Access

CTX-Blog

powered by Ecki's Place

March 24, 2009

AAC and IE 8.0

Some days ago, Microsoft officialy released IE 8.0. Since IE 8.0 will be available trough Windows Update soon, more and more users will hit existing AAC deployments with this browser. Unfortunately this is not working as expected. This is, how an AAC portal page looks like in IE 8.0 with default settings:

Portal
OWA

The layout is crushed, links are missing and OWA is nearly unusable 🙁

A small change in the file C:\Inetpub\wwwroot\CitrixSessionInit\NUI.aspx solves the display issue by forcing IE 8.0 into IE 7.0 compatibility mode.

It is sufficient to add the following line in the header of the NUI.aspx file:

<meta http-equiv=”X-UA-Compatible” content=”IE=EmulateIE7″ />

Your header might look like this after the change:

<html xmlns="http://www.w3.org/1999/xhtml">
<head>
<title>Citrix Access Gateway</title>
<meta http-equiv="X-UA-Compatible" content="IE=EmulateIE7" />
<meta name="GENERATOR" content="Microsoft Visual Studio .NET 7.1" />
<meta name="CODE_LANGUAGE" content="C#" />
<meta name="vs_defaultClientScript" content="JavaScript" />
<meta name="vs_targetSchema" content="http://schemas.microsoft.com/intellisense/ie5" />
<link rel="SHORTCUT ICON" href="themes/default/images/favicon.ico" type="image/vnd.microsoft.icon" />
<base id="baseElement" href="" runat="server" />
<link id="cssElement" rel="stylesheet" href="" runat="server" />
<!--[if IE]>
<style type="text/css">

Immediately your portal is rendered again as it should be 🙂

Portal
OWA

This is not a final solution for the problem, but until Citrix releases a fix for this issue it will do…

Regards
Ecki

July 29, 2008

Update – AAC tuning, part 4

I had to upgrade the document, because a customer wanted to set the color of the bar to a dark blue. The caption inside the bar could not be read anymore after this change, so we had to change the color of the caption to white. This way we got the contrast needed back. How to do that is added to the document now.

The howto is written in german. A translation into english is not available at the moment. Since the pdf utilizes a lot of pictures, you might be able to understand it anyway. As soon as i find the time, i will provide a translated version. Until then, you can download the german version here: AAC4_5_CustomizeLogonPoint_Rev1.1_DE.pdf

Regards
Ecki

July 12, 2008

AAC tuning, part 4

To adjust the look of an AAC LogonPoint at the CI of a company is not as easy as it is with a Citrix Web Interface deployment. In the following PDF i will show you a way to get there anyway.

The howto is written in german. A translation into english is not available at the moment. Since the pdf utilizes a lot of pictures, you might be able to understand it anyway. As soon as i find the time, i will provide a translated version. Until then, you can download the german version here: AAC4_5_CustomizeLogonPoint_Rev1.1_DE.pdf

This is, what your LogonPoint could look like after reading this document:
Angepasster LogonPoint - LoginAngepasster LogonPoint - Portal

Additional documentation about customizing an AAC LogonPoint can be found here:

  • Basic Customization of the Advanced Access Control 4.x Logon Point
  • How to Customize the Default View for Web Interface 4.6 When it is Embedded in Access Gateway Advanced Edition
  • And here you can find a currently very interesting article about AAC and FireFox 3.0:

  • Access Interface Appears Incorrectly with Firefox 3.0
  • Regards
    Ecki

    May 7, 2008

    AAC hotfix AAC450W003 and CAG hotfix 4.5.7 available

    A few days ago, Citrix released the hotfixes AAC450W003 and hotfix AG2000_v457. Beside a couple of bug fixes, there are some really interesting things in these releases:

    Hotfix AAC450W003 invalidates some parts of my last posting in “AAC tuning, part 3”. A couple of months ago, i asked Citrix to allow customers to change the caption of the RADIUS input box on the logon page. In my last article i showed a way to change the caption easily for RSA and SafeWord deployments and pointed out a way to change the text with a little script in case of another RADIUS solution. However this solution had some unwanted side effects and so i’m glad that Citrix came up with a solution for all deployments. The procedure described in the first section of “AAC tuning, part 3” stays valid but is now applicable for all RADIUS deployments too, given you installed hotfix AAC450W003 correctly.

    Vista is now supported with AAC 4.5, but it is still beta. This means, that you are now able to check Vista clients through EPA-scans, provided by Citrix. My first tests have been successfull. CAUTION: If you use EPA-scans from EPAFactory/Accario you have to wait for an update from Accario to support AAC 4.5 HF03. This should be available around the 20th of Mai.

    The list of supported AV scanner and personal firewalls has become a little longer. McAfee 8.5i, Symantec AVE 10.0, Symantec Endpoint Protection 11.0 and Trend Micro 8.0 are now officially supported at last.

    The download and readme for AAC can be found here: CTX117123, AAC45W003

    The download and readme for CAG 4.5.7 can be found here: CTX117123, Hotfix AG2000_v457

    Regards
    Ecki

    December 15, 2007

    AAC tuning, part 3

    Two Factor Authentication with RSA, SafeWord or any other third party RADIUS solution is a common way to authenticate in a secure manner to an AAC deployment. AAC however labels the input box for the OTP (One Time Password) fix with the text “SecurID-PASSCODE”, “SafeWord CODE:” oder generic with “RADIUS Password”.

    Endusers however know their OTP solution most of the time with other names, the name of the RADIUS solution provider for example. This can lead to confusion during the login process.

    This problem is easily solved for RSA SecureID and SafeWord. A solution for RADIUS is described further down. As in part 1 and 2, the solution can be found in the “web.config” file in the root of the respective LogonPoint directory.

    On a standard AAC server this is presumably:

    C:\Inetpub\wwwroot\CitrixLogonPoint\#LogonPointName#

    There is an other version of this file in the “C:\Inetpub\wwwroot\CitrixLogonPoint\” directory which should stay untouched !

    This file can be opened and edited with any editor like the Windows NotePad. In the last third of the file you can find a section <appSettings>, which gives you some interesting possibilities. Among other things you can configure the lables for the OTP field, so that it displays a text your users expect. All it needs, is to change the following line below the <appSettings> section:

    <add key=”SecondaryAuthenticationPromptOverride” value=”Password:” />
    and
    <add key=”SecondaryAuthenticationToolTipOverride” value=”Enter Password” />

    Where “Password:” stands for the text to be displayed as lable and “Enter Password” stands for the text, displayed as tool tip.

    The section should look like this afterwards:

    <appSettings>
    <add key="DebugConsoleTrace" value="False" />
    <add key="AdvancedGatewayClientDownloadUrl" value="http://www.citrix.com" />
    <add key="AdvancedGatewayClientActivationDelay" value="10" />
    <add key="MaxConnectionsToAuthenticationService" value="20" />
    <add key="LogonPointId" value="00000000-0000-0000-0000-000000000000" />
    <add key="DeployedBy" value="LACONFIG" />
    <add key="ExtendedSecurIdFunctionalityEnabled" value="true" />
    <add key="SecondaryAuthenticationPromptOverride" value="SafeWord PIN + Zahlencode:" />
    <add key="SecondaryAuthenticationToolTipOverride" value="PIN und Zahlencode eingeben" />
    <!- -

    After saving the changes, a user calling this manipulated LogonPoint should now see the new lable.

    This method unfortunately works only for RSA SecureID and SafeWord. The text displayed, when using a third party RADIUS solution is hard coded and not that easy to manipulate. There is a pending feature request at Citrix, but it isn’t clear, when a solution will be publicly available.

    At last I found a very good work-around in the Citrix AAC Forum, published by Joel Donaldson. A simple manipulation of the BasePage.aspx file of the respective LogonPoint solves the problem in an elegant way.

    With an english LogonPoint it is sufficient, to add the following paragraph before the </body> tag:

    <script type="text/javascript" language="JavaScript">
    document.body.innerHTML=document.body.innerHTML.replace("RADIUS Password:","Kobil Einmalpasswort:");
    </script>

    The result will look like this:
    Loginprompt nach der Manipulation

    If you want to support german LogonPoints also, you need another code block that respects the german notation:

    <script type="text/javascript" language="JavaScript">
    document.body.innerHTML=document.body.innerHTML.replace("RADIUS-Kennwort:","Kobil Einmalpasswort:");
    </script>

    Other languages can be added easily this way.

    If someone is asking itself why this works, this short explanation may help. The script code is looking for the string “RADIUS Password:” in the delivered web page and replaces it with the second parameter of the function “document.body.innerHTML.replace”, in our example “Kobil OTP:”.

    Attention, this works only, if JavaScript is enabled in the browser. If JavaScript is disabled, the original text “RADIUS Password:” is displayed. This modification shouldn’t have any other side effects.

    < < AAC tuning, part 2

    !!! Please read the first comment to this post !!!

    Regards
    Ecki

    November 15, 2007

    Access Gateway hotfix 4.5.6

    Citrix released HotFix 4.5.6 of the Access Gateway Standard, which eliminates another couple of bugs. Before the update to version 4.5.6 the number of connections from the Secure Access Client and Citrix Presentation Server Clients could be different in the Real-Time Monitor or on the Statistics tab in the Administration Tool. Another fix adresses this issue: When users are logged on to the Advanced Access Control option through the Access Gateway, when users logoff, the session is not disconnected. Users must manually disconnect by right-clicking the Secure Access Client and selecting Disconnect.

    If the Access Gateway appliance is upgraded to version 4.5.6, and Access Gateway Advanced Edition with hotfix AAC450W001 is installed on a server in the internal network, users are prompted to install the ActiveX control each time a connection is created. Currently, the file web.config has the following at the end of the file:

    <add key="SACCodebase" value="net6helper.cab#version=4,5,0,122" />
    </appSettings/>
    </configuration/>

    The version number needs to be changed to the correct version and build number for 4.5.6, which is 4,5,6,111.

    The full list of fixes and the download can be found here.

    Regards
    Ecki

    September 17, 2007

    Access Gateway hotfix 4.5.5 Rev. B

    After the summer holidays and several very busy weeks, i have found the time again to carry on with these pages 🙂

    Citrix released Revision B of the Access Gateway HotFix 4.5.5 today, which eliminates a couple of bugs. After the update to version 4.5.5 some CAG Standard installations experienced a freeze every 10 to 20 minutes or even worse 2 to 3 crashes/reboots a day. The “reason” for this behavior was the configuration of more than one STA on the CAG Standard. After the update to Rev. B this bug should be eliminated.

    Additional fixes for the SAC roll out and the EPA download are included. Furthermore the SAC should close now more reliably in AAC deployments. The full list of fixes and the download can be found here.

    Regards
    Ecki

    July 21, 2007

    AAC 4.5 update available

    July 20.: Citrix yesterday released the Hotfix AAC450W001 for Citrix Access Gateway Advanced. This update comprises a couple of new features and options. Beside others, the main improvements are IMHO the following issues:

    • WANScaler integration (protocol and TCP optimizations through the SSL VPN client)
    • Support for Web-enabled Mobile Devices

    Since a couple of security updates are comprised in this Package, administrators shouldn’t wait with installing this update.

    The download and aditional informations can be found here.

    Regards
    Ecki

    May 28, 2007

    AAC tuning, part 2

    AAC admins that deploy LogonPoints with RSA SecureID, SafeWord or any other Two Factor Authentication solution know the dilemma. The token realy boosts security, but if the token isn’t at hand, there is no way to access internal resources. Fortunately this is not imperativ. A LogonPoint configured with Two Factor Authentication must not always require a One Time Password.

    As in part 1, the solution can be found in the “web.config” file in the root of the respective LogonPoint directory.

    On a standard AAC server this is presumably:

    C:\Inetpub\wwwroot\CitrixLogonPoint\#LogonPointName#

    There is an other version of this file in the “C:\Inetpub\wwwroot\CitrixLogonPoint\” directory which should stay untouched !

    This file can be opened and edited with any editor like the Windows NotePad. In the last third of the file you can find a section <appSettings>, which gives you some interesting possibilities. Among other things you can configure Two Factor Authentication such, that a One Time Password is not mandatory. All it needs is to change the following line below the <appSettings> section:

    From
    <add key=”SecondaryAuthenticationIsOptional” value=“false” />
    to
    <add key=”SecondaryAuthenticationIsOptional” value=“true” />

    The section should look like this afterwards:

    <appSettings>
    <add key="DebugConsoleTrace" value="False" />
    <add key="AdvancedGatewayClientDownloadUrl" value="http://www.citrix.com" />
    <add key="AdvancedGatewayClientActivationDelay" value="10" />
    <add key="MaxConnectionsToAuthenticationService" value="20" />
    <add key="LogonPointId" value="00000000-0000-0000-0000-000000000000" />
    <add key="DeployedBy" value="LACONFIG" />
    <add key="ExtendedSecurIdFunctionalityEnabled" value="true" />
    <add key="SecondaryAuthenticationIsOptional" value="true" />
    <!- -

    After saving the changes, a user calling this manipulated LogonPoint will still see the prompt for RSA, SafeWord, or RADIUS passcode, but he is now able to leave this field empty and log in with just his username and password.

    This manipulation creates a big hole in your security configuration, but this hole can be easily closed again. All that is needed is to reconfigure your filters and policies.

    The filter for full access must require RSA, SafeWord, or RADIUS authentication. Therefore the filter generator allows to use the authentication strength as a criteria. Only users using strong authentication get access to all resources.

    Authentication Strength

    A user that has no access to his token is nevertheless able to authenticate without a One Time Password. But now an other filter is matched (you can create the same filter as for full acces, but without strong authentication) and an other, more restrictive policy becomes active. This way, the user is at least able to work in a restricted environment, then to stop working 🙂

    < < AAC tuning, part 1 AAC tuning, part 3 >>

    !!! Please read the first comment to this post !!!

    Regards
    Ecki

    May 23, 2007

    AAC tuning, part 1

    Is there any AAC admin happy with the way, EPA scans behave? Once you create just one EPA scan in the AMC (Access Management Console), the EPA scan gets started automatically on every LogonPoint, regardless whether this is wanted/needed or not.

    This behavior is for example very annoying at OWA (Outlook Web Access) LogonPoints, that are created only to allow restricted access to the personal mail from anywhere. To operate “client less” from anyplace, anywhere, no EPA scans may be required. On a standard LogonPoint the EPA scan appears anyway with his download and installation directions. If you click on the “Skip Scan” button, you can proceed without scanning your PC, but the download of the EPA scan client still takes place in the background, steeling you valuable bandwidth. In addition, less computer versed users in an internet cafe with restricted PCs might end up trying to install the EPA scan client over and over without a chance to succeed…

    Recently I stumbled upon an option that is able to stop this “misbehavior”. Well hidden and badly documented, the chances are good, that only few people discovered this option so far. The solution can be found in the “web.config” file in the root of the respective LogonPoint directory.

    On a standard AAC server this is presumably:

    C:\Inetpub\wwwroot\CitrixLogonPoint\#LogonPointName#

    There is an other version of this file in the “C:\Inetpub\wwwroot\CitrixLogonPoint\” directory which should stay untouched !

    This file can be opened and edited with any editor like the Windows NotePad. In the last third of the file you can find a section <appSettings>, which gives you some interesting possibilities. Among other things you can disable EPA scans here. All it needs is to add the following line below the <appSettings> section:

    <add key=”EndpointAnalysisDisabled” value=“true” />

    The section should look like this afterwards:

    <appSettings>
    <add key="DebugConsoleTrace" value="False" />
    <add key="AdvancedGatewayClientDownloadUrl" value="http://www.citrix.com" />
    <add key="AdvancedGatewayClientActivationDelay" value="10" />
    <add key="MaxConnectionsToAuthenticationService" value="20" />
    <add key="LogonPointId" value="00000000-0000-0000-0000-000000000000" />
    <add key="DeployedBy" value="LACONFIG" />
    <add key="ExtendedSecurIdFunctionalityEnabled" value="true" />
    <add key="SecondaryAuthenticationIsOptional" value="false" />
    <add key="EndpointAnalysisDisabled" value="True" />
    <!- -

    After saving the changes, a user calling this manipulated LogonPoint will now be forwarded immediately to the login prompt without seeing any EPA “nag screen” 🙂

    AAC tuning, part 2 >>

    !!! Please read the first comment to this post !!!

    Regards
    Ecki