Citrix Cloud Storefront

Posted on  by



The reason this pops up is due to a functionality called “Citrix Content Collaboration (sharefile)”. Disabling this feature should eliminate this logon window and should allow the Storefront connector to work as intended. Citrix Virtual Apps and Desktops (CVAD) 1912 LTSR CU2; XenApp/XenDesktop 7.15.7000 LTSR; XenApp/XenDesktop 7.6 LTSR CU9; Citrix Profile Management 2103; Citrix Provisioning 2012; Citrix App Layering 2104; Citrix StoreFront. StoreFront 1912 LTSR CU2 through 3.5; StoreFront 2.6 through 3.0.9000; Citrix ADC / NetScaler. Citrix ADC 13; Citrix ADC.

After attending Citrix Synergy this week, there is no denying that Citrix is quite serious about their cloud offerings and announced more offers that will be arriving later this year. This includes offerings like their Citrix Analytics Services and Workspace Service, but still it will take some time before these services will be available. Today Citrix Cloud consists of multiple services such as XenApp and XenDesktop Essentials, ShareFile, XenMobile and the “plain” XenDesktop deployments which are labeled Apps & Desktops.

So if you plan to start using Citrix Cloud today, what do you need to think about? It is an important fact to know that Citrix Cloud is not a solution which manages your VDA agents (meaning where you applications and data is stored) it is about controlled management plane with additional services.

Brief overview of the architecture
This shows the architecture on Citrix Cloud with Apps and Desktop Service. You have an active subscription with Citrix Cloud and you setup a integration between your resources and Citrix Cloud using a Cloud Connector whic his the link between your resources and Citrix Cloud. These Cloud Connectors are stateless and
To ensure security compliance, the Connector will self-manage. So do not disable reboots or put other restrictions on the Connector virtual machines. These actions prevent the Connector from updating itself when there is a critical update.

Limitations
In Citrix Cloud, Citrix will manage the XenDesktop infrastructure for you, this includes delivery controllers, backend site database, license server and such. Also you will automatically get updated every two weeks as part of it as well which provides us with access to new functionality directly. So what do we as customers need to maintain?

  • * VDA Agents (endpoints such as VDI or Session Hosts)
    * NetScaler appliances (Unless using NetScaler Gateway as a Service)
    * Storefront (Unless using Citrix Cloud Hosted Storefront)
    * RDS Licenses and RDS License Server
    * Active Directory (We need to bring our own)

So what else are we missing out on?
* Logging and Auditing (Since we do not have the option to check logs on who has been logged into Citrix Cloud from a management perspective.) In case we need to figure out who has logged in Citrix has extensive internal auditing information. If a customer has a concern, contact Citrix within 30 days. They will review the audit logs to determine which of the customer’s administrators performed an operation, on what date, from which IP address, etc.
* The Citrix Cloud control plane is only hosted in the United States, which might pose as an issue for customers who want their resources to be in EMEA.
* The customer owns and manages the Resource Locations. It can be created in any data center, cloud, location, or geo desired. All critical business data (such as documents, spreadsheets, etc.) are in the Resource Locations and are under customer control.

Access from the end-users and management
In regular Citrix XenDesktop and XenApp enviroments we can give end-users access from multiple types of authentication mechanisms such as Smart Cards, SAML, OAuth, KDC Constrained Delegation and even regular LDAP based as well. This allows us to utilize Azure AD or Google IAM to delegate authentication to them as identity providers. Citrix Cloud only supported regular Active Directory authentication for regular end-users. From a management perspective they support Azure AD which allows us to specify which people are allowed to access the management plane.

Using Azure AD as identity provider allows us to get some more insight into who has authenticated into Citrix Cloud, but it does not give us any insight into who has done “what”.

Using Storefront in Cloud
You also have the option if you want to have Storefront hosted from Citrix Cloud as well. When you set this up the end-users can access it from the .xendesktop.net/Citrix/StoreWeb/'>https://<customername>.xendesktop.net/Citrix/StoreWeb/ address. This address cannot be changed. Using this service has still some limitations when it comes to UI customization options, also the ability to do more advanced features such as Optimal Gateway Routing and other Authentication options such as SAML. But again it is a question if you want to manage your own Storefront servers or consume it as a service.

Using NetScaler Gateway as a Service
If you plan on using Citrix XenApp Essentials, NetScaler Gateway as a Service is the default option since it does not require any type of configuration or deployment of virtual instances since it is actually running as a Windows Service on the Citrix Cloud Connector machine. This service is actually “ICA-proxy” as a service it does not provide anyof the Smart Access features such as SSL VPN, Endpoint Analysis, support for the newer protocols such as Framehawk and EDT as well. Also from an authentication perspective it does not provide any other options that regular pass-trough from Storefront option.

You can also use NetScaler Gateway as a service as an option for regular Citrix Cloud deployments as well. You need to be aware of since this is a cloud service running in Citrix Cloud all traffic will be routed trough from your endpoint to Citrix Cloud to the Cloud Connectors and to the VDA agents. This feature is natively supported in Citrix Reciver and Receiver for Web as well.

NGaaS is a multi region geo load balanced services which is available on different locations around the world, and will always try to route a user to the closest PoP. Note that if you do not have PoP which is close to your location you might suffer with higher latency values than setting up your own NetScaler virtual appliances. Also NGaaS does not provide any AppFlow analytics which means that we do not have the insight we might be used to in Insight Center or MAS, it will give information about ICA RTT and such within Citrix Director.

Here is a chart of where the closest PoPs are located:

Eight PoPs in Azure
Azure South Central US
Azure West Europe
Azure Australia East
Azure East US
Azure West US
Azure North Europe
Azure Japan East
Azure Brazil South

Three PoPs in Amazon
US-East
US-West
EU-Centra

Concurrent Users: No Limit
Data Transfer Limit per user: No Limit
Overall Bandwidth Up to 250 Mbps – Can be scaled up with setting up multiple Citrix Cloud Connectors wherever your resources are located.

Cloud health and SLA
Citrix has an SLA for all their different cloud services on 99.9 every 30 days. They also have their own status page for all cloud offerings here –> http://status.cloud.com/

And they have also implemented an subscribe option which allows us to send notifications to Slack or other Webhooks directly to our Service Management tool –> http://status.cloud.com/subscribers/new


NOTE: The status page does not show if there is any planned Maintance.

Is Citrix Cloud an option for me?
After having a lot of good conversations and discussions with customers and partner at Citrix Synergy I got a lot of good feedback which I want to share directly.

* I don’t wanna manage Citrix I just want to deliver my apps and desktops and make it easy for my end-users
* I like the OpEx model for Citrix but they need to make it easier for adjust licenses for our end-users directly.
* For large enterprises we require complete visibility and full role based access control based upon what kind of responbiility our IT-staff has, Citrix Cloud does not have that option yet.

Now I don’t think that Citrix Cloud is going to replace any large XenApp/XenDesktop Enterprise solutions anytime soon, I belive that Citrix cloud will provide customers with an even broader range of deployment options to choose from depending on what kind of setup they are looking for. If you are considering a Citrix Cloud setup, you can use a finished a deployment guide from Citrix here –> http://tools.cloud.com/

downloadWhy can't I download this file?1. Open a Remote Desktop Session to the storefront server.
2. Open the StoreFront Management Console.
3. On the StoreFront Management Console, select Manage Authentication Methods.

4. On the Manage Authentication Methods window, select SAML Authentication.
5. Open Windows PowerShell ISE as Administrator in storefront server.
6. Run the following code in Windows PowerShell ISE.

Citrix Cloud Storefront 構築


Note: Remember to change the value of the $storeVirtualPath variable to reflect the name of your actual store.
$storeVirtualPath='/Citrix/Saml'
$auth=Get-STFAuthenticationService-Store (Get-STFStoreService-VirtualPath$storeVirtualPath)
$spId=$auth.AuthenticationSettings['samlForms'].SamlSettings.ServiceProvider.Uri.AbsoluteUri
$acs=New-ObjectSystem.Uri$auth.Routing.HostbaseUrl, ($auth.VirtualPath +'/SamlForms/AssertionConsumerService')
$md=New-ObjectSystem.Uri$auth.Routing.HostbaseUrl, ($auth.VirtualPath +'/SamlForms/ServiceProvider/Metadata')
$samlTest=New-ObjectSystem.Uri$auth.Routing.HostbaseUrl, ($auth.VirtualPath +'/SamlTest')
Write-Host'SAML Service Provider information:
Service Provider ID: $spId
Assertion Consumer Service: $acs
Metadata: $md
Test Page: $samlTest'
7. This command will output the SAML Service Provider Information.
Create the Application in Azure
8. On your web browser, navigate to portal.azure.com.
9.Log in with your Microsoft Azure credentials.
10. Open WvdAzure Active Directory.
11.On the Azure Active Directory blade, select Enterprise Applications.
12.On the Enterprise Applications blade, select New Application.
13.On the Add an application blade, select Non-gallery application.
14. On the Add your own application blade, enter a name for the application and click Add.

15.After the application is crated, on the new application blade, under Manage select Users and Groups.

16.On the Users and Groups blade, select Add user.
17.On the Add Assignment blade, select Users and Groups.
18.On the Users and groups blade, select theAD Users or Groups to which you want to provide access.
19. Click Select.
20.On the Add Assignment blade select Assign.
21.Back on the application blade, under Manage select Single Sign-On.

Citrix Cloud Vs On Prem


22.On the Single Sign-On blade, under Single Sign-on Mode, select SAML-based Sign-on.

23.Under step 2 Domain and URL's, enter the following information.

Citrix Cloud Portal


a. Identifier (Entity ID): Service Provider ID from step 7.
b. Reply URL: Assertion Consumer Service from step 7.
24. On step 3 User Attributes, make sure user.userprincipalnameCitrix cloud storefront download is selected as the Citrix cloud portalUser Identifier.

25.On step 4 SAML Signing Certificate, click on Metadata XML.

26.Click Save on the top of the blade.Citrix cloud storefront server
Note: This will download an XML file to your computer.
27. Place the Metadata XML file on a directory on your StoreFront Server.
28. Open Windows PowerShell ISE as Administrator one more time.
29. Run the attached code in Windows PowerShell ISE.

Citrix Cloud Storefront Sign In


Note: Remember to change the value of the $storeVirtualPath variable to reflect the name of your actual store, and the value of the –FilePath parameter to reflect the actual path of the file in your computer.
Get-Module'Citrix.StoreFront*'-ListAvailable|Import-Module
$StoreVirtualPath='/Citrix/Saml'
$store=Get-STFStoreService-VirtualPath$StoreVirtualPath

Citrix Cloud Storefront Server

$auth

Citrix Cloud Storefront Login

=Get-STFAuthenticationService-StoreService$store
Update-STFSamlIdPFromMetadata-AuthenticationService$auth-FilePath'C:FedMetStoreFront.xml'