated with an IP address by using DNS lookup

A network trace to provide to technical support personnel

To view network information for App Controller

1. In the command-line console, on the Main

2. In the Troubleshooting

3. In the Network menu, select one of the following options:

Troubleshooting menu.

Network Utilities menu.

4. Follow the command prompts for the selected option.

To return to the Troubleshooting

Creating a Support Bundle for App Controller

If you have a problem with App Controller, you can create a support bundle to send to technical support staff for evaluation. The support bundle contains the following information:

System information

App Controller logs

App Controller database information

App Controller core information

Trace files

App Controller most recent snapshot

To create a support bundle

2. In the Troubleshooting

3. In the Support Bundle

Troubleshooting menu.

Support Bundle menu.

citrix.com

When App Controller finishes creating the support bundle or overwriting a support bundle you previously created, you receive a message that contains the name of the support bundle. The name contains the date and time stamp, and the internal IP address of the appliance. The support bundle has the extension .support. For example, you might see the following as the name of the file:

20100823150921_10.199.240.168.support

. The section 20100823 is the date,

150921 is the time, and 10.199.240.168 is the IP address. When you create a support bundle, you can then use the

Secure Copy protocol (SCP) or the File Transfer Protocol (FTP) menu options to upload the bundle to a remote server for review by technical support staff.

To upload a support bundle by using either SCP or FTP

2. In the Troubleshooting

3. In the Support Bundle

3 4

Troubleshooting menu.

Support Bundle menu.

Configuring Logs by Using the Command-Line Console

1. In the command-line console, in the Main

2. In the Troubleshooting

3. In the Logs menu, do one of the following:

Logs menu.

Troubleshooting menu.

(from 1 through 1,000) of the log you want to view.

citrix.com

Configuring Roles

A role is a group of users to which you assign applications. You can use roles to assign groups from Active Directory in

App Controller. After you add Active Directory groups to a role, you then assign applications to the role. The basic steps for adding a role in App Controller are as follows:

Assign a name to the role.

Provide a description for the role.

Select one or more groups that exist within the domain you chose and add them to the role.

If users are members of multiple groups, you can choose if users must be members of all of the defined groups or if users can belong to some of the groups. For example, you have JohnD in the Sales,

Finance, and Marketing Groups. To access apps and data, you can require JohnD to be a member of all three groups. You can also allow JohnD to be a member of any of the groups to gain access to apps and data.

Select the ShareFile Storage Zone to which users have access.

You can assign web, SaaS, and mobile applications to a role. You can also assign web links to a role and add roles to

ShareFile settings.

Note: You must configure Roles before you configure ShareFile settings. You cannot use the AllUsers role for ShareFile.

After you configure roles, you configure the applications for single sign-on (SSO). You can then assign one or more applications to the roles. For example, you configure Sales, Marketing, and Finance roles in App Controller. After you configure the Salesforce and GoToMeeting application connectors, you might assign the Salesforce application to the

Sales role and you might assign GoToMeeting to all three roles.

Adding or Removing Roles

When you add a role, you assign one or more Active Directory groups to the role. You must have an active connection from App Controller to Active Directory to add a role. After you add groups to the role, you then assign applications to the role.

Note: You can only use the Assign Apps to Role link on the Roles tab when you create a role. You can also assign an app to a role by using the Configure App dialog box.

When you configure a role and add multiple Active Directory groups, you can require users to be a member of all groups or you can require membership in at least one of the selected groups.

When you delete a role, the role is removed from App Controller. If you need the role again, you need to configure a new role.

To add a role

1. In the App Controller management console, click the Roles tab.

2. Under Roles , click Add Role .

3. In the Add Role dialog box, in Role name , type a name for the role.

4. In Role description , enter a description of the role.

5. If you configured multiple domains in App Controller, in Domain , select the domain.

If only one domain is configured, this field appears as a label. If you configure multiple domains, the field appears as a drop-down list.

6. Under ShareFile Configuration , in Storage Zone , select the storage zone for the role.

Storage Zone only appears if you configure ShareFile in App Controller. If ShareFile is not configured, you can click the Sync icon to add the domain, user name, and password for ShareFile. When you click Discover , App

Controller retrieves the ShareFile Storage Zone. The Sync icon does not appear if you configure ShareFile in

App Controller.

7. Click Next .

8. In Group membership , do one of the following: a. Click AND to require role membership from all groups in order to access apps.

b. Click OR to require role membership in any of the selected groups in order to access apps.

9. Under Available groups , select the groups that you want to add to the role and then click the chevron (>) to move the groups to Role members .

10. Click Save .

citrix.com

To delete a role

1. In the App Controller management console, click the Roles tab.

2. In the navigation pane, under Roles , click the wrench icon for the role and then in the dialog box, click the X icon.

3. Click Yes to delete the role.

citrix.com

Viewing Members of Active Directory Groups

After you add Active Directory groups to a role, you can view the members of the Active Directory group.

To view Active Directory group membership

1. In the App Controller management console, click the Roles tab.

2. Under Roles , click a role and then click the wrench icon to the right of the role name.

3. In the pop-up dialog box, click the pencil icon.

4. In the Edit Role dialog box, click Next and then click the users icon next to the group name.

The list of users appear in the View Group Members dialog box. You can also view the details when you add groups to a role.

5. Click Close and then click Save if you made changes to the role. Otherwise, click Cancel .

citrix.com

Assigning and Removing Applications from a Role

You can add one or more applications to a role. Roles allow you to control who has access to applications in your organization. You can add a role when you configure the app or from the Roles panel. When you create a role, you assign users and then you assign apps. You must create one or more roles before you assign an application to a role.

You cannot assign an application to the default AllUsers role.

1. In the management console, click the Roles tab.

2. In the navigation pane, under Roles , select a role and then at the bottom of the left-hand menu, click Assign apps to role .

3. In the Assign Apps to Role dialog box, do one of the following: a. To add one application, under Available Apps , select the application and then click the single chevron (>) to move the application to Apps assigned to Role .

b. To add two or more applications, under Available Apps , press the CTRL key, select the applications and then click the single chevron to move the applications to Apps assigned to Role .

c. To add all applications in the list, under Available Apps select the applications and then click the double chevron (>>) to move all of the applications to Apps assigned to Role .

4. Click Save .

You can view applications assigned to roles on the Roles page. When you click a role, the applications appear under Applications Assigned to <roleName> . If you configure multiple roles, click the role to see the assigned apps.

To remove applications from a role

1. In the App Controller management console, click the Roles tab.

2. In the navigation pane, under Roles , click the role.

3. Under Applications assigned to < roleName > , hover over an application and then click the X in the upper-right corner.

citrix.com

Configuring Categories

App Controller enables users to access different types of applications, web links, and stores. When users connect with

Citrix Receiver or Worx Home, they can view all of their applications, web links, and stores and then select what they want to open.

When users log on by using Receiver or Worx Home, they receive a list of applications, web links, or stores. By using categories, you can sort items that allow users to access only the applications, stores, or web links that you want. For example, you can have a Finance category and add applications that only pertain to finance. Or, you can configure a

Sales category to which you assign sales applications. You can also configure an Apple category for the App Store.

You configure categories on the Apps & Docs page in App Controller. When you configure or edit a store, web link, or application connector, such as Box, during the configuration steps, you can select the category. For more information about adding categories to an application, see Configuring Single Sign-On by Using Application Connectors .

To add a category

1. In the management console, click the Apps & Docs tab.

2. In All categories drop-down box, click the plus sign (+).

3. In the Add Category dialog box, in Name , type a name for the category.

4. In Description , add a description for the category and then click list.

To delete a category

1. In the management console, click the Apps & Docs tab.

2. In the All categories drop-down box, hover over the category and then click the X next to the category.

3. Click Yes to confirm the category deletion.

citrix.com

Configuring Workflows

You can use workflows to manage the creation and removal of user accounts. Before you can use a workflow, you need to identify individuals in your organization who have the authority to approve user account requests. Then, you can use the workflow template to create and approve user account requests.

When you configure App Controller for the first time, you configure workflow email settings. You must configure workflow email settings to use workflows. You can change workflow email settings at any time by using the System

Configuration panel in App Controller. These settings include the email server, port, email address, and whether the request to create the user account requires approval or not.

You can configure workflows in two places in App Controller:

On the Workflows tab in the App Controller management console. On the Workflows tab, you can configure multiple workflows for use with application connectors. When you configure workflows from this tab, you can select the workflow when you configure the application.

When you configure an application connector. In the application, you provide a workflow name and then configure the individuals who can approve the user account request.

You can assign up to three levels for manager approval of user accounts. If you need other individuals to approve the user account, you can search and select additional approvers by using the person's name or email address. When App

Controller finds the individual, you then add the person to the workflow. All individuals in the workflow receive emails to approve or deny the new user account.

citrix.com

To create and manage workflows in the management console

1. In the App Controller management console, click the Workflows tab.

2. On the Workflows tab, in the details pane, click Add Workflow .

3. In Workflow name , type a name for the workflow.

4. Optionally, in Description , type a description for the workflow and then click Next .

This is an optional field.

5. Under Manager Approvals , in Levels of manager approval , select the number of levels required for manager approval of the user account.

6. Under Additional Approvers , in Enter additional required approvers , enter the name of the approver.

Approver names are from Active Directory.

7. When the approver's name appears in the text field, click the name and then click the plus (+) symbol.

The approver's name and email address appears in Selected Approver .

8. Click Save .

The workflow appears in the management console.

After you create the workflow, you can view the workflow details, view the apps associated with the workflow, or delete the workflow. You cannot edit a workflow after you create the workflow. If you need a workflow with different approval levels or approvers, create a new workflow.

To view details of the workflow

1. In the App Controller management console, click Workflows at the top of the page.

2. On the Workflows tab, in the details pane, select a workflow and then under Actions , click the workflow details icon.

The details of the workflow appears.

3. Click Close .

To view applications assigned to a workflow

1. In the App Controller management console, click Workflows at the top of the page.

2. On the Workflows tab, in the center pane, select a workflow and then under Actions , click the apps icon.

The apps associated with the workflow appear.

3. Click Close .

To delete a workflow

1. In the App Controller management console, click Workflows at the top of the page.

2. On the Workflows tab, in the center pane, select a workflow and then under Actions X

3. Click OK to delete the workflow.

citrix.com

To configure workflow email settings

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, under System Configuration , click Workflow Email .

3. In the details pane, next to Workflow Email , click Edit .

4. In Email server , type the name of the email server where user email accounts reside.

5. In Port , type the port number.

The default is port 25.

6. In Email , type the email address of the service account and then click Save .

The service account is the administrative account you use to log on to Active Directory.

7. Optionally, select Authentication required if approvers must log on to the email server before sending workflow email and then enter the following: a. In Login name , type the approver's user name.

b. In Password and Confirm Password , type the approver's password.

8. Click Save .

citrix.com

Mobile Apps

App Controller supports iOS and Android apps, including Worx apps, such as WorxMail and WorxWeb, and the use of

MDX policies. In addition to the Worx apps, you can add the following types of mobile apps to App Controller:

Apps you develop for your users

Apps in which you want to allow or restrict device features by using MDX policies

You can wrap mobile apps with the MDX Toolkit and then upload the apps to App Controller. When you upload the app, you can configure the following settings:

Details of the app, including version and URL

Approval workflow for the app

Approvers for the app if you create a workflow

MDX policies

This section discusses mobile apps and Worx apps.

Searching for Applications

You can search the web, SaaS and mobile application catalog to locate the application you want to add to App

Controller.

There are two ways you can search for applications on the Apps & Docs tab:

From the All Apps tab. This option searches all applications configured in App Controller.

From application catalog on the Web & SaaS tab. This option searches for applications in the catalog.

When you start to enter the search string next to the magnifying glass icon in the details pane or the application catalog,

App Controller displays a list of apps the either start with or contain the letters you type.

For the applications you have added to App Controller, if you configure roles and assign applications to a role, on the

Roles tab, you can search for the app in the role. You can quickly see which role the app is assigned to and make any necessary changes.

To search for an application in the catalog

1. In the App Controller management console, click the Apps & Docs tab.

2. In the navigation pane, click Web & SaaS .

3. In the details pane, click the plus (+) sign.

4. In Catalog , in Search catalog , type the search string and then click the app to configure settings.

To search for applications assigned to roles

1. In the App Controller management console, click the Roles tab.

2. In the navigation pane, under Roles , click a role.

3. In the details pane, in Search apps , type the search string.

The app appears in the right pane.

citrix.com

Adding Mobile Apps to App Controller

You can add native apps to App Controller for Android and iOS. Native apps as opposed to web apps, are apps that are locally installed and are programmed to be compatible with the language and operating system of the user device on which the app is installed.

You can also allow secure user access to HTML5 apps through Citrix Receiver to data stores in the internal network.

When users log on with Receiver from an Android, iPad, or iPhone device, they can download and install the selected app on their device. This provides users with access to the business applications they need at any time.

You use the Citrix MDX Toolkit to create MDX mobile apps. The MDX Toolkit inserts logic and policies into each mobile app. When you upload a mobile app to XenMobile App Edition, the app is validated during installation. You can upload mobile apps that have the extension .mdx.

When the installation is complete, you can then configure specific application details and policy settings in the App

Controller management console. Receiver enforces the policies that the MDX Toolkit configured and that you set in App

Controller. You can run the MDX Toolkit on Mac OS X Version 10.7 (Lion) and Version 10.8 (Mountain Lion) only.

You configure application details and policy settings in the management console from the Apps & Docs tab.

After you configure the app details and policy settings, the mobile app appears on the Apps & Docs page in the Android or iOS tabs in the left pane. The mobile apps also appear in All Apps in the left pane. The apps are then available for authorized users to download and install on their device.

citrix.com

Connecting to the Worx App Gallery

Citrix hosts the Worx App Gallery on the Citrix web site. The Worx App Gallery provides information about the vendors partnered with Citrix to provide MDX mobile apps. The Worx App Gallery contains descriptions of the mobile apps and from where you can obtain the apps: the Apple App Store or Google Play.

When you download the MDX mobile app from the App Store or Google Play, save it to your computer and then upload the app to App Controller. When you upload the MDX mobile to App Controller, you then configure settings and policies for the app.

To connect to the Worx App Gallery

1. In the App Controller management console, click the App & Docs tab.

2. Under APPS , click App Marketplace .

The App Center opens.

citrix.com

Retrieving Mobile App Names and Descriptions

You can configure settings to retrieve mobile app names and descriptions from the Apple App Store and Google Play.

When you retrieve the app information from the store, App Controller overwrites the existing name and description.

You can configure public app store settings from the Apps & Docs tab in App Controller. When you finish configuring the mobile link, the link appears as an icon in the store in App Controller. When users log on with Citrix Receiver, the app appears with the name and description from the App Store or Google Play.

In the App Controller management console, you provide the following information:

Name for the link

Description of the link

Web address

Type of mobile link as iOS or Android

Category

Role

Image, in .png format (optional)

To configure a Web link

1. In the App Controller management console, click the Apps & Docs tab.

2. In the left pane, under Apps & Docs > APPS , click Web Link and then click the plus sign (+) in the details pane.

3. In the Configure App dialog box, complete the following: a. In App Name , type a name for the link.

b. In Description , type a description of the link.

c. In URL , enter the full Web address of the site, such as http://www.citrix.com.

d. If applicable, select the App is hosted in the internal network check box.

e. If applicable, select Require app installation if users save the link on their device.

f. In Category , select the category in which the link appears in Citrix Receiver.

g. In Assigned Role , select the role. This is a mandatory field.

h. In Image , select Use default to use the default Citrix logo or select Upload to add your own logo to the logon page.

i. If you want to upload your own logo, click Browse and then navigate to the logo on your device.

Note: The graphic you upload must be the type PNG. You cannot upload a GIF or JPEG graphic. You can upload a custom graphic when you create a web link. After you save the web link, you cannot change the graphic.

j. Click Save .

citrix.com

Upgrading a Mobile App in App Controller

If a new version of a mobile app becomes available, you can upload the new version to XenMobile App Edition. When you receive the updated app, disable the app in App Controller and then upgrade the app by clicking the upgrade icon in the app dialog box.

To upgrade a mobile app

1. In the management console, click the Apps & Docs tab.

2. In the right pane, click the mobile app and then in the dialog box, click the green disable button. When you click the button, App Controller disables the app and the button turns gray.

3. Click the mobile app and then in the dialog box, click the upgrade icon.

4. In the Upgrade Mobile App dialog box, under Select an MDX file to upload , click Browse .

5. Navigate to the app on your computer, click Open and then click .

When App Controller is finished, the Mobile App Details dialog box opens and allows you to configure details and policy settings for the app. These settings are the same as the settings you configure when you upload the app for the first time. After you configure and save the settings, click the mobile app and then click the gray enable button. App

Controller enables the app and users receive a message to upgrade the app on their device.

citrix.com

Maintaining and Upgrading Applications, Web Links, and Stores

If you need to make changes, you can disable the following applications, links, and stores in App Controller:

Web or SaaS applications. You can change the URL, category or role.

Android or iOS mobile apps. You can edit and save the settings, and you can upgrade the app. If you upgrade a mobile app, you can also configure when users must upgrade the app on their device. You can force users to upgrade immediately or you can provide warnings indicating how long users have until they have to upgrade.

Web links. You can change the URL, category or role.

Public app stores. You can change the URL, category, assigned role, or require installation.

If you need to change the settings of an application, web link or store, you can disable and then edit the settings, which puts the application, web link, or store in maintenance mode. For example, you might want to add a workflow or change policy settings. You can disable the app to prevent users from connecting to the app while you are making changes. It is not required, however, that you put applications, web links, or stores in maintenance mode to make changes.

You can disable any store, web link or web, mobile, or SaaS application. When you disable any of these items in App

Controller, the application or link becomes unavailable on the user device. If users connect with Worx Store, the item is not available. If users connect with Worx Home, the app, store, or web link appears on the user device. Users, however, cannot open the item when it is disabled. When you change settings, save your changes, and then enable the item, it becomes available again on the user device. If users are logged on when you disable the store, application, or web link, they can continue to use item even though it is in maintenance mode. If users log off, they cannot start the item again until you enable the item in App Controller.

When you enable the application or web link after making changes, the new settings are applied the next time users start the application.

To disable or enable an application, web link, or store

You can disable an application, store or web link to change settings. For iOS and Android apps, you can also disable the app to upload an upgrade and change settings. If an app, store, or web link is enabled, the Enable or Disable icon appears green. When you disable an app, store, or web link, the icon turns gray.

1. In the App Controller management console, click the Apps & Docs tab.

2. In the navigation pane, under Apps & Docs > APPS , click one of the following:

Android MDX iOS MDX

Public App Store

Web & SaaS

Web Link

3. In the details pane, click an item and then click the Enable or Disable icon.

The application, store, or web link icon turns gray to show it is disabled.

4. Click the application, store, or web link and then click the pencil icon to edit the application.

5. Change the settings and then click Save .

6. Click the application, store, or web link and then click the Enable or Disable icon.

citrix.com

MDX Policies for Mobile Apps

You can configure MDX policies for mobile apps, including the WorxMail and WorxWeb apps. The policies you can configure depend on the mobile app and the mobile device. You configure the policies after you wrap the app with the

MDX Toolkit and when you upload the app to AppController 2.5 or 2.6, or App Controller 2.8.

When you upload a mobile app to App Controller, the following app details appear on the Details page. When the app is wrapped, the person wrapping the app defines some settings. Citrix recommends that you do not change the fields that contain app information, such as the app name, description, and version.

App name. The name of the app.

Description. A description of the app.

Application type. The platform on which the app can run.

Application version. The internal version number of the app.

Minimum OS version. The minimum operating system version on which the app can run.

Maximum OS version. The maximum operating system version on which the app can run.

Excluded devices. The device types on which the app cannot run. You must define iPhone or iPad and not the specific version of the device, such as iPad 3 or iPhone 4S. For Android devices, you need to specify the manufacturer and phone model, such as Samsung HTC or Motorola Droid Razr M.

Category. Where the app appears in Receiver.

Assigned role. The role assigned to the app. The role defines the Active Directory groups from which users are obtained. You must select a role.

On the Workflow page, you can either create a new workflow or select a workflow you configured by using the Workflows tab in the management console. If you use an existing workflow, when you click Next , you go to the Policies page where you configure the policies as described earlier in this topic If you are creating a new workflow, when you click Next , you go to the Manager Approvals page where you can configure the levels of approvers and any additional approvers.

Configuring MDX Policies for WorxMail

You can configure the following policies for WorxMail apps on both Android and iOS devices:

WorxMail Exchange Server. The fully qualified domain name (FQDN) for Exchange Server. Default is empty.

WorxMail user domain. The default Active Directory domain name for Exchange users. Default is empty.

Background network services. The FQDN and of the ActiveSync server, such as servername:443. This might be an Exchange Server, either in your internal network or in another network that WorxMail connects to, such as mail.mycompany.com:4443. If you configure this policy, set the Network access policy to

Tunneled to the internal network . This policy takes affect when you configure the network access policy. In addition, use this policy when the Exchange Server resides in your internal network, or if you want to use

NetScaler Gateway to proxy the connection to the internal Exchange Server.

Background ticket expiration. The time period that a background network service ticket remains valid. When

WorxMail connects through NetScaler Gateway to an Exchange Server running ActiveSync, App Controller issues a token that WorxMail uses to connect to the internal Exchange Server. This property setting determines the duration that WorxMail can use the token without requiring a new token for authentication and the connection to the Exchange Server. When the time limit expires, users must log on again to

Receiver to generate a new token. Default value is 168 hours (7 days).

Background network services gateway. This is the NetScaler Gateway FQDN and port number with which

WorxMail uses to connect to the internal Exchange Server. The format is "fqdn:port". In the NetScaler

Gateway configuration utility, you must configure the Secure Ticket Authority (STA) and bind the policy to the virtual server. The default value is empty, implying that an alternate gateway does not exist. If you configure this policy, set the Network access policy to Tunneled to the internal network . This policy takes affect when you configure the network access policy. In addition, use this policy when the Exchange Server resides in your internal network or if you want to use NetScaler Gateway to proxy the connection to the internal Exchange Server.

For the complete list of MDX policies, see Configuring MDX Policies for Android Apps in App Controller and Configuring

MDX Policies for iOS Apps in App Controller .

citrix.com

Configuring MDX Policies for Android Apps in App Controller

You can configure the following policies in App Controller 2.8 for apps that run on Android devices.

Policies to Limit App Interaction

Security Group

The name of security group to which the app belongs. Leave this field blank if you want all XenMobile App Edition managed mobile apps to exchange information with one another. Define a security group name to manage security settings for specific sets of apps (for example, Finance or Human Resources).

Cut and Copy

Blocks, permits, or restricts Clipboard cut and copy operations for the app. When you choose Restricted , the copied

Clipboard data is placed in a private Clipboard that is only available to MDX apps. Default is Restricted .

Options: , , or Restricted

Document exchange (Open In)

Blocks, permits, or restricts document exchange operations for the app. When you choose Restricted , documents can be exchanged only with other MDX apps. Default is Restricted .

Options: , , or Restricted

Policies to Set App Restrictions

Disable diagnostic logging

If On , disables diagnostic logging. Default is On .

Block camera

Prevents access to the camera. Default is On .

Block mic record

Prevents access to the microphone for recording. Default is On .

Block location services

Prevents the use of location services (GPS or network). Default is On .

Block SMS compose

Prevents app use of SMS (compose). Default is On .

Block screen capture

Prevents or permits a user-initiated screen capture operation while the app is running. Default is On.

Block device sensor

Prevents or permits an app to use the device sensors, like accelerometer, motion sensor, or gyroscope. Default is On.

Policies for App Settings

The following policies establish email settings and apply to WorxMail and WorxWeb.

Background network services

Background services ticket expiration

Background network services gateway

WorxMail Exchange Server

The fully qualified domain name (FQDN) for Exchange Server. Default is empty.

WorxMail user domain

The default Active Directory domain name for Exchange users. Default is empty.

Background network services

The FQDN and of the ActiveSync server, such as

servername:443

. This might be an Exchange Server, either in your internal network or in another network that WorxMail connects to, such as

mail.mycompany.com:4443

. If you configure this policy, set the Network access policy to Tunneled to the internal network . This policy takes affect when you configure the network access policy. In addition, use this policy when the Exchange Server resides in your internal network or if you want to use NetScaler Gateway to proxy the connection to the internal Exchange Server. This policy is only available for WorxMail.

Background services ticket expiration

The time period that a background network service ticket remains valid. When WorxMail connects through NetScaler

Gateway to an Exchange Server running ActiveSync, App Controller issues a token that WorxMail uses to connect to the internal Exchange Server. This property setting determines the duration that WorxMail can use the token without requiring a new token for authentication and the connection to the Exchange Server. When the time limit expires, citrix.com

users must log on again to Receiver to generate a new token. Default value is 168 hours (7 days). This policy is only available with WorxMail.

Background network services gateway

This is the NetScaler Gateway FQDN and port number with which WorxMail uses to connect to the internal Exchange

Server. The format is "fqdn:port". In the NetScaler Gateway configuration utility, you must configure the Secure Ticket

Authority (STA) and bind the policy to the virtual server. For more information about configuring the STA in NetScaler

Gateway, see Configuring the Secure Ticket Authority on NetScaler Gateway . The default value is empty, implying that an alternate gateway does not exist. If you configure this policy, set the Network access policy to Tunneled to the internal network . This policy takes affect when you configure the network access policy. In addition, use this policy when the Exchange Server resides in your internal network or if you want to use NetScaler Gateway to proxy the connection to the internal Exchange Server. This policy is only available with WorxMail.

Policies to Address Authentication

Authentication

Determines if the app requires enterprise logon to run. Default is Offline access permitted after challenge .

Options:

Network logon. Requires Worx Home sign on to securely use the app. If you set the policy to require network logon, when users try to open an app, the following message appears: Sign on to Worx

Home to securely use this app.

Offline access permitted after challenge. The app prompts for enterprise logon when possible, but allows offline use after the password challenge.

Offline challenge only. Allows the app to run with an offline password challenge.

Not required. Does not require user authentication.

Note: After the maximum offline period for the app expires, Receiver logon will be required regardless of the policy setting.

Maximum offline period (hours)

Defines the maximum period an application can run offline without requiring a enterprise logon for the purpose of entitlement and refreshing policies. Default is 72 hours (3 days).

Regardless of app logon requirements, this is maximum time between Receiver logons in order reconfirm entitlement and refresh policies. The minimum time you can configure is 1 hour. Users are reminded to log on at 30, 15, and 5 minutes before the period expires. After expiration, the app is locked until users log on.

Note: If the Authentication policy is set to Network logon , this setting is ignored with no offline access allowed.

Reauthentication period (hours)

Defines the period before a user is challenged to authenticate again. Default is 8 hours. A setting of 0 (zero) prompts for logon each time the app is started or reactivated.

Policies to Determine Device Security

Block jailbroken or rooted

The app is locked when the device is jailbroken (iOS) or rooted (Android). Default is On .

Options:

On. The app is locked when the devices is jailbroken or rooted.

Off. The app can run on a jailbroken or rooted device.

Require device encryption

If true , the managed application is locked if the device does not have encryption configured. If false , the app is allowed to run even if the device does not have encryption configured. Default is Off.

Require device pin or password

If true , the app is locked if the device does not have a PIN or password configured. If false , the app is allowed to run even if the device does not have a PIN or password set. Default is Off.

Require device pattern screen lock

If true , the app is locked if the device does not have a pattern screen lock configured. If false , the app is allowed to run even if the device does not have a pattern screen lock set. Default is Off.

Note: This policy is only enforced if the Require device pin or password setting is Off .

Policies for Encryption

Encryption keys

Ensures that access to keys and the associated encrypted content. Default is Offline access permitted .

Option: citrix.com

Offline access permitted. Android devices permit offline access only. Secrets used to derive encryption keys may be persisted on the device.

Note: If you select Offline access permitted , Citrix recommends that you set the authentication policy to Offline challenge only in order to protect access to the keys and the associated encrypted content.

Private file encryption

Controls the encryption of private data files in the following locations: /data/data/appname and

/mnt/sdcard/Android/data/appname. Default is Application .

Options:

Disabled. Encryption is turned off.

SecurityGroup. Encrypts private files by using a key shared by all MDX applications in the same security group.

Application. Encrypts private files using a key unique to the application.

Private file encryption exclusions

Contains a comma-separated list of file paths. Each path is a regular expression that represents one or more files that should not be encrypted. The file paths are relative to the internal and external sandboxes. Default is empty.

Non-standard external storage locations

Contains a comma-separated list of non-standard external storage. Different devices may use different paths for SD cards and so on. The standard external storage location for Android (typically, /mnt/sdcard) is automatically recognized and does not need to appear on this list.

Access limits for public files

Contains a comma-separated list. Each entry is a regular expression path followed by (NA), (RO), or (RW). Files matching the path are limited to No Access, Read Only, or Read Write access. The list is processed in order and the first matching path is used to set the access limit. Default is empty.

Public file encryption

Controls the encryption of public files. Default value is Security group .

Options:

Disabled. Does not encrypt public files.

Security group. Encrypts public files by using a key shared by all MDX applications in the same security group.

Application. Encrypts public files using a key unique to this application.

Public file encryption exclusions

Contains a comma-separated list of file paths. Each path is a regular expression that represents one or more files that should not be encrypted. The file paths are relative to the default external storage and to any explicitly listed external storage.

Public file migration

This policy is enforced only when public file encryption is enabled (changed from the Disable option tothe

SecurityGroup/Application option). This policy is applicable only to existing, unencrypted public files and specifies when these files are encrypted. Default value is Write(WO/RW) .

Note: New files or overwriting existing unencrypted files encrypts the replacement files in every case.

Caution: Encrypting an existing public file makes the file unavailable to other applications that do not have the same encryption key.

Options:

Disabled. Does not encrypt existing files.

Write (RO/RW). Encrypts the existing files only when they are opened for write-only or read-write access.

Any. Encrypts the existing files when they are opened in any mode.

Policies for Miscellaneous Situations

App update grace period (hours)

Defines the grace period during which users may use an app after the system has discovered that an app update is available. Default is 168 hours (7 days). If 0, the update must be applied immediately.

Note: Citrix recommends using a value other than zero (0). A zero (0) value would immediately prevent users, without warning, from using a running app until they download and install the update. This could lead to a situation in which users are forced to exit the app and potentially losing work.

Auth failures before lock

Locks the app after the specified number of consecutive offline logon failures and prompts user to log on. Default is 5 failures. If you enter 0, the app does not lock no matter how many times users enter incorrect credentials

Erase app data on lock

Erases data and resets the app when the app is locked. Default is Off .

citrix.com

Options:

On. App data is automatically erased when the app is locked.

Off. App data is not erased automatically when the app is locked.

An app can be locked for any of the following reasons:

Loss of app entitlement for the user.

Removal of app subscription.

Removal of Receiver account.

Uninstallation of Receiver.

Too many app authentication failures.

Rooted device and policy restricting the app to run on such a device.

Other administrative action to lock device.

Active poll period (minutes)

Determines how often XenMobile App Edition is polled to determine the current app (enabled or disabled) and device

(lock or erase) status. When a device has network connectivity, polling allows the running app to detect and respond to changes in the app state. Default is 60 minutes (1 hour).

Important: Only set this value lower for high-risk app or performance may be affected.

Policies on Network Access and Requirements

Network access

Prevents, permits or redirects app network activity. App blocks network use or restricts it to an applicationspecific tunnel gateway. Default is Blocked .

Options:

Unrestricted. Allows unrestricted access to the internal network.

Blocked. When blocked, the app behaves as if the device has no network connection. All network access is blocked.

Tunneled to the internal network. A per-app VPN tunnel through NetScaler Gateway to the internal network is used for all network access.

Note: This setting requires Receiver logon.

Require WiFi

Determines if the device requires a WiFi connection in order for an app to run. Default is Off .

Options:

On. The app is locked when the device is not connected to a WiFi network.

Off. The app can run even if the device does not have an active WiFi connection, such as 4G/3G or a

LAN connection.

Require internal network

The app requires a connection to a network within the organization. Default is Off .

Options:

On. The app is blocked when the device is not connected to an internal network.

Off. The app can run from an external network.

Internal WiFi networks

The app requires a connection to one of the specified wireless networks. Separate the network Service Set Identifier

(SSID) with commas. The default is an empty list. If the list is empty it indicates that users can connect to any internal

WiFi network. If users log on from an external network (or they are not logged on), this policy is not enforced.

citrix.com

Configuring MDX Policies for iOS Apps in App Controller

You can configure the following policies in App Controller 2.8 for apps that run on iOS devices.

Policies to Limit App Interaction

Cut and Copy

Blocks, permits, or restricts Clipboard cut and copy operations for the app. When you choose Restricted , the copied

Clipboard data is placed in a private Clipboard that is only available to MDX apps. Default is Restricted .

Options: , , or Restricted

Paste

Blocks, permits, or restricts Clipboard paste operations for the app. When you choose Restricted , the pasted

Clipboard data is sourced from a private Clipboard that is only available to MDX apps. Default is Unrestricted .

Options: , , or Restricted

Document exchange (Open In)

Blocks, permits, or restricts document exchange operations for the app. When you choose Restricted , documents can be exchanged only with other MDX applications. Default is Restricted .

Options: , , or Restricted

Allowed URLs

Filters the outbound URLs that are passed from this app to other apps for handling. By leaving the setting blank, all

URLs are blocked, except for the following: http:=ctxmobilebrowser: https:=ctxmobilebrowsers:

+citrixreceiver: +tel:

Enter a comma-separated list of patterns in which each pattern may be preceded by a Plus Sign (+) or Minus

Sign (-). Inbound URLs are compared against the patterns in the order listed until a match is found. When a match is found, the prefix dictates the action as follows:

A Minus Sign (-) prefix. Blocks the URL from being passed to another app.

A Plus Sign (+) prefix. Permits the URL to be passed to another app.

No prefix. Assumes the URL can be passed into another app.

The following table contains examples of allowed URLs:

^mailto:=ctxmail: All mailto: URLs open in WorxMail.

^http:=ctxmobilebrowser:

^https:=ctxmobilebrowsers:

All HTTP URLs open in WorxWeb.

All HTTPS URLs open in WorxWeb.

^tel:

-//www.dropbox.com

Allows user to make calls.

Blocks Dropbox URLs dispatched from managed apps.

+^COL-G2M:

-^SMS:

+^webex , +^wbx

Permits managed apps to open the GoToMeeting client app.

Blocks the use of a messaging chat client.

Permits managed apps to open the WebEx client app.

This policy is available only for iOS apps.

App URL schemes

Mobile iOS apps can dispatch URL requests to other apps that have been registered to handle specific schemes, such as http://. This feature enables an app to pass requests for help to another app. The App URL schemes policy serves to filter the schemes that are actually passed into the app for handling (that is, inbound URLs). Default is All registered app URL schemes are blocked .

citrix.com

Enter a comma-separated list of patterns in which each pattern may be preceded by a Plus Sign (+) or Minus

Sign (-). Inbound URLs are compared against the patterns in the order listed until a match is found. When a match is found, the prefix dictates the action as follows:

A Minus Sign (-) prefix. Blocks the URL from being passed into the app.

A Plus Sign (+) prefix. Permits the URL to be passed into the app.

No prefix. Assumes the URL can be passed into the app.

If an inbound URL does not match any pattern in the list, the URL is blocked.

The following table contains examples of App URL schemes:

Scheme App that requires the URL scheme

Purpose ctxmobilebrowser WorxWeb Permit WorxWeb to handle HTTP: URLs from other apps.

ctxmobilebrowsers ctxmail

WorxWeb

WorxMail

Permit WorxWeb to handle HTTPS:

URLs from other apps.

Permit WorxMail to handle mailto: URLs from other apps.

COL-G2M wbx

GoToMeeting

Webex

Permit a wrapped GoToMeeting app to handle meeting requests.

Permit a wrapped WebEx app to handle meeting requests.

This policy is available only for iOS apps.

Policies to Set App Restrictions

Block camera

Prevents access to the camera. Default is On .

Block mic record

Prevents access to the microphone for recording. Default is On .

Block location services

Prevents the use of location services (GPS or network). Default is On .

Block SMS compose

Prevents app use of SMS (compose). Default is On .

Block email compose

Prevents an app access to email (compose). Default is On .

Block iCloud

Prevents the use of iCloud features for Cloud-based backup of app settings and data. Default is On .

Block AirPrint

Prevents access to printing by using AirPrint features to print to AirPrint-enabled printers. Default is On .

Policies for Email Settings

The following policies establish email settings and apply to WorxMail or WorxWeb apps.

WorxMail Exchange Server

The fully qualified domain name (FQDN) for Exchange Server. Default is empty.

WorxMail user domain

The default Active Directory domain name for Exchange users. Default is empty.

Background network services

The FQDN and of the ActiveSync server, such as

servername:443

. This might be an Exchange Server, either in your internal network or in another network that WorxMail connects to, such as

mail.mycompany.com:4443

network or if you want to use NetScaler Gateway to proxy the connection to the internal Exchange Server. This policy is only available for WorxMail.

Background services ticket expiration

The time period that a background network service ticket remains valid. When WorxMail connects through NetScaler

Background network services gateway

This is the NetScaler Gateway FQDN and port number with which WorxMail uses to connect to the internal Exchange

Server. The format is "fqdn:port". In the NetScaler Gateway configuration utility, you must configure the Secure Ticket

Authority (STA) and bind the policy to the virtual server. For more information about configuring the STA in NetScaler

Policies to Address Authentication

Authentication

Determines if the app requires enterprise logon to run. The default is Offline access permitted after challenge .

Options:

Network logon. Requires Worx Home sign on to securely use the app. If you set the policy to require network logon, when users try to open an app, the following message appears: Sign on to Worx

Home to securely use this app.

Offline access permitted after challenge. The app prompts for enterprise logon when possible, but allows offline use after the password challenge.

Offline challenge only. Allows the app to run with an offline password challenge.

Not required. Does not require user authentication.

Note: After the maximum offline period for the app expires, users must log on to Receiver logon regardless of the policy setting.

Maximum offline period (hours)

Defines the maximum period an app can run offline without requiring a enterprise logon for the purpose of entitlement and refreshing policies. Default is 72 hours (3 days).

Note: If the Authentication policy is set to Network logon , this setting is ignored with no offline access allowed.

Reauthentication period (hours)

Defines the period before a user is challenged to authenticate again. Default is 8 hours. A setting of 0 (zero) prompts for logon each time the app is started or reactivated.

Policies to Determine Device Security

Block jailbroken or rooted

The app is locked when the device is jailbroken (iOS) or rooted (Android). Default is On .

Options:

On. The app is locked when the device is jailbroken or rooted.

Off. The app can run on a jailbroken or rooted device.

Policies for Encryption

Encryption keys

Ensures that access to keys and the associated encrypted content. Default is Offline access permitted .

Options:

Online access only. Secrets used to derive encryption keys may not be persisted on the device.

Instead, the device must be recovered the keys from the key management service of XenMobile App

Edition each time they are needed.

citrix.com

Note: If you select Online access only , the authentication policy is assumed to be Network logon regardless of the authentication policy setting that you configured for the app.

Offline access permitted. Secrets used to derive encryption keys may be persisted on the device.

Enable database encryption

Determines if the data held in local database files is encrypted. Default is On .

Options:

On. The data is encrypted in local database files.

Off. The data is not encrypted in local database files.

Database encryption exclusion list

Exclusion list of databases that are not automatically encrypted. To prevent database encryption for a specific database, add an entry to the comma-separated list of database file names. If any part of the supplied entry matches the database file name used by the app, that database is not automatically encrypted. For example, if the database to be excluded is named "googleanalytics.sql," adding "google," "googleanalytics," or "analytics" to the list prevents the database contents from being encrypted. Default is empty.

Policies for Miscellaneous Situations

App update grace period (hours)

Note: Citrix recommends using a value other than zero (0). A zero (0) value would immediately prevent users, without warning, from using a running appl until they download and install the update. This could lead to a situation in which users are forced to exit the app and potentially lose work.

Auth failures before lock

Locks app after the specified number of consecutive offline logon failures and prompts user to log on. Default is 5 failures. If you enter 0, the app does not lock no matter how many times users enter incorrect credentials

Erase app data on lock

Erases data and resets the app when the app is locked. Default is Off .

Options:

On. App data is automatically erased when the app is locked.

Off. App data is not erased automatically when the app is locked.

An app can be locked for any of the following reasons:

Loss of app entitlement for the user

Removal of app subscription

Removal of Receiver account

Uninstallation of Receiver

Too many application authentication failures

Jailbroken device and policy restricting the app to run on such a device

Other administrative action to lock device

Active poll period (minutes)

Determines how often XenMobile App Edition is polled to determine the current app (enabled or disabled) and device

(lock or erase) status. When a device has network connectivity, polling allows the running app to detect and respond to changes in the app state. Default is 60 minutes (1 hour).

Important: Only set this value lower for high-risk apps or performance may be affected.

Policies on Network Access and Requirements

Network access

Prevents, permits, or redirects app network activity. App blocks network use or restricts it to an applicationspecific tunnel gateway. Default is Blocked .

Options: citrix.com

Unrestricted. Allows unrestricted access to the internal network.

Blocked. When blocked, the app behaves as if the device has no network connection. All network access is blocked.

Tunneled to the internal network. A per-app VPN tunnel through NetScaler Gateway to the internal network is used for all network access.

Note: This setting requires Receiver logon.

Require WiFi

Determines if the device requires a WiFi connection in order for an app to run. Default is Off .

Options:

On. The app is locked when the device is not connected to a WiFi network.

Off. The app can run even if the device does not have an active WiFi connection, such as 4G/3G or a

LAN connection.

Require internal network

The app requires a connection to a network within the organization. Default is Off .

Options:

On. The app is blocked when the device is not connected to an internal network.

Off. The app can run from an external network.

Internal WiFi networks

The app requires a connection to one of the specified wireless networks. Separate the network Service Set Identifier

(SSID) with commas. The default is an empty list, which indicates that any internal WiFi network can be used if users log on from an external network (or they are not logged on), this policy is not enforced.

Network access

Prevents, permits, or redirects application network activity.

Options:

Unrestricted. No restrictions are placed on the network access

Tunneled to the internal network. A per-application VPN tunnel back to the internal network is used for all network access.

Certificate label

You can enter a label to identify the certificate for this app. When a certificate is required in order for HTTP traffic to meet a server authentication challenge, the label enables the micro VPN code to acquire the appropriate certificate.

Default is empty.

citrix.com

Configuring Encryption Policies for Apps Running on Mobile Devices

You can configure encryption policies for apps running on iOS and Android mobile devices. You can configure four encryption policies for iOS apps and eight encryption policies for Android apps. This topic lists the encryption policies that apply to each device type.

Policies for Encryption for iOS Apps

This section describes the policies you can configure in App Controller for apps that run on iOS devices. For a complete list of the policies you can configure for iOS devices, see the topic, Configuring MDX Policies for iOS Apps in App

Controller in this section.

Encryption keys

Ensures that access to keys and the associated encrypted content. Default is Offline access permitted .

Options:

Online access only. Secrets used to derive encryption keys may not be persisted on the device.

Instead, the device must be recovered the keys from the key management service of XenMobile App

Edition each time they are needed.

Note: If you select Online access only , the authentication policy is assumed to be Network logon regardless of the authentication policy setting that you configured for the app.

Offline access permitted. Secrets used to derive encryption keys may be persisted on the device.

Enable encryption

Determines if the data held in local database files is encrypted. Default is On .

Options:

On. The data is encrypted in local database files.

Off. The data is not encrypted in local database files.

Database encryption exclusion list

File encryption exclusions

Exclusion list of files that are not automatically encrypted. To prevent file encryption for a specific file, add an entry to the comma-separated list of file names. If any part of the supplied entry matches the file name, the file is not automatically encrypted. Default is empty.

Policies for Encryption for Android Apps

This section describes the policies you can configure in App Controller for apps that run on Android devices. Before you configure encryption policies for Android apps, to understand how file storage and encryption works on Android devices, see the topic, Configuring Encryption Policies for Android Devices. For a complete list of the policies you can configure for Android devices, see the topic, Configuring MDX Policies for Android Apps in App Controller.

Encryption keys

Ensures that access to keys and the associated encrypted content. Default is Offline access permitted .

Option:

Offline access permitted. Android devices permit offline access only. Secrets used to derive encryption keys may be persisted on the device.

Private file encryption

Controls the encryption of private data files in the following locations: /data/data/

appname

and

/mnt/sdcard/Android/data/

appname

. Default is Security Group .

citrix.com

Options:

Disabled. Encryption is turned off.

SecurityGroup. Encrypts private files by using a key shared by all MDX applications in the same security group.

Application. Encrypts private files using a key unique to the application.

Private file encryption exclusions

Non-standard external storage locations

Access limits for public files

Contains a comma-separated list. There are three parts to each entry. The first part contains either "Ext" or "VS." Ext is standard storage and VS is vendor-specific external storage. Each entry also contains a regular expression path followed by (NA), (RO), or (RW). Files matching the path are limited to No Access, Read Only, or Read Write access.

The list is processed in order and the first matching path is used to set the access limit. Default is empty.

Public file encryption

Controls the encryption of public files. Default value is Security group .

Options:

Disabled. Does not encrypt public files.

Security group. Encrypts public files by using a key shared by all MDX applications in the same security group.

Application. Encrypts public files using a key unique to this application.

Public file encryption exclusions

Public file migration

This policy is enforced only when public file encryption is enabled (changed from the Disable option to the

SecurityGroup/Application option). This policy is applicable only to existing, unencrypted public files and specifies when these files are encrypted. Default value is Write(WO/RW) .

Note: New files or overwriting existing unencrypted files encrypts the replacement files in every case.

Caution: Encrypting an existing public file makes the file unavailable to other applications that do not have the same encryption key.

Options:

Disabled. Does not encrypt existing files.

Write (RO/RW). Encrypts the existing files only when they are opened for write-only or read-write access.

Any. Encrypts the existing files when they are opened in any mode.

Configuring Encryption Policies for Android Apps

App Controller supports the following encryption features for Android devices and apps:

Private or public data to be encrypted through the use of a security group

The ability to prevent data sharing by using an application key to encrypt files

The ability to prevent applications from being made public by using access limits for public files that defines what the app can do with storage, such as Read Only or Read Write access.

No encryption

Before you configure encryption policies for apps that run on Android devices, you need to understand how file storage and encryption work on Android devices.

Storing Files on Android Devices

On Android devices, files may be read or written in the following locations:

App Controller supports the following encryption features for Android devices and apps:

Private or public data to be encrypted through the use of a security group

The ability to prevent data sharing by using an application key to encrypt files citrix.com

The ability to prevent applications from being made public by using access limits for public files that defines what the app can do with storage, such as Read Only or Read Write access.

No encryption

Before you configure encryption policies for apps that run on Android devices, you need to understand how file storage and encryption work on Android devices.

Internal storage

External storage

Vendor-specific external storage

How Internal Storage Works

Internal storage is a private sandbox for a specific application. The storage path is /data/data/

appname

, where

appname

is the name of the application. Directory permissions can prevent other applications from accessing the files in the specified path.

How External Storage works

External storage is a partition that is shared by all applications. On Android devices, external storage can use internal memory. Older devices might use an SD card for external storage.

External storage is often located at /mnt/sdcard. Within that directory, there are subdirectories. These include:

Android/data/

appname

that is a private sandbox, similar to what exists for internal storage.

Alarms, DCIM, Download, Movies, Music, Notifications, Pictures, Playlists, and Podcasts that are well known directories for specific types of content.

Anything else that is available to the application. The application can access files in the root external storage directory or any subdirectory. The application can also create new subdirectories.

How Vendor-Specific External Storage Works

Android devices might support external storage devices, such as memory cards. When users insert the memory card into the device, the path is defined by the device manufacturer. For example, on the Samsung Galaxy Tab 2, the path is

/mnt/extSdCard. The Android operating system does not manage this storage.

Configuring File Application Policies

You can use application policies to control transparent file encryption. The policies apply to public and private files and other areas on Android devices.

Private files. A vault that contains internal storage and the sandbox area for external storage.

Public files. A vault that contains standard external storage and any vendor-specific external storage.

Other. A category that you can use for key management and access limit policies.

Encryption uses the concept of inclusion prefixes and exclusion filters. Inclusion prefixes are used to indicate whether a file is in a particular vault. Each vault has a list of inclusion prefixes. Exclusion filters are POSIX extended regular expressions which then cause particular files or directories to be omitted from a vault. When determining if a path is in a vault, the path must first begin with a prefix associated with the vault. If the prefix exists, the path must also NOT match any of the exclusion filters. If both conditions pass, the path is considered to be part of the vault.

Some applications use unsupported access modes like memory mapping. Others may try to use encrypted files before the encryption key is available. If application issues are encountered, the logcat log may be used to search for error messages on the ctxtfe component. This may lead to possible paths/files that should be excluded.

The following are examples of inclusion prefixes, exclusion filters, and paths:

Inclusion Prefixes

/data/data/com.foo

/mnt/sdcard/Android/data/com.foo

Exclusion Filters

^app_dx/

\.jpg$ citrix.com

Paths

If a vault is defined by the above inclusion prefixes and exclusion filters, the following example paths may or may not appear in the vault: data/data/com.foo/files/myfile.doc

Located in the vault.

/data/data/com.bar/files/myfile.doc

Not in the vault because there are no inclusion prefixes that match.

/data/data/com.foo/app_dx/generated23423.jar

Does not reside in the vault because of the ^app_dx/ exclusion. The prefix is removed from the path, leaving the path app_dx/generated23423.jar. The exclusion entry that contains the caret (^) symbol means that the match must occur at the beginning of the string. The next characters "app_dx/" must match exactly. The remainder of the path can be anything. You can use this pattern to exclude everything under a specified directory name.

/mnt/sdcard/Android/data/com.foo/files/mypic.jpg

Does not reside in the vault because of the \.jpg$ exclusion. The "\." indicates a match with a dot. The backslash is necessary because the dot is a special regular expression character. The "jpg" extension is a literal match. The "$" means match at the end of the line. This matches any path that ends in ".jpg".

When you configure encryption in App Controller for Android devices, users are permitted offline access only which allows secrets used to derive encryption keys to be persisted on the device.

For a complete list of the policies that you can configure for Android devices, including the encryption policies, see

Configure MDX Policies for Android Apps in App Controller, in this section.

Configuring Private and Public File Encryption

You can configure two types of encryption that can be applied to either the private or public files. You can select the key type to balance between higher security and the ability to share data. You can use both key types with apps wrapped with the MDX Toolkit and apps that are not wrapped with the toolkit. The two keys are:

Security Group Key that encrypt public files by using a key available to all MDX apps in the same security group. Using the security group key allows sharing of data between applications. However, the level of security is lower.

Application Key that encrypt public files by using a key only available to the specific MDX app. The application key offers the highest security. If you use the application key, it prevents data from being accessed by other MDX apps. For example, if users in the health industry have radiology files that cannot be compromised, when you upload the app to App Controller, the files are encrypted and cannot be shared.

You can also configure access limits for public files to block data from being moved to less secure locations, such as removable storage. Access limits are independent of encryption.

citrix.com

Configuring Applications for Single Sign-On

App Controller comes with a set of application connectors , which are templates that you can configure for single sign-on

(SSO) to web and Software as a Service (SaaS) applications, and in some cases for user account creation and management as well. App Controller includes Security Assertion Markup Language (SAML) connectors and HTTP

Federated Formfill connectors. SAML connectors are used for web applications that support the SAML protocol for SSO and user account management. App Controller supports SAML 1.1 and SAML 2.0. When users log on to a Formfill application, their credentials are automatically entered on the applicationâ€™s logon page.

You can also build your own enterprise, SAML, and HTTP Federated Formfill application connectors in App Controller.

For details, see Building Your Own Application Connectors .

This section includes the following information:

List of all application connectors indicating the type (SAML or HTTP Federated Formfill)

Steps to configure SSO by using application connectors

List of application connectors that require you to configure additional parameters

Steps for building your own SAML or HTTP Federated Formfill connectors

Steps for creating and managing user accounts for applications and configuring workflow settings

Steps for configuring connectors to enable users to change an application password in their HTTP

Federated Formfill apps or to recover their passwords.

citrix.com

Building Your Own Application Connectors

You can create your own application connectors in App Controller. You can create either a Security Assertion Markup

Language (SAML) connector or an HTTP Federated Formfill connector.

When you build a connector, you use the logon web address for the URL. For example, you want to add LinkedIn to your application list. Go to http://www.linkedin.com and then click Sign in . When the logon page appears, copy the web address and then paste the web address in the URL field in the Configure App wizard in App Controller.

Building SAML Connectors

App Controller enables you to build either a SAML 1.1 or SAML 2.0 connector. SAML connectors are used for web applications that support the SAML protocol for SSO. The Generic SAML connector enables you to create your own

SAML connector for applications that support the SAML protocol. App Controller supports the identity provider (IdP)

SSO for SAML applications.

Building HTTP Federated Formfill Connectors

App Controller can use Formfill to automatically enter user credentials in the applicationâ€™s logon page. When users connect to a SaaS application, the web browser displays the logon form and then redirects users to the SaaS application. When you to add a new Formfill connector to the existing catalog, you must provide information about the application that you want to add. After you successfully configure the connector, you can then configure the connector for SSO. The Formfill connector supports applications that:

Obtain the user name and password and submit the credentials to the application without verifying the information again.

Set the application cookies when users request the logon page. The cookies set the attributes that change for each logon request for the application.

Building Enterprise Application Connectors

You can create enterprise application connectors from the Apps & Docs tab in the App Controller management console.

When you create an enterprise app, you create the app and the Formfill connector at the same time. Users log on to enterprise apps by using SSO. You can also configure user account management for enterprise applications, as well as policies for the connector.

1. In the management console, click the Apps & Docs tab.

2. Under Apps & Docs > APPS , click Web & SaaS and then click the plus (+) sign in the right pane.

3. In the catalog, click New enterprise app .

4. On the Details page, complete the following: a. In App name , type a name for the app.

b. In Description , enter a description for the app.

Note: If you want to configure a second app with the same web address, you must give the app a different name.

c. In URL , type the web address for the app. Precede the web address with http or https.

d. Select App is hosted on internal network if the app is running on a server that resides in your internal network.

e. To obtain user credentials from Active Directory, click Use Active Directory for SSO .

f. Select Require app installation if users connect to the app from a mobile device. This setting requires users to download and install the app to their device.

g. In Category , select the category from the list.

h. In Assigned role , select the role. This is a mandatory field.

i. In Image , select the default Citrix logo or select Upload to add your own logo to the logon page and then click

Next .

If you want to upload your own logo, click Browse and then navigate to the logo on your device.

Note: The graphic you upload must be of the type PNG. You cannot upload a GIF or JPEG graphic. When you add a custom graphic, you cannot change it at a later time.

5. Click Next .

6. On the Workflow page, configure the following if you need approval for creating user accounts: a. Select Requires Approval and then either create a new workflow or select an existing workflow.

b. If you create a new workflow, in Workflow name , enter a name for the workflow and then click Next .

If you choose not to add or configure a workflow, click Next and go to Step 7.

c. Under Manager Approvals , in Levels of manager approval , select the number of levels required for manager approval of the user account.

d. Under Additional Approvers , in Enter additional required approvers , enter the name of the approver.

citrix.com

6. d.

Approver names originate from Active Directory.

e. When the approver's name appears in the text field, click the name and then click the plus (+) symbol.

The approver's name and email address appears in Selected Approver .

7. Click Next .

8. On the Policies page, configure any of the following: a. Under Device Security , in Block jailbroken or rooted , click the toggle to Off to allow this app to work on a compromised mobile device.

b. The default is On , which does not allow the app to work on a compromised mobile device.

c. Under Network Requirements , enable or disable WiFi required .

d. Enable or disable Internal network required .

e. In Internal WiFi networks , enter one or more Wired Equivalent Privacy (WEP) or Wi-Fi Protected Access

(WPA) keys, separate by commas.

9. Click Save .

To build a SAML connector

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under Quick Links , click Add connector and then click SAML connector .

3. In the Add a SAML Connector dialog box, in Name , type a name for the application.

4. In Description , describe the application.

5. In Logon URL , enter the logon web address for the application.

You must include http:// in the web address.

6. In SAML version , select the version.

7. In Entity ID , enter the identity for the SAML application.

8. In Relay State URL , enter the web address for the SAML application.

The relay state URL is the response URL from the application.

9. In Name ID format , select from the options in the list. The default is Email Address .

10. In ACS URL , enter the assertion consumer service of the identity provider or service provider.

The AssertionConsumerServiceURL (ACS URL) provides single sign-on (SSO) capability for users.

11. In Image , select Use default to use the default Citrix logo or select Upload to add your own logo to the logon page.

If you want to upload your own logo, click Browse and then navigate to the logo on your device.

Note: The graphic you upload must be the type PNG. You cannot upload a GIF or JPEG graphic. When you add a custom graphic, you cannot change it at a later time

12. Click Save .

To build an HTTP Federated Formfill connector

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under Quick Links , click Add connector and then select Formfill connector .

3. In the Add a Formfill connector dialog box, in Name , type a name for the connector.

4. In Description , enter a description for the connector.

5. In Logon URL , enter the logon web address for the connector.

6. In Image , select the default Citrix logo or select Upload to add your own logo to the logon page.

If you want to upload your own logo, click Browse and then navigate to the logo on your device.

Note: The graphic you upload must be the type PNG. You cannot upload a GIF or JPEG graphic. When you add a custom graphic, you cannot change it at a later time.

7. Click Save .

List of Application Connector Types

The following table lists the connectors and the types of connectors that are available with App Controller. The table also indicates if the connector supports user account management, which enables you to create new accounts automatically or by using a workflow.

Connector name Supports user account management

AccessGateway

AmericanAirlines

AmericanExpress

Ameritrade

Ariba

SSO

Formfill

SSO

SAML

Â citrix.com

AtTask

Basecamp

Bill

Birst

Box

Bugzilla

Campfire

CanadaPost

CentralDesktop

Ceridian

CitrixAccessGateway

CitrixWebInterface

ConcurSolutions eBay

EchoSign

EchoSign_SAML

Egnyte eLeaP

Epocrates

Evernote

Expedia

Fidelity

Fieldglass

Force

Globoforce_SAML

GoogleApps_SAML

GoogleApps_SAML _IDP

GoToAssist

GoToManage

GoToMeeting

GoToMyPC

GoToTraining

GoToWebinar

Groupon

HelpSpot

Jira

Kayak

LogMeInRescue

LotusLive

Marketo

Medgate

MedPageToday

Y citrix.com

Medscape

MyAtlassian

MySpace

NetDocuments

Office 365

Oracle10g

OracleCRM

Orbitz

OWA

Pandora

Pearson

PeopleclickAuthoria

PivotalTracker

Postini

QualysGuard

Rackspace

RallySoftware

Recover_Password

Reset_AppPassword

Responsys

RightScale

RingCentral

Salary

Salesforce

Salesforce_SAML

Salesforce_SAML_SP

SAP

ShareFile

ShareFile_SAML

ShareFile_SAML_SP

Skype

SlideRocket

Smartsheet

SoftLayer

SouthwestAirlines

SpringCM

SuccessFactors

SuccessFactors_SAML

SugarCRM

SugarSync

SurveyMonkey

Syncplicity

Twitter

UnitedAirlines citrix.com

Web Link

Webex

WebEx_SAML_SP

WebMD

Webtrends

YahooMail

Yammer

YouSendIt

Zendesk

Zoho

Â citrix.com

Configuring the Reset_AppPassword Connector

Users can change HTTP Federated Formfill app passwords saved in App Controller by using the reset application password ( Reset_AppPassword ) connector. When you configure Reset_AppPassword , the connector appears in

Receiver as an application. If users change the application password in the app, the user can use Reset_AppPassword to update the password in App Controller. This allows users to continue using SSO for HTTP Federated Formfill SSO apps.

When users click the application in Receiver, a web page starts and a list of apps that have saved passwords appears.

Users can then change the password for the apps in the list.

If you do not configure Reset_AppPassword , users cannot update the password in App Controller. As a result, If users change the password in the app, when they start the app in Receiver, they will need to log on.

You can also allow users to recover their passwords. To do so, you configure the recover application password (

Recover_AppPassword ) connecter.

To configure the reset application password connector

1. In the App Controller management console, click Apps & Docs at the top of the page.

2. Under APPS , click Web & SaaS and then click Reset_AppPassword .

3. In the Configure App dialog box, in App Name , leave the default name or type one of your own.

4. In Description , leave the default description or type one of your own.

5. In URL , type the web address to the password reset web page.

6. Optionally, select the Category and Role .

7. Click Next to configure settings on subsequent pages and then click Save .

To configure the recover application password connector

1. In the App Controller management console, click Apps & Docs at the top of the page.

2. Under APPS , click Web & SaaS and then click Recover_AppPassword .

3. In the Configure App dialog box, in App Name , leave the default name or type one of your own.

4. In Description , leave the default description or type one of your own.

5. In URL , type the web address to the password recovery web page.

6. Optionally, select the Category and Role .

7. Click Next to configure settings on subsequent pages and then click Save .

citrix.com

100

Configuring Applications for User Account Management

When you configure an application for SSO, you can also configure some application connectors to enable user account creation and management. When you enable user account management, you can configure settings to create new user accounts automatically or by using a workflow. You must select one or the other option. If you use a workflow, the workflow settings specify the correct number of approvals that are necessary to create user accounts. When all the approvals are received, App Controller creates the user account.

If an application is available for user account management, after you configure the URL and licenses, you click Next to configure the settings for creating user accounts, including workflow settings. If an application is not available for user account management, the check box does not appear when you configure the URL and license information.

After you configure the application to enable user account creation and management, you can synchronize the application accounts with Active Directory. When you synchronize application accounts, App Controller uses the users'

Active Directory credentials for SSO to the application.

To configure new user accounts

When you configure an application that allows for user account management, you can have App Controller create the user accounts automatically or you can configure a workflow to have user account creation approved by individuals in your organization.

When you choose to create an account automatically, you can also choose the action to take when the account is not longer needed. For example, if a user is temporarily away from the organization, you can select to disable the account until the user returns. If a user has left the organization permanently, you can select to delete the account.

1. In the App Controller management console, click Apps & Docs at the top of the page.

2. Under APPS , click Web and SaaS .

3. In the detail pane, click the plus (+) sign and then select a SAML application from the catalog.

4. On the first page of the Configure App dialog box, configure the application settings, select Enable user management for provisioning and then click Next.

5. On the second page of the Configure App dialog box, do the following: a. Under Service account , in User name and Password , enter the application service account credentials.

The service account is the administrator account for the application.

b. To create user accounts automatically, under User Accounts , select Create account automatically and then in

When user entitlement ends , select from the options in the list.

6. Click Next .

7. On the User Names page of the Configure App dialog box, do the following: a. Under User Name Rule , in User attribute , select the parameter for creating the user account.

For example, select Last name . The default parameter is Email address .

b. In Length (characters) , select the length for the user account.

For example, if you select 7, the user name is the first seven letters of the users' last name. The default setting is All . When you select these two parameters, the Rule field populates automatically.

c. Under Password Requirement , select the required password length.

d. Under Password Expiration , in Validity (days) , set the number of days the password is valid.

e. Select Automatically reset password after it expires to allow users to reset their passwords.

8. Click Next to configure the workflow settings.

To configure workflow settings

1. On the Workflow page of the Configure App dialog box, click Requires Approval if you want to use a workflow to approve new user accounts.

2. Select Create new workflow or select an existing workflow.

3. If you are creating a new workflow, in Workflow name , enter a name for the new workflow.

4. Optionally, in Description , describe the workflow purpose and then click Next .

5. Under Manager Approvals , next to Levels of manager approval , select the number of levels required for user account approval.

You can select up to three levels of approvers or you can select Not needed if the workflow does not require manager approval. Approval goes through the workflow according to the managers identified in Active Directory.

Note: If you do not select the manager approval level, you must add approvers in Additional Approvers .

6. Under Additional Approvers , add the people who also need to approve the user account.

7. citrix.com

To find the name of an approver, you can enter a first or last name in the fields provided. You can also enter partial names. When the user appears in the text box, select the user and then click the plus (+) sign.

101

7. Click Next , configure the policies for the application and then click Save .

To synchronize application users with Active Directory

After you configure an application connector to enable user account creation and management, you need to synchronize the users who have application accounts with the users in Active Directory. When you add users to Active Directory, you must enter the first name, last name, and email in the user properties. If you do not configure users in Active Directory with this information, App Controller cannot synchronize these individuals. When users attempt to start an app, users receive a message that they are not authorized to use the app.

Note: The Sync icon only appears when you select an application that is configured for user account management.

1. In the App Controller management console, click the Apps & Docs tab.

2. In the details pane, click an application.

3. In the dialog box that appears, click the Sync icon.

citrix.com

102

Configuring Additional Parameters in Application Connectors

Most application connector templates contain a predefined URL. When you add the application, you can choose to save the default settings. The application is then configured for SSO.

Some connectors require you to configure the following additional parameters:

URL that contains a domain or subdomain name.

For example, when you configure the AtTask application connector, the URL appears as

$$url$$/attask/home.cmd. You replace $$url$$ with the subdomain name. This is the URL with which users log on.

URL and subdomain name.

You need to add the URL and subdomain name for an application connector, such as the Basecamp application.

Cookies domain that contains the name of the cookie for the application.

You must know where to locate the name of the cookie to enter the name in this field.

Some application connectors require configuration in App Controller and in the application. One example is Google

Apps. When you configure Google Apps in App Controller, you need to download a SAML certificate from App

Controller and install the certificate in Google Apps. You also need to configure SSO settings in Google Apps to work with App Controller. For more information about downloading the SAML certificate, see xmob-appc-saml-app-certs-tsk.

html#clg-appc-saml-app-certs-c-tsk .

List of Application Connectors with Additional Parameters

The following is a list of applications that require additional parameters. Some applications require that you download a

SAML certificate from App Controller and then upload the certificate to App Controller. For more information about downloading the certificate, see xmob-appc-saml-app-certs-tsk.html#clg-appc-saml-app-certs-c-tsk .

AccessGateway

Users can log on to NetScaler Gateway by using one of the following three methods: NetScaler Gateway Plug-in, clientless access, or Citrix Receiver. When you configure this connector, it connects to the Web Interface by using an

ICA connection. If you use this connector, configure Web Interface settings on NetScaler Gateway. When users log on with Receiver, NetScaler Gateway establishes an ICA connection to the XenApp or XenDesktop server. Users receive a list of applications or desktops in the web browser. When they click an application and open the application, the ICA connection is established.

In URL , enter the web address used to log on to NetScaler Gateway. The web address is: https:

AtTask

//<AccessGatewayFQDN>/vpn/index.html

URL: $$url$$/attask/home.cmd

In $$url$$ enter the subdomain name for the AtTask logon web site.

Basecamp

Basecamp is an application for project management and online collaboration.

In subdomain , enter the domain name that hosts Basecamp.

In URL , enter the web address to which users connect.

Bugzilla

Bugzilla is an application that you host in your internal network.

In URL , enter the web address that you use to log on to Bugzilla.

For example, enter http://<Application FQDN>/index.cgi

Campfire

In subdomain , enter the domain name that hosts Campfire.

In URL , enter the fully qualified domain name (FQDN) of Campfire.

CentralDesktop

CentralDesktop is collaboration software and online project management for business.

In URL , enter the web address that you use to log on to CentralDesktop.

CitrixAccessGateway

NetScaler Gateway provides secure user access to network resources in the internal network. If users log on with the

NetScaler Gateway Plug-in or clientless access, use the CitrixAccessGateway connector.

You must enter the web address used to log on to NetScaler Gateway in URL .

You can use the following web address for NetScaler Gateway: https://<NetScalerGatewayFQDN>.

CitrixWebInterface

The Web Interface provides secure user access to published applications from XenApp and virtual desktops from

XenDesktop.

citrix.com

103

In Cookies Domain , enter the Web Interface domain name.

In URL , enter the web address to which users connect.

Echosign_SAML

In URL , enter the subdomain name for Echosign. This application requires the SAML certificate. For more information about configuring Echosign, see the Echosign web site .

Egnyte

In URL , enter the web address used to log on to Egnyte.

In Cookies Domain and subdomain , enter the domain names.

URL: https:// <Application FQDN>

Example web address: https://<mycompany>.<mydomain>.com

Example Domain Name: <mydomain>.com

Example SubDomain Name: <mydomain> eLeaP

In Cookies Domain , enter the domain name.

In URL , enter the web address used to log on to eLeaP.

For example, https:// <Application FQDN>

Example: https://<mycompany>.2leap.com

Example Domain Name: <mycompany>.2leap.com

Globoforce_SAML

Globoforce is software that allows organizations to recognize their employees.

In URL , enter the web address to which users connect.

GoogleApps_SAML

When you configure a connector for Google Apps, use the token $$domain$$ for the web address. This token is substituted with the Google Apps domain name. You provide the domain name in Domain Name .

URL: https://www.google.com/a/<mydomain.com>

Example: https://www.google.com/a/citrix.com

Important: You must use HTTPS for the Google Apps web address.

To configure App Controller for SSO to Google Apps

1. In the management console, click the Apps & Docs tab.

2. Under Apps & Docs > APPS , click web & SaaS .

3. In the right pane, click the plus (+) sign and then click GoogleApps_SAML .

4. In App name , type a name for the application.

5. In Description , type a description for the application.

6. In Cookies Domain , type the domain name that you configured in Google Apps.

7. In URL , enter the URL preceded with http or https.

8. Select App is hosted in internal network if the app is running on a server that resides in your internal network.

9. Configure the remaining optional settings to configure categories, and roles for the application and then click

Next .

10. Configure the settings for user account management and workflows. For details, see To configure settings to create user accounts .

11. Click Save when you are finished configuring the application.

After you configure Google App settings in App Controller, you then need to configure Google Apps for SSO. First, you download the SAML certificate from App Controller. Then, you log on to Google Apps, configure the SSO settings, and upload the certificate to Google Apps.

To configure Google Apps, follow these guidelines:

Enable SSO in Google Apps.

Provide the sign-in page URL. For example, type https://appc-johndoe-151.agsag.

com/samlsp/websso.doaction=authenticateUser&app=GoogleApps_SAML&reqtype=1 .

Provide the sign-out page URL.

This is the web address that appears when users log off. For example, type https://appc-johndoe-

151.agsag.com/mywebapps

Provide the URL that users can access to change their password.

For example, type https://appc-johndoe-151.agsag.com/mywebapps

Upload the SAML certificate from App Controller to Google Apps.

Note: When users log on to Google Mail, they are automatically signed on to all features by using SSO. To log on, use the format http://mail.google.com/a/<domainName>.com

GoogleApps_SAML_IDP

You can use this connector to configure Google Apps as an Identity Provider. The settings are the same as for

GoogleApps_SAML.

HelpSpot

In URL , enter the web address that users use to log on.

In Cookies Domain , enter the HelpSpot domain name.

citrix.com

104

URL: http://<Application FQDN> :< port number>/helpspot/admin.php

The default web address is $$url$$/helpspot/admin.php

Example URL: http://mycompany.helpspot.com:8089/helpspot/admin.php

Example domain name: mycompany.helpspot.com

JIRA

JIRA is an application you host in your internal network.

In URL , enter the web address used to log on to JIRA.

Example URL: http:// <Application FQDN> :<port number> /secure/Dashboard.jspa

Office 365

Microsoft Office 365 is cloud-based solution for e-mail, collaboration, instant messaging, and web conferencing.

Before you configure Office 365, make sure you have the following prerequisites:

Windows Azure

Public domain name that can be reached from the Internet

Microsoft Online Service Module to connect to the Azure database

Active Directory

Directory Synchronization tool that is used to synchronize Active Directory objects (users, groups, and contacts) to the cloud. This is also called directory sync .

In Cookies Domain , enter the Office 365 domain name.

In URL enter the web address used to log on to Office 365. The default URL is https://login.microsoftonline.com.

On the Settings tab, in the left pane, click Certificates .

After you configure Office 365 settings in App Controller, you need to configure Office 365 for SSO. First, you download the SAML certificate from App Controller. When you run the cmdlets in the following procedure, you enter the SAML certificate path or copy the certificate into the location from where you run the cmdlets. The following procedure enables the trust relationship between Windows Azure and App Controller. This allows SAML-based SSO.

When you configure the domain name (

$dom

), use the Active Directory domain.

To configure Office 365

1. Log on to Windows Server 2008 R2 or Windows Server 2008.

2. Open Power Shell.

3. At the command prompt, type

Connect-MsolService

. Enter Microsoft online service user name and password when prompted.

4. At the command prompt, enter the following cmdlets:

$dom = "<Domain name>"

$fedBrandName = "AppC"

$url = "https://< AppC FQDN>/samlsp/websso.do?action=authenticateUser&app=Office365_SAML"

$uri = "AppController.example.com"

$logoutUrl = "https://<AppC FQDN>/samlsp/websso.do?action=logout&app=Office365_SAML"

$cert = New-Object System.Security.Cryptography.X509Certificates.X509Certificate2("certificate.pem")

$certData = [system.convert]::tobase64string($cert.rawdata)

Set-MsolDomainAuthentication â€“DomainName $dom â€“federationBrandName $fedBrandName -Authentication Federated -PassiveLogOnUri $url -SigningCertificate $certData -IssuerUri $uri -LogOffUri $logoutUrl -PreferredAuthenticationProtocol SAMLP

After you configure these settings, users can log on to Office 365 from Receiver or by using the Office 365 URL in a web browser.

Oracle10g

In URL enter the web address used to log on to Oracle10g.

In Cookies Domain , enter the Oracle10g domain name.

URL syntax: http://<Application FQDN>:<port no(if any)>/apex

Example URL: http:// <mycompany>.<mydomain>.com:8080/apex

Example domain name: <mydomain>.com

In the Oracle10g application in App Controller, change the default Redirection URL to the FQDN of App Controller. For example, if the App Controller FQDN is appcontroller.citrix.com; the Redirection URL must be "https://appcontroller.

citrix.com".

OWA (Outlook Web Access)

In URL , enter the web address that is used to access Outlook Web Access.

In Cookies Domain , enter the domain name of Outlook Web Access.

URL: https://<Application FQDN>

Example URL: https://<mycompany>.<mydomain>.com

Example domain name: <mycompany>.<mydomain>.com

The Outlook Web Access connector does not support NTLM-based authentication. Outlook Web Access only supports form-based authentication.

PeopleclickAuthoria

In URL , enter the web address used to log on to Peopleclick Authoria.

In Cookies Domain , enter the domain name.

URL: https://<Application FQDN>

Example URL: https://<mycompany>.<mydomain>/loginAction.action

Example domain name: <mycompany>.<mydomain>.com

Note: Authoria connector is for an enterprise hosted application and not for a web-based application.

citrix.com

105

Recover_Password

In URL , enter the App Controller FQDN, such as https://AppController.example.com/recoverpasswordportal.

Reset _AppsPassword

In URL , enter the App Controller FQDN, such as https://<AppControllerFQDN>.

Salesforce

When you open the connector for Salesforce, the URL contains a web address. If the default web address is different than the web address that your organization uses, enter the correct web address.

Default URL : https://login.salesforce.com

Example: Your organizationâ€™s URL: https://my.salesforce.com

Salesforce_SAML

URL: https://login.salesforce.com

When you open the connector for Salesforce, the URL contains a web address. If the web address is different from the web address that your organization uses, enter the correct web address.

This application requires the SAML certificate from App Controller. Follow the procedures in Salesforce_SAML_SP to upload the SAML certificate to the Salesforce server.

Salesforce_SAML_SP

URL: https://login.salesforce.com

When you enable user management and enter the user name and password, you need to use the password you use to log on to Saleforce along with the token. For example,

password

ZDMn6tx5Rf9l1bLdKrgwNuviM.

You need to download the certificate from App Controller and then upload the certificate to the Salesforce application.

For more information about uploading the certificate to Salesforce, see Configuring SAML Settings for Single Sign-On .

In the Salesforce application, specify the IdP URL in SAML settings as https://appc-johndoe-151.agsag.

com/samlsp/websso.doaction=authenticateUser&app=Salesforce_SAML_SP&reqtype=1.

SAP

In URL , enter the web address used to log on to SAP.

In Cookies Domain , enter the SAP domain name.

URL: http://<Application FQDN>

Example: http://<mycompany>.mydomain.com

Example domain name: <mycompany>.mydomain.com

ShareFile

In Cookies Domain , enter the domain name that hosts ShareFile.

ShareFile_SAML

In URL , enter the web address used to log on to ShareFile_SAML.

In Cookies Domain , enter the domain name that hosts ShareFile.

ShareFile_SAML_SP

In URL , enter the web address used to log on to ShareFile.

In Cookies Domain , enter the domain name that hosts ShareFile.

SuccessFactors

SuccessFactors requires the parameter Company Id . Enter your organizationâ€™s name in App Controller.

URL: https://performancemanager4.successfactors.com/login

Company ID: <company Id>

Note: Company Id is case sensitive. Please enter the Company ID that you registered with SuccessFactors.

SuccessFactors_SAML

The SuccessFactors technical support team configures SAML settings. Contact SuccessFactors when you are ready to configure these settings. You need to provide a .csv file to technical support. The .csv file must have a password column that is the same as the user ID.

SuccessFactors requires the Company ID parameter which is your organizationâ€™s name. Enter your organizationâ€™s name in Cookies Domain .

Domain Name: <Company Name>

Webex

Note: Company Name is case sensitive. Please enter the Company Name that you registered with SuccessFactors.

In URL , enter the web address used to log on to WebEx. In Cookies Domain , type your organizationâ€™s domain name. In Company Name , enter your organizationâ€™s name.

Example: https://<mycompany>.webex.com/mw0306lc/mywebex/default.do?siteurl=<mycompany> &service=10

Example domain name: citrix.webex.com

Example company name: <mycompany>

Note: Domain Name and Company Name are case sensitive.

WebEx_SAML_SP

In URL , enter the web address used to log on to WebEx SAML.

URL: https://<companyname>.webex.com/dispatcher/SAML2AuthService?siteurl=<companyname>

This application requires the SAML certificate from App Controller. For more information about uploading the certificate to WebEx, see Single sign-on Configuration in the Cisco WebEx Administration Tool .

In the WebEx application, specify the IdP URL in SAML settings as https://appc-johndoe-151.agsag.

com/samlsp/websso.doaction=authenticateUser&app=WebEx_SAML_SP&reqtype=1.

Webtrends

When you configure a Webtrends connector, you must enter the account name provided by Webtrends when you registered App Controller.

Account: <Account name>

Example Account name: mycompany

Note: Account is case sensitive.

URL: https://ondemand.webtrends.com/login.asp

citrix.com

106

Zendesk

In URL , enter the web address used to log on to Zendesk.

In Cookies Domain , type the domain name for Zendesk.

URL: https:// <Application FQDN>

Example URL: https://<mycompany>.zendesk.com

Example domain name: mycompany.zendesk.com

citrix.com

107

Configuring Single Sign-On by Using Application Connectors

With App Controller, you can provide users with single sign-on (SSO) to your mobile, enterprise, web, and SaaS applications. You can enable applications for SSO by using the application connector templates found in the App

Controller catalog. You can also enable some applications for user account management.

An application in App Controller is either a simple or complex application. If you configure a simple application, you can edit the label or accept the default name. If you are running multiple instances of the application in your network, you must change the label to make it easier to identify the application. With some applications, you can activate an application connector for SSO more than one time with different names. For example, you can configure the application named Box twice with the names as Box1 and Box2. If you have already configured an application, rename the application before you configure another connector.

If you add a complex application, you can edit the application name and the logon web address. If the application is an

SaaS application, you do not need to change the web address. If the application is a hosted application in your internal network, you change the web address to match the deployed application.

You configure an application connector by providing the following parameters:

Different names (optional). For example, you configure two instances of the Box application connector, each with a unique name. Not all applications allow you to configure multiple instances.

Description of the application.

Web address by using the fully qualified domain name (FQDN), such as https://app.bill.com.

Location of the application, either on the Internet or in your internal network.

Credentials for SSO. Users can use the application credentials or Active Directory credentials.

Category for the application. Categories allow you to organize applications in Citrix Receiver. When users log on, they can double-click the category and then start the application.

A group of users to which you want to assign the application.

Workflow approval settings for all applications that includes specifying the individuals who can approve the user account.

Application policies for each app you configure in App Controller.

If an application is available for SSO only, when you finish configuring the preceding settings, you save the settings and the application appears on the Apps & Docs tab in the App Controller management console. If an application is available for user account management, you select the check box to enable user management and then configure additional settings. The settings include:

Service account

Automatic account creation

User name and password rules

For more information about creating user accounts for an application, see xmob-appc-add-apps-provconnector-con.

To activate an application connector in App Controller for SSO only

1. In the management console, click the Apps & Docs tab.

2. Under Apps & Docs > APPS , click Web & SaaS and then in the right pane, click the plus (+) symbol.

3. From the catalog, click an application.

4. In the Configure App dialog box, in App Name , keep the default name or enter one of your own.

5. In Description , keep the default description for the application or choose one of your own.

6. If applicable, in URL , type the Web address of the application or keep the default address.

7. Select App is hosted in internal network if the application is running on a server in your internal network.

Note: If users connect from a remote location to the internal app, they must connect through NetScaler Gateway.

Selecting this check box adds the VPN keyword to the application and allows users to connect through NetScaler

Gateway.

8. Select automatically for logging on.

9. Select Require app installation if users connect to the app from a mobile device. When you select this option, when users connect from an iOS or Android device, the app downloads and then installs on the device.

10. In Category , select a category.

11. In Assigned role , select the role to which you want to assign the application.

12. Click Next .

13. If the application requires approvals for users, in Workflow , click workflow or use an existing workflow.

14. To use an existing workflow, in Create new workflow , select the workflow, and then click Next .

15. citrix.com

108

15. To create a new workflow, in Workflow name type a name for the workflow and in Description , type a description of the workflow. Click Next .

16. On the Policies page, configure the policies and then click Save .

citrix.com

109

Configuring Google Play Settings

You can enter users' Google Play store credentials in order to display an app description and icon in the management console and in the Worx Store. Google store credentials are mandatory when you configure App Controller to connect to Device Manager and when you configure an app for an Android mobile link in the management console.

You can enter any value for the user name and password. You need to enter the device ID that is associated with the account. The device ID is only used to download the information to Device Manager.

On your Android device, you can obtain the device ID by entering *#*#8255#*#* on your phone pad.

To configure Google Play settings

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Store Credentials .

3. In the details pane, next to Google play store , click Edit .

4. In User name and Password , enter the credentials.

5. In Device ID , enter the ID number and then click Save .

citrix.com

110

Creating Custom Store Branding for Devices

You can upload your own logo pages to mobile phones and tablets. You must put the files in a compressed zip file. The files must meet the following requirements:

Graphic files must be in .png format with a pure white logo or text with a transparent background set to 72 dpi.

Logos must be 170 pixels x 25 pixels (1x) + 340 pixels x 50 pixels (2x). The logo cannot exceed this height or width.

Note: Select 1x if the graphic is for an iOS device. Select 2x if the device has retina display (high resolution screen).

Name the files Header.png and [email protected]

To add logo files to App Controller

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Branding .

3. In the details pane, click for phone or for tablet .

4. Click Browse to navigate to the zip file on your computer and then click Upload .

citrix.com

111

Configuring GoToAssist in App Controller

App Controller and Citrix GoToAssist integrate to provide continuous technical support for mobile device users who are using WorxMail or WorxWeb. When you configure settings, you can add an email address, phone number, chat information, and ticket information. If the user needs assistance, they can tap a chat button on their mobile device and the GoToAssist web page opens.

To get started, you need to do the following:

1. After you purchase XenMobile, you receive a promotion code for GoToAssist.

Note: The promotion enables a one-year subscription to GoToAssist that allows one Help desk support personnel to log on to the management console and support an organization's users. You must renew the subscription each year.

2. Log on to the GoToAssist web site.

3. Create a new service for integrating GoToAssist with XenMobile.

When you do these steps, GoToAssist generates the email address that users can use to create a support ticket. This also creates an integration key that you enter in the App Controller management console.

When users start GoToAssist from their mobile device, the Worx app provisions XenMobile App Edition and GoToAssist accounts. GoToAssist sends an account key (token) to XenMobile App Edition which is then sent to the Worx app.

Users can use GoToAssist to receive technical support in the following ways:

Enter a valid email address to allow support personnel to contact them.

Use chat to contact support personnel.

Note: When users log on to chat from their device, the XenMobile App Edition and Worx app logs are bundled together and sent to support personnel.

Create an incident form by clicking Create Incident . If support personnel are not available through chat,

GoToAssist redirects users to the incident form automatically.

When you configure GoToAssist in App Controller, the settings appear on the Support Options tab in Settings . On this page you can view the settings for phone, chat, and ticket options. In Support Options , you can do the following:

Edit existing GoToAssist settings for phone, chat, or the ticket.

Add email or key support options.

Delete an option.

To configure GoToAssist settings in App Controller

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click GoToAssist .

3. In the details pane, next to GoToAssist Configuration , click Edit .

4. In Support email , enter the email address for support personnel.

Users can choose to use the email address to contact support personnel instead of GoToAssist.

5. In Support phone , enter the phone number for users to use to contact support personnel.

6. In GoToAssist chat leave the default token number or enter one of your own.

When users request a chat session, this token is sent to the Worx app.

7. In GoToAssist ticket , enter the email address that you can use to differentiate GoToAssist support requests and then click Save .

To edit support settings

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Support Options .

3. In the details pane, next to an item, under Actions , click the pencil icon.

4. In the Add Property dialog box, do the following: a. In Value , change the value for the support option type.

For example, if you are editing the chat option, enter the new key in this field.

b. In Name , change the name of the value.

c. In Description , add a description for the option.

5. Click Save .

The changes appear in the Support Options details pane.

citrix.com

112

To add support information by using Support Options

You can add a support email address or a custom key.

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Support Options .

3. In the details pane, click the plus (+) sign.

4. In the Add Property dialog box, do the following: a. In Key , select either SUPPORT_EMAIL or Custom Key .

b. If you select Custom Key , enter a name of the custom key you want to add in the blank field that appears. Keys have two parts: key name and the value, such as GTA_PHONE=5551212.

c. In Value , add the value for the support option type.

For example, if you are editing the chat option, enter the new chat key in this field.

d. In Name , add a name of the value.

e. In Description , add a description for the option.

To remove a support option

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Support Options .

3. In the details pane, click an option and then under Actions click the X icon.

4. To confirm, click Yes .

citrix.com

113

Creating Snapshots of the App Controller Configuration

A configuration snapshot represents all the App Controller settings and certificates at a specific time. If you saved a snapshot from an earlier version of App Controller, you cannot import the snapshot to a more recent version of App

Controller. You can only import snapshots for the same version. For example, if you upgrade from AppController 2.6 to

App Controller 2.8, you cannot import the Version 2.6 snapshot to Version 2.8.

When you install App Controller for the first time, App Controller creates a snapshot of the configuration automatically.

Then, you can take snapshots at different periods of time, such as after you add and configure apps, roles, categories and workflow settings.

You can import a snapshot to App Controller. You can also export a snapshot and save it to your local computer.

When you export a snapshot, the name is generated automatically. The file type is BIN (.bin).

A benefit of the snapshot feature is that you can easily restore your configuration settings if, for example, you need to reinstall App Controller. You can export a snapshot to your computer and then import the snapshot back to App

Controller. If the snapshot you import has a different network configuration, such as IP address, you can use the command-line console to run Express Setup to change network settings.

You can use Release Management on the Settings tab in the management console to import and export snapshots.

You can also use the command-line console to import and export snapshots.

To export a snapshot

1. In the App Controller management console, click the Settings tab.

2. Under System Configuration , click Release Management.

3. In the details pane, under Updates , select a snapshot.

4. In the lower-right corner, click Export .

5. Click OK to save the file.

To import a snapshot

1. In the App Controller management console, click the Settings tab.

2. Under System Configuration , click Release Management .

3. In the lower-right corner, click Import .

4. In the Import snapshot dialog box, click Browse , navigate to the snapshot and then click Open .

5. Click Upload .

The snapshot uploads to App Controller and then App Controller restarts.

citrix.com

114

Device Actions

When users install Citrix Receiver on their device, when they log on for the first time, App Controller registers the device.

Then, the device is included in the App Controller inventory and appears on the Devices tab in the App Controller management console. The inventory displays all devices that connect to App Controller from Receiver. For each device, the list provides the following information:

Type of device with which the user logs on

Operating system of the user device

Model of the user device

Name of the user device

User ID of the person who owns the device

Last time the user logged on with Receiver

Action you can take on the device

For each device in the list, you can perform the following actions for each device:

Erase application data and documents from the device. If users lose an iOS or Android device and do not locate the device in a specified period of time, or if the user leaves the organization, you can erase application data and ShareFile documents from the user device.

Stop erasing data and documents the device. If you determine that the device is safe, you can stop erasing the data and documents on the device. Users can access their apps and ShareFile documents when you stop erasing.

Lock and unlock the device. If users lose an iOS or Android device, you can lock applications on the device that App Controller delivers, which prevents unauthorized access to the applications. You can later unlock the same applications.

Delete the device. You can delete a device as a part of device inventory maintenance, if, for example, the device is lost or destroyed.

The lock and erase functions take effect after Receiver polls App Controller. The polls occur every 60 minutes by default.

An erased or locked device continues to appear in the inventory in the management console. If users do not need access to the device, you can remove the device from the inventory. When you erase application data from the device, the device listing appears in All Devices and Erased . If you lock a device, the listing appears in All Devices and Locked .

These lists allow you to see at a glance the devices that are currently active and the devices that might be compromised.

The following table shows the icons that you can use to perform the preceding actions for all devices, including devices that are connected to App Controller:

Icon Icon name Definition

Delete Used for deleting a user device from the inventory.

Lock

Unlock

Erase

Used to lock a user device.

Used to unlock a user device after you have locked it.

Used to erase application data and documents from the user device.

Stop erasing Used to stop erasing application data, and documents on the user device.

Locking and Unlocking Applications on User Devices

You can lock and unlock user devices in the App Controller management console. This action prevents users from connecting to applications in Citrix Receiver.

To lock applications on a user device

1. In the App Controller management console, click the Devices tab.

2. citrix.com

115

2. In the center pane, hover over a user device and then under Actions , click the lock icon.

3. Click Yes to confirm that you want to lock the device.

The user device appears in the All devices and Locked lists.

To unlock applications on a user device

1. In the App Controller management console, click the Devices tab.

2. In the left pane, click Locked .

3. Hover your mouse over the user device and then under Actions , click the unlock icon.

4. Click Yes to confirm that you want to unlock the device.

The user device is removed from the Locked list.

citrix.com

116

Locking and Unlocking Applications on User Devices

You can lock and unlock user devices in the App Controller management console. This action prevents users from connecting to applications in Citrix Receiver.

To lock applications on a user device

1. In the App Controller management console, click the Devices tab.

2. In the center pane, hover over a user device and then under Actions , click the lock icon.

3. Click Yes to confirm that you want to lock the device. The user device appears in the All devices and Locked lists.

To unlock applications on a user device

1. In the App Controller management console, click the Devices tab.

2. In the left pane, click Locked .

3. Hover your mouse over the user device and then under Actions , click the unlock icon.

4. Click Yes to confirm that you want to unlock the device. The user device is removed from the Locked list.

citrix.com

117

Erasing Application Data and Documents on the User Device

If a user device is compromised in any way, you can erase application data and ShareFile documents from the user device. When you erase the data from the user device, users can no longer access the applications or documents. You can also stop erasing data from the user device. If you stop erasing, you cannot restore the data and documents to the user device.

To erase application data and documents from a user device

1. In the App Controller management console, click the Devices tab.

2. In the details pane, hover over a user device and then under Actions , click the erase icon.

3. Click Yes to confirm that you want to erase application data and documents from the device. The user device appears in the All devices and Erased lists.

To stop erasing application data and documents on the user device

1. In the App Controller management console, click the Devices tab.

2. In the navigation pane, click Erased .

3. In the details pane, hover your mouse over the user device and then under Actions , click the stop erasing icon.

4. Click Yes to confirm that you want to stop erasing application data and documents from the user device. The user device is removed from the Erased list.

citrix.com

118

To delete a user device from App Controller

You can delete a user device from App Controller to maintain your current inventory. You might need to delete a device for the following reasons:

The individual left the company and returned the device.

The device is lost or damaged.

1. In the App Controller management console, click the Devices tab.

2. In the details pane, hover over a device and then click the delete icon.

3. Click Yes to confirm the deletion.

citrix.com

119

Monitoring App Controller

The App Controller Dashboard displays a summary of application and user access in App Controller. The Dashboard refreshes information every minute. You can also refresh the data manually at any time.

You can review the following information:

Total number of users who logon by Receiver type

Total number of sessions

Total number of configured applications in App Controller

Total number of applications started by users

The Apps Used counter shows data from the previous 24 hours. If you delete applications, the number of applications configured might not be the same as the number of applications started. For example, if you configure 10 applications and users start all 10, and then you delete 3 applications, all within 24 hours, the Dashboard shows 7 applications used, but still shows 10 apps started. Refreshing the Dashboard does not affect this counter. App Controller removes deleted applications automatically from the counter 24 hours after the last time users started the application.

You can configure App Controller to send log files to either a syslog server or to a server in your secure network. You configure log settings in the App Controller management console as part of the system settings.

You can also use the command-line console to configure logs to troubleshoot issues that may arise with App Controller.

You can revert back to the default log level control, create a new log, or display the current log.

You can transfer information and audit logs to a syslog server or file server in your network. You can also transfer the counters log to a file server in your network. If you select Audit , all logs are sent to the syslog server or file server. Audit logs contain a chronological record of system activities for App Controller.

Administrator logs are stored in the file AdminAuditLogFile.txt. User logs are stored in the file UserAuditLogfile.txt.

If you deploy App Controller with StoreFront, the following user activities do not appear in the audit logs:

Subscribing to applications

Unsubscribing from applications

Logon

Logoff citrix.com

120

Monitoring App Controller by Using the Dashboard

The App Controller Dashboard displays a summary of:

Total number of user logons. When you click the Total Logons icon, you can see a list of Receiver types and the number of users who are currently logged on with each type. This counter does not show unique users.

For example, if a user logs on two times, both logons are shown in the total number. This counter shows user logons from the following Receiver types:

Receiver for iOS

Receiver for Android

Receiver for Windows

Receiver for Mac

Receiver for Web

Total number of connected user sessions. This shows the total number of connected, active sessions. For example, if a user logs on with Receiver for Web, the user session is shown in this section. The arrow next to the total number shows if sessions are going up or down. This section does not contain any additional information.

The number of apps in use per the total number of configured apps. When you click the Apps Used icon, you see a list of all app types, such as Android, iOS, web and SaaS, web links, and ShareFile. This counter shows the total number of apps started and the total number of configured apps. You can also see the number of individual applications and how many times users started the app. When you click an individual app icon, a table appears that shows the number of times users started the app.

The Dashboard refreshes every minute. This provides current information about App Controller in your network.

If you configure App Controller to transfer logs to a server in your network, you can also configure the log to contain the counters from the Dashboard. App Controller logs the counters every hour.

To view the Dashboard

1. Log on to the App Controller management console.

2. Click the Dashboard tab.

citrix.com

121

Maintain and Monitor

App Controller provides a System Configuration panel that allows you to create and modify App Controller settings.

When you configure App Controller in the management console for the first time, you configure additional network settings, such as the administrator password and email address, host name, IP address, subnet mask, default gateway and Domain Name Server (DNS) settings, Active Directory, Network Time Protocol (NTP) server, certificates, and workflow email settings.

Note: You initially set the App Controller IP address, default gateway, DNS server, and NTP server by using the command line. When the Configure dialog box opens, you can changes these settings.

At a later time, you can access the System Configuration panel to configure or reconfigure the following settings:

Overview allows you to view the current system configuration of App Controller.

Deployment allows you to configure StoreFront or NetScaler Gateway settings for Citrix Receiver deployments.

XenMobile MDM allows you to establish communication between App Controller and XenMobile Device

Manager by configuring a host, port, and shared key. You can also require that users enroll in Mobile Device

Manager. For details on how to generate the shared key, see the Device Manager documentation in eDocs.

GoToAssist integrates with App Controller to provide users with email, phone, or chat assistance.

Active Directory allows you to configure or edit Active Directory settings.

Certificates allows you to upload, export, and delete certificates. You can create a Certificate Signing

Request (CSR) and download trusted (.pem), server (.pem or .pfx), and SAML (.pem) certificates.

Branding allows you to add a custom logo for the organization that appears on the Worx Storeâ„¢ or Worxâ„

¢ Home on devices running Receiver for iPhone or Receiver for iPad.

Network Connectivity allows you to change the App Controller host name, IP address, subnet mask, default gateway, to Allow support access , which enables or disables Secure Shell (SSH) access, and to enable SSL offloading to move SSL encryption and decryption tasks to terminate on a NetScaler Gateway virtual server that you configure in the DMZ.

Domain Name Server allows you to configure up to two DNS servers and provide the domain names. If you enter multiple domain names, use a comma to separate the names.

NTP Server allows you to configure an NTP server for the date, time, and time zone.

Workflow Email allows you to configure an email server, port, and email address, and to require user authentication to approve user requests to applications.

Administrator allows you to change the App Controller administrator password. When you change the password, it is changed in the management console and in the command-line console.

Release Management allows you upgrade to a new software version, install patches, and new application connectors.

Receiver Email Template allows you to use a template to send to users that indicates where they can download Citrix Receiver. You can automatically send the email to users, or you can manually send the email to users. When you send the email, you can also send a CR (.cr) file that contains all the settings that

Receiver needs to connect to App Controller.

Store Credentials if you deploy App Controller with XenMobile Device manager, you must enter a user name, password, and Android device ID for Google Play store.

Log Transfer allows you to transfer App Controller log files to a server in your network, to indicate the frequency with which the files are transferred and archived, and to specify the type of log you want to transfer.

Syslog allows you to transfer log files to remote syslog servers.

Receiver Updates allows you to configure how plug-ins are updated on the Windows-based device. You can select Citrix (citrix.com) or Citrix Merchandising Server, or you can indicate that you do not want to check for updates.

GoToAssist support options that allows you to configure and modify GoToAssist support information.

To open the System Configuration panel, click the Settings tab.

Configuring System Settings by Using the Command-Line Console

You can also use the command-line console to configure some system settings. You can:

Configure the App Controller IP address, subnet mask, default gateway, DNS servers, and NTP server.

Configure high availability for primary and secondary App Controller virtual machines (VMs).

Configure an App Controller cluster. For more information, see Creating a Cluster .

Reset the App Controller server certificate.

citrix.com

122

Enable or disable SSH access.

Import or export the App Controller configuration.

Configure a web proxy server.

Use network utilities to troubleshoot App Controller.

Create a support bundle to send to support personnel.

Restart or shut down App Controller.

citrix.com

123

Managing Citrix Receiver Updates

You can configure App Controller to update Citrix Receiver on Windows-based devices and Mac OS X computers. You can configure Receiver updates by using the following methods:

Do not check for updates. Update services are not provided.

Citrix. Updates Receiver from the Citrix update service on Citrix.com. You can also select other plug-ins to update from Citrix. These include:

NetScaler Gateway Plug-in

ShareFile for Outlook

ShareFile Sync

Citrix Merchandising Server. Updates all plug-ins installed on the user device from the Merchandising Server that you specify.

If you configure StoreFront in Trust Settings , you cannot configure Receiver updates.

To configure Receiver updates

1. In the management console, click the Settings tab.

2. Under System Configuration , click Receiver Updates .

3. In the details pane, next to Manage Receiver Updates , click Edit .

4. In Get updates from , do one of the following: a. To prevent Receiver updates, click Do not check for updates .

This is the default setting.

b. Click Citrix (citrix.com) . Under Citrix Update Options , in Include plug-ins , select the plug-ins for updates.

c. Click Citrix Merchandising Server . Under Merchandising Server Option , in Server , enter the fully qualified domain name (FQDN) of the Merchandising Server.

5. Click Save .

citrix.com

124

Changing System Settings by Using the Command-Line Console

You manage some system settings by using the App Controller command-line console. You can use the command-line console from the Console tab in either XenCenter or in vSphere. If you enable Secure Shell (SSH) access, you can also open any command prompt, such as PuTTY, and log on to App Controller. The following sections appear in the App

Controller command-line console:

Express Setup

With Express Setup, you can configure the basic network settings to enable App Controller to work within your network.

These settings include:

The App Controller IP address and subnet mask

The default gateway

The Domain Name Server (DNS)

The Network Time Protocol (NTP) server

For more information about using these settings, see Setting the App Controller IP Address for the First Time .

Clustering

You can install multiple instances of the App Controller virtual machine (VM) to create a cluster. One App Controller VM acts as the cluster head. All other App Controller VMs in the cluster are called service nodes. Each service node has a local database that is used by the service node only. Updating user information from the service node to the cluster head requires writing to the database. A service node connects to the database on the cluster head by using a secure channel.

Citrix recommends deploying two App Controller VMs in a high availability pair. Each VM is a cluster head. If one VM fails, the secondary VM can act as the cluster head. Citrix also recommends using the gateway proxy to establish a secure connection between the service node and the cluster head.

When you create the cluster head, you enter a shared key for the cluster. When you join additional VMs to the cluster, you enter the shared key. For more information about clustering, see Creating a Cluster .

High Availability

With high availability, you configure the settings for the primary and secondary App Controller VMs. These settings include:

The App Controller role (primary or secondary)

The IP address and shared key of the other App Controller VM

The option to start and stop the App Controller VM

The option to view the status of the App Controller VM

The option to enable or disable high availability

For more information about configuring high availability, see xmob-appc-ha-wrapper-con.html#clg-appc-ha-wrapper-con .

System Menu

With the System Menu, you can configure or view basic system settings that include:

The system date and time

The system disk usage

The option to enable or disable SSH access

The option to reset the test certificate

The option to import or export an App Controller configuration file

The option to configure a web proxy server

The option to restart and shut down App Controller

Troubleshooting

With Troubleshooting, you can access three tools that help you view network settings, view logs, and create a support bundle that you can send to technical support. In Network Utilities , you can do the following: citrix.com

125

View network information, including the loopback address.

Show the network routing table.

Show information from the Address Resolution Protocol (ARP) table.

Ping a network IP address or web site.

Display the network route and transit delay of packets by using traceroute.

Show DNS information by using DNS lookup.

Capture a network trace.

You can configure logs by using the Logging menu. In the menu, you can:

Set class and group logging levels to include any of the following information:

Info

Warn

Debug

Fatal

Error

Reset the logging level to the App Controller default setting.

Create a new log file.

Show the log file.

You can also create a support bundle to send to technical support staff for evaluation.

To view the App Controller date and time

You can view the date and time in App Controller.

Note: Citrix recommends using a Network Time Protocol (NTP) server to set the date and time on App Controller.

1. Log on to the command-line console.

2. In the Main menu, type and then press ENTER to open the System menu.

3. In the System

The day, date, time, time zone, and year appear.

To view the system disk usage

When you install App Controller, 50 GB of disk space is allocated in XenServer for the App Controller VM. You can use the command-line console to view how much disk space App Controller is using.

1. Log on to the command-line console.

2. In the Main

3. In the System

The system disk usage statistics appear.

Enabling or Disabling SSH Access

You can enable Secure Shell (SSH) access by using the command-line console. When you enable SSH access, you can log on to App Controller from an application that supports SSH, such as PuTTY. You can also enable or disable

SSH access from the App Controller management console.

To enable or disable SSH access by using the command-line console

1. Log on to the command-line console.

2. In the Main menu, type and then press ENTER to open the System menu.

3. In the System

4. Do one of the following: a. y b. y

To enable or disable SSH access in the management console

1. In the App Controller management console, click the Settings tab.

2. In the left pane, under System Configuration , click Network Connectivity .

3. In the right pane, next to Network Connectivity , click Edit .

4. Click Allow support access and then click Save .

citrix.com

126

To reset the App Controller server certificate

You can use the command-line console to change the default server certificate in App Controller. When you reset the certificate, App Controller removes the passphrase and the new certificate file overwrites the old certificate file. When you reset the default certificate, you must restart App Controller.

1. Log on to the command-line console.

2. In the Main menu, type and then press ENTER to open the System menu.

3. In the System

4. When Reset Certificate y

The certificate resets.

5. Restart App Controller.

To restart or shut down App Controller by using the command-line console

You can restart or shut down App Controller by using the command-line console.

1. Log on to the command-line console.

2. In the Main menu, type and then press ENTER to open the System menu.

3. Do one of the following: a. To restart App Controller, in the System

8 b. To shut down App Controller, in the System

9 citrix.com

127

citrix.com

128

Hello! I am an AI chatbot specifically trained to assist you with the Citrix 2.8 User manual. I have thoroughly reviewed the document and can help you locate the exact information you need or explain the content in clear and simple terms. Whether you’re looking for guidance on specific features, troubleshooting steps, or general usage, feel free to ask your questions. The more details you provide about your concerns or needs, the more accurately and effectively I can assist you!

Show related prompts

Assistant typing

Assistant is out of keyboard. Please, try again later.

Key features

Centralized user account management
Single sign-on (SSO) for web and SaaS applications
Unified enterprise app store for Android and iOS apps
Centralized policy controls for application and data security
ShareFile access with document-level control
Device inventory and management
Secure ticketing for MDX applications
Active Directory integration
Clustering for high availability
Data security for mobile apps

Frequently asked questions

App Controller 2.8 supports XenServer 5.6 with a minimum of Service Pack 1, XenServer 6.0, XenServer 6.1, Microsoft Server 2012 with Hyper-V enabled, Microsoft Hyper-V Server 2012, VMware ESXi 4.x, VMware ESXi 5.0.1, and VMware ESXi 5.1

App Controller 2.8 provides features like centralized user account management, single sign-on for web and SaaS applications, a unified enterprise app store, centralized policy controls, ShareFile access, device inventory and management, secure ticketing, Active Directory integration, clustering for high availability, data security, support for Worx Mobile Apps, and integration with XenDesktop and XenApp.

You can configure two App Controller VMs for high availability. If the primary App Controller fails, the secondary App Controller can accept user connections. Each App Controller VM must be in the same subnet. You can configure high availability by using the command line on the Console tab in XenCenter.

App Controller 2.8

What are the system requirements for App Controller 2.8?

What are the key features of App Controller 2.8?

How do I configure App Controller 2.8 for high availability?

Related

XenMobile 8.6 User Manual

XenMobile 8.7 User Manual

XenMobile 9 User Manual

Citrix Receiver for iOS Installation Guide | AI Chat & PDF Access

iOS Email Sign & Encrypt: AI Chat & PDF Access

Citrix ShareFile Workflows Manual - Read, Download, Ask

Citrix NetScaler Gateway Deployment Guide | AI Chat

Citrix StoreFront 1.2 User Manual | AI Chat & PDF

Tronia agrē iOS User Manual | AI Chat & PDF Access

Citrix MDX Toolkit 10.2.1 User Manual

Citrix MDX Toolkit 10 User Manual

Citrix Receiver Android App User Manual | AI Chat & PDF