Forum Discussion

Henrik_S's avatar
Henrik_S
Icon for Nimbostratus rankNimbostratus
Oct 20, 2015

APM - Wyse ThinOS - Password change while logon to webtop for citrix WI/SF replacement

Hello,

 

Environment: Citrix XenApp 7.6 BIG-IP APM 11.6 HF5 With Webtop for Storefront/Web Interface replacement

 

Normal logon functions fine and users are able to access Citrix resources. But, if an user is prompted from AD to change their password, they are unable to do so from Wyse ThinOS. Wyse ThinOS gives an error Message saying that the password neeeds to be between 4-8 characters.

 

If the users logs on to the same Access profile from a normal browser they are able to change their password through the logon page.

 

BR, HS

 

BIG-IP Access Policy Manager (APM)
deployment
security
  • Lucas_Thompson_'s avatar
    Lucas_Thompson_
    Historic F5 Account
    Oct 21, 2015

    This function isn't really supported for Receiver clients. There is an existing bug ID to track this issue (439351).

     

    What's the end user experience exactly? It sounds like it's not very good. Are you talking about pre-emptive password change (password about to expire but not yet expired), or are you talking about "user must change password at next logon" (password is actually expired)?

     

  • Henrik_S's avatar
    Henrik_S
    Icon for Nimbostratus rankNimbostratus
    Oct 27, 2015

    Thank you for clarifying the issue. The problem occurs when the password is actually expired and as you state they are unable to change password through Receiver clients.

     

    Are there any updates to the bugID 439351? How old is it and will we see any progression in the near future?

     

  • Henrik_S's avatar
    Henrik_S
    Icon for Nimbostratus rankNimbostratus
    Oct 29, 2015

    Thank you for your replies. I tested to change the password through the ordinary Citrix Receiver with no luck. I then read up on https://support.f5.com/kb/en-us/solutions/public/13000/800/sol13894.html and after the changes I was able to change an expired password through Citrix Receiver on Windows.

     

    However, I am unable to make the WTOS clients connect to APM using StoreFront mode. The only way that I am able to make the WTOS client logon and connect to APM is to set it to use legacy PNAgent mode: PnliteServer=https:// CAGAuthMethod=LDAP

     

    And then, if the password is expired I am asked to change it. If I enter a password of more than 8 characters, it fails with an error saying it must be between 4 and 8 chars. If I enter a password of 8 characters that complies to the domain policy, the password change fails.