SSO doesn't work with Citrix deployed on BIG-IP
Hi guys, We would like to use our F5 (LTM&APM fully licensed) instead of Netscaler Gateway for access to our Citrix Farm therefore we have recently deployed the newest iApp (f5.citrix_vdi.v2.3.0) to get this configured and I can see some issues with single sign-on already. I can get to the F5 website (Virtual Server - DNS record created) and log-in successfully with my AD credentials but then it will take me to one of our website hosted on our Citrix WI server (Web Interface) which will ask me to log-in again. Providing the same set of credentials I can log in and access all the resources just fine. It looks like the SSO does not work - not passing on my credentials from F5 website to Citrix Web Interface. What am I missing here? Has anyone seen this before? Thanks,Citrix XenApp and XenDesktop
More and more organizations are using the BIG-IP system to secure, optimize, and scale their Citrix XenApp/XenDesktop deployments. Since the days when these applications were known as MetaFrame, F5 has been testing and tuning the BIG-IP system for Citrix implementations, and detailing the procedures first in our deployment guides, and now in our iApp templates for Citrix as well. Not only can the BIG-IP system act as a replacement for the Citrix Web Interface servers, but it can securely proxy Citrix ICA traffic using TCP optimization profiles which increase overall network performance for your application. You also have the option to configure the BIG-IP APM with smart card authentication or with two factor authentication using RSA SecurID. The following simple, logical configuration example shows one of the ways you can configure the BIG-IP system for Citrix Xen deployments. In this example, the BIG-IP APM Dynamic Presentation Webtop functionality is used to eliminate the need for the Citrix Web Interface StoreFront server tier. With BIG-IP APM, a front-end virtual server is created to provide security, compliance and control. The iApp template configures the APM using Secure ICA Proxy mode. In secure ICA proxy mode, no F5 BIG-IP APM client is required for network access. The BIG-IP system uses SSL on the public (non-secure) network and ICA to the servers on local (secure) network. See the deployment guide for more information. Seehttps://devcentral.f5.com/s/articles/citrix-vdi-iapp-templatefor information on using the iApp template to configure the BIG-IP system for Citrix. See https://f5.com/solutions/deployment-guidesto find the appropriate deployment guide for quickly and accurately configuring the BIG-IP system for Citrix XenApp/XenDesktop. If you have any feedback on these or other F5 guides or iApp templates, leave it in the comment section below or email us at solutionsfeedback@f5.com. We use your feedback to help shape our new iApps and deployment guides.
Citrix APM with ICA proxying
We've set up F5 in front of citrix xendesktop 7.11 using the iApp and everything seems to be working but when actually launching an app like notepad through the browser it opens a new tab called citrix receiver but the tab shows nothing but black. We've configured the iapp to proxy ICA traffic and authenticate users and the Storefront 3.7.0.39 (version included in 7.11) loads just fine. From the logs we've been able to locate so far nothing is jumping out at us. Any suggestion on where to look next? Sorry for the lack of info but I'm not sure what would be useful info here and what isn't. Thanks!
