Citrix Receiver configuration

Stratodesk makes sure NoTouch has latest versions of Citrix Receiver (formerly known as ICA client) for Linux integrated. Our Citrix Receiver implementation supports both ICA and HDX, as well as Flash, multimedia and USB redirection, making a perfect Citrix endpoint solution, without any need for installing software, cryptic configuration files or command line options! NoTouch provides a complete configuration environment for Citrix Receiver, so it is not necessary to directly work with Citrix' own configuration windows - everything can be configured and managed via the local NoTouch configuration menu as well as centrally with NoTouch Center.

The Citrix Receiver can be used for connecting to Citrix XenApp, XenDesktop, VDI-in-a-Box (successor to the Kaviza product), and all earlier Citrix software such as Presentation Server or MetaFrame. It can be run as a standalone application, run from the web browser, or "hidden" so that the end user just sees a login dialog and then the actual server connection. NoTouch also supports StoreFront.

This article gives an overview of the different configuration scenarios and later describes Citrix product specific configuration steps. We assume that you basically understand how NoTouch Receiver is configured and especially how server connections are created and configured. The Citrix Receiver for Linux differs in many aspects from the Windows-based Receiver, not only in terms of look&feel, but also in terms of available features and even bugs.

Citrix-based connection modes in NoTouch for XenApp and XenDesktop

Yes, you can use the web browser. However, we find that many people rather prefer a more "direct" approach, letting users connect and enter their credentials without going through a web browser. Several different session modes exist to facilitate different ways of using Citrix (note that "published application" can also refer to a full desktop). The most important two are:

Citrix/StoreFront. The mode of choice for using NoTouch with StoreFront (NoTouch 2.40.188 or later). It can be used to either run one resources (absolutely seamless to the end user) or show a menu where users can choose from - at your option!
Citrix/One application or desktop. Login to Web frontend (in the background!), then run a single published application or desktop. This creates the most seamless experience for end users, they will be taken directly into one specific published resource. This mode is what most people want.
Citrix/Program Neighborhood. Login to Web frontend (in the background!), and put all available published applications into the local Start Menu, allowing the user to choose from many available resources.

Please note that NoTouch Receiver configures the full Citrix client for each session. Citrix makes a different between client and session parameters, whereas NoTouch Receiver allows to set everything as session-dependent parameter. This gives you more flexibility, but could lead to problems in the rare case when several Citrix sessions with conflicting sessions are supposed to be started at the same time.

At the end of the day, it is always the client originating an ICA connection to a terminal server, no matter what session mode you use, what Citrix products you use.

One thing not mentioned in the list above is the possibility of starting a browser on the desktop device and have the user connect via browser; NoTouch Receiver considers this a browser session - see Firefox.

StoreFront connections to XenApp and XenDesktop

Setting up a connection to a Citrix StoreFront portal is really easy. Follow these simple steps:

Create a connection
Set its Connection Mode parameter to "Citrix/StoreFront"
Set the Citrix StoreFront URL into the Connection Target parameter
- You can also use the Citrix URL parameter of the Citrix options instead of Connection Target - both parameters work equally well
Make sure the client has access to all necessary Certificates. StoreFront is SSL-only, it is mandatory to install proper root certificates!

NoTouch will display a chooser if more than one published resources are available (otherwise, if it is only one, it will launch that without further questioning). If you want to go directly into one resource, please read below.

Starting directly into a specific application or desktop

If you want to start a specific resource instead of showing a chooser:

Set it into the Launch Resource parameter of the Citrix options, or
Make sure Citrix StoreFront offers only one resource. In that case, NoTouch will start the single available resource automatically.

Logoff timeout

By default NoTouch will close the StoreFront connection immediately after the actual published application or desktop is closed. This is expected in 99% of all use cases - you don't want your users to log off from a Windows desktop, walk away from the workstation but leave the StoreFront chooser open for anybody else...

However, if your use case is different, you can modify the StoreFront stay logged in parameter in the Citrix options. It is 0 by default (=immediate termination), any number of seconds is ok. Thus, if you type in 120, you would give your users two minutes (120 seconds) time to choose another connection out of the chooser window.

Citrix product specific information

XenApp

Registering at the Citrix Web frontend allows for better load balancing, reconnect and session distribution, since the user authenticates first to the connection broker, and after that starts a connection to a specified server. The session modes "Citrix/One application or desktop" and "Citrix/Program Neighborhood" take advantage of this:

Create a connection
Set session type to "Citrix/One application or desktop" or "Citrix/Program Neighborhood"
Save changes and then navigate to the "Citrix" parameter subcategory
Set the "Citrix URL" parameter to an URL containing the host name/IP address where the Web frontend is installed, such as http://mycitrix.mycompany.com/Citrix/PNAgent/config.xml
- Have your Citrix URL always refer to a config.xml if possible. Yes, you can abbreviate but only if the paths are standard like /Citrix/PNAgent on the server
If using "Citrix/One application or desktop", write the name of the desired published application into the "Launch Resource" parameter
Save changes

XenDesktop

XenDesktop also uses the ICA/HDX protocol and the Citrix Web service, so the configuration is similar to how you would configure XenApp. (Note that there is a special hint for XenDesktop 7 below...)

Create a connection
Set the connection mode to either (according to what you want to use)
- "Citrix/One application or desktop" (start one named desktop)
  - In this case please write the name of the desktop to be started into the "Launch Resource" parameter. Observe case, spaces, punctuation!
- "Citrix/Program Neighborhood" (get desktops added to local start menu)
Set the parameter "Citrix URL" in the Citrix parameter subtree to the URL where the Citrix Webservice resides

There are a few other hints you should consider (mostly these are fulfilled by default, but double check):

Workplace-Management has to be set to either none, disconnected or all. This will either reconnect no sessions (none), only disconnected sessions (disconnected) or all kinds of sessions (all).
The authentication method for the webxml service must be set to 'prompt'. 'passthrough' is NOT supported by the Linux Citrix Receiver.
Make sure the device is set to 24 bit colordepth and the ICA session is also using 24 bit colordepth.

XenDesktop 7 and higher

XenDesktop 7 and higher have - by default - only the StoreFront interface active. This is perfectly fine as you can use the Citrix/StoreFront connection mode. Only if you want to use the other modes that use config.xml, you need to enable "Legacy Support" according to this screenshot:

Access Gateway

Connecting via Citrix Access Gateway is, generally spoken, not different from connecting to a XenApp or XenDesktop. However, there are three things you need to be aware of:

Configuration of Access gateway and Citrix URLs. Please see http://support.citrix.com/article/CTX124937 for information on how make Access Gateway work directly with Citrix Receiver (i.e. NoTouch).
Citrix URLs: When just providing a short URL or even just a host name, NoTouch will add the standard config.xml path for you. People using Access Gateway are much more likely to change paths so the automatic completion won't work, you must provide the exact and correct URL to config.xml
Certificates: If you use HTTPS (SSL) with a self-signed/private certificate (and not one from a well-known certificate authority), then you must upload your root CA certificate to NoTouch. The Citrix Receiver does not offer an option to ignore unverifiable certificates nor does it offer to accept and store a private certificate for you (as a web browser does). It must be present before the connection is launched, no matter if you connect via browser or directly with the Citrix Receiver. See here for more information on how to deal with certificates in NoTouch: Certificates

Furthermore, you need to have Access Gateway configured correctly as well:

it must allow the connection from whereever you are connecting (IP/network range)
it must allow the connection from the user account and the user account must be allowed to connect from this network
it must allow the connection from a non-Windows machine and non-domain member
make sure that there are no redirects that only work "inside", no private IP addresses are used

The following article may be helpful as well: http://www.jasonsamuel.com/2012/04/10/how-to-setup-your-citrix-netscaler-access-gateway-and-web-interface-for-ipads-and-mobile-devices-that-use-citrix-receiver/

Note that if it works from another client, notably a Windows PC, this doesn't mean your Access Gateway is configured correctly. Especially when testing from inside your network with external URLs, you may experience a perfectly working scenario, and from outside it doesn't work. You might find out that your system would redirect to internal IP addresses or find similar error causes.

NetScaler

Similar to what is said above about NetScaler, in general there is no difference between connecting with or without NetScaler. However, there are three things you need to be aware of:

Configuration of NetScaler and PNAgent service. Please see http://support.citrix.com/article/CTX133771 for information on how configure PNAgent service (config.xml) on NetScaler.
Citrix URLs: When just providing a short URL or even just a host name, NoTouch will add the standard config.xml path for you. People using NetScaler are much more likely to change paths so the automatic completion won't work, you must provide the exact and correct URL to config.xml
Certificates: If you use HTTPS (SSL) with a self-signed/private certificate (and not one from a well-known certificate authority), then you must upload your root CA certificate to NoTouch. The Citrix Receiver does not offer an option to ignore unverifiable certificates nor does it offer to accept and store a private certificate for you (as a web browser does). It must be present before the connection is launched, no matter if you connect via browser or directly with the Citrix Receiver. See here for more information on how to deal with certificates in NoTouch: Certificates

The following article may be helpful as well: http://www.jasonsamuel.com/2012/04/10/how-to-setup-your-citrix-netscaler-access-gateway-and-web-interface-for-ipads-and-mobile-devices-that-use-citrix-receiver/

Note that if it works from another client, notably a Windows PC, this doesn't mean your NetScaler is configured correctly. Especially when testing from inside your network with external URLs, you may experience a perfectly working scenario, and from outside it doesn't work. You might find out that your system would redirect to internal IP addresses or find similar error causes.

VDI-in-a-Box

For VDI-in-a-Box connections you would also use the Citrix Receiver as described here in the article - use the "Citrix/One application or desktop" connection mode. The only notable difference is that the URL to config.xml looks a little bit different - please check the dedicated article about VDI-in-a-Box connections: VDI-in-a-Box

Legacy systems - Presentation Server, MetaFrame

There are three more "direct" Citrix modes that were used with earlier Citrix products such as MetaFrame and Presentation Server. Most people use either the web browser or the XenApp/XenDesktop modes (see above).

Legacy Citrix/ICA connect. Run a single ICA session to a host or published application. This was the main mode for Citrix terminal servers before XenApp/XenDesktop, mainly in Presentation Server deployments. Nowadays most people go for the other modes below:
Legacy Citrix/Built-in PNAgent view. Login to Web frontend (in the background!), then run what Citrix calls "PNAgent view on Linux" - a window showing icons for different published applications. The pnagent mode uses Citrix receiver's own GUI which is not as beautiful as it could be. We suggest to use Citrix/One application or desktop or Citrix/Program Neighborhood.
Legacy Citrix/ICA configurator. Run the Citrix configuration dialog (basically the wfcmgr binary, if you are familiar with the Citrix Receiver for Linux). This is somehow what one would see when running ICA client on any normal Linux. We discourage from using this, as ordinary end users will find this too complicated and are usually much better off with Citrix/One application or desktop or Citrix/Program Neighborhood.

The availability of these modes is also depending on the used Citrix client version. The Citrix client 13.x and above only allow "Legacy Citrix/ICA connect". If you need the other two modes, make sure you select the 12.x Citrix receiver in the "Citrix client version" parameter, pending availability in the NoTouch image that you use.

To make the simplest ICA connection possible, just follow these steps (in NoTouch Receiver or NoTouch Receiver):

Create a connection
Set session type to "Legacy Citrix/ICA connect"
Set "Connection target" to the host name of a Citrix-enabled terminal server (=XenApp server)
Save changes

Web browser

You can use the local built-in Web browser Firefox to connect to Citrix servers. In this case simply add a "browser" connection. Your users can surf to the Citrix Web fronted, log in, and start the applications.

In this scenario, make sure the server does not try to use the Java client - NoTouch Receiver has the native client built in and is advertising it to the server, so don't bother with downloading the Java client.

Note: In order to take advantage of all features such as drive mapping, you may have to execute Firefox with "root" permissions. To do so, please go to the Connection options, Extended, and enable "Force execution as root". Please read through the Firefox article to understand the implications.

Help! It's not fullscreen!

Connection modes Citrix/One application or desktop and Citrix/Program Neighborhood as well as connecting to Citrix via browser means that the actual session specification will be created on the server. This includes for example the window size. It is not possible to modify such settings from the client side - you must do it in the Citrix management console, e.g. setting the "window size" to Fullscreen.

Multimonitor/Dualscreen operation

The Citrix Receiver will take advantage of multiple monitors automatically and it will report screen geometry to the server. Please make sure Multimonitor support works, more information can be found here: Multimonitor operation with NoTouch

Two parameters influence the dualmonitor/multimonitor behavior - the effects of these parameters are entirely up to Citrix and may change with different versions of the Citrix client:

Use screens (span)
- Default. This is the default. All monitors are available will be used if present.
- All. Force using all monitors.
- No setting. NoTouch will not set this parameter at all when launching the Citrix client.
- Custom. The values from the "Custom span parameter" will be taken.
Custom span parameter (only if "Use screens" is set to custom. The following excerpt is from the Citrix manual:

   -span [h[[o][a|mon1[,m2[,m3,m4]]]  Set monitor spanning of full-screen sessions.

Most people will be fine with default settings, both in single- and in dual-monitor setups.

HTTPS/SSL and certificates

If you use private certificates, you must add your own certificate - please refer to the documentation on certificates.

The Citrix Receiver for Linux does not have any switch to simply ignore the certificate check. That means you can not just turn the checks off. This is a Citrix limitation.

USB forwarding

By default, USB forwarding is switched to on and USB devices will be forwarded to the server automatically. So called HIDs (human interface devices, such as keyboards, mice, but also mouse-emulating devices like digital dictation foot pedals) will not be forwarded, but rather handled locally and brought to the VDI desktop as keystrokes and mouse movements.

There are two parameters, both need to be enabled for USB forwarding to work (yes, the default is that both are on):

"Citrix USB forwarder" in the "Services" section
"Generic USB forwarding" in the ICA parameters section of the actual connection.

The Citrix USB forwarder is a system service, thus it can be configured from the "Services" parameters, not the Citrix ICA connection parameters. The startup behavior is controlled by the parameter named "Citrix USB forwarder" parameter. It has these options:

"with Citrix connection". This is the default. Start the Citrix USB forwarder only if there is a Citrix connection configured.
"off". Do not start the Citrix USB forwarder.
"on". Start the Citrix USB forwarder after system boot.

Futhermore, you can allow or deny specific devices by using the "Allow devices" and "Deny devices" parameters in the "Services"/"Citrix USB" parameters. These parameters directly modify Citrix' usb.conf file and thus accept the original Citrix syntax only [1]. Multiple stanzas, each one describing one device, stanzas separated by commas, can be added to either of these parameters. A stanza consists of tags that in turn have the form TAG=VALUE. Acceptable tags are:

VID Vendor ID from the device descriptor
REL Release ID from the device descriptor
PID Product ID from the device descriptor
Class Class from either the device descriptor or an interface descriptor
SubClass SubClass from either the device descriptor or an interface descriptor
Prot Protocol from either the device descriptor or an interface descriptor

Valid examples for either of the two parameters are:

VID=1460 PID=0008
Class=07 SubClass=06

The Information page of the local configuration application will present information about USB devices to you - this is the place how you can find out the VID or PID, for instance. Command line afficionados will prefer the lsusb command, preferably in lsusb -v form.

Please see the original Citrix documentation for more information [2]. Changes to these parameters need a reboot to become active.

HDX and Multimedia support

From within the "HDX/Multimedia" parameter section (a subsection of Citrix "ICA" parameters), several aspects of multimedia support of the ICA/HDX protocol can be configured.

HDX MediaStream Flash Redirection

Flash redirection is enabled by default. Please note that the list of software requirements on the server side is long and the list of supported software modules such as browsers is very short. You may have to adapt your VDI environment to meet Citrix requirements.

While for some time Citrix has required Flash version numbers to match on client and server, this is not required any more. In fact, the opposite is now true - Citrix suggests to disable the Flash version number check, as stated below and here: http://support.citrix.com/article/CTX134786

You should disable the Flash version check by adding/modifying Windows Registry Key on VDA, named “FlashPlayerVersionComparisonMask” which is a dword that should be set to zero.

This will need to set on each VDA:

32 bit OS: HKLM\\Software\\Citrix\\HdxMediaStreamForFlash\\Server\\PseudoServer
64 bit OS: HKLM\\Software\\Wow6432Node\\Citrix\\HdxMediaStreamForFlash\\Server\\PseudoServer

After making these modification you need to restart IE on VDA.

HDX RealTime Webcam Video Compression

HDX RealTime Webcam Video Compression needs audio input to be enabled both on client and server to work. NoTouch typically has audio input ("microphone in") disabled by default, so you have to turn this on. Besides that, no extra switch is necessary to enable HDX RealTime Webcam Video Compression, but there's still an extra switch to force the redirection, "HDX RealTime webcam video compression".

HDX RealTime Media Engine (MS Lync Optimization)

The HDX RealTime Media Engine is the main component behind what is commonly referred to as "MS Lync optimization" (to be a little more precise, the portion on the endpoint; the actual Lync optimization kit contains software for the VDI desktops that you have to install on the server-side [3]). For images that have it (from 2.35 on), it is present, but disabled by default - you need to set its parameter to "on". You can check if your image has it by checking the "Information" page of the local configuration window. It will display the version number of the HDX RTME, if present.

HDX 3D Pro GPU/H.264 acceleration

HDX 3D Pro GPU/H.264 acceleration is enabled by default. Switch it off by setting the "HDX 3D Pro GPU/H.264 acceleration" parameter to off.

If there are any issues regarding the session's resolution while HDX 3D Pro is active, please have a look at the follwoing article:

http://support.citrix.com/article/CTX131501

HDX Mediastream Windows Media Redirection

NoTouch includes GStreamer, as required by Citrix Receiver to support Mediastream Windows Media Redirection [4].

Printing

Printing works fine with Citrix in NoTouch. Please consult our Printer configuration page.

Expired passwords

The Citrix Receiver for Linux has a feature to allow users to enter a new password should theirs have expired. This has to be done before actually logging in, so it requires a special mechanism. Again, this functionality provided by the Citrix Receiver, it just needs to be configured properly - set these two parameter in the Citrix parameters correctly:

Kerberos KDC Server (Domain Controller Name). This needs to be a DNS host name or IP address of the Domain Controller. Please make sure the name is resolvable by DNS (i.e. not just a Windows/WINS name) - a simply test is to ping the name from the Console of a NoTouch system or any other non-Windows system such as a Mac.
Kerberos KDC Realm (Domain Name). Set this to the domain name of your AD domain.

Keep in mind that NoTouch systems are not members of the AD domain - this is the reason why you have to supply to these parameters to NoTouch, which in turn passes them on directly to the Citrix Receiver.

Smartcard support

Citrix can forward smartcard readers and use these for login purposes. U.S. Federal customers will enjoy the CAC card support. In that case, do not forward the smartcard reader with generic USB forwarding. Configure smartcard support according to these instructions:

Switch on the "Smartcard service (PCSCD)" in the "Services" options
- In most cases the default settings for the Smartcard driver parameter will be fine. Some readers need the Omnikey setting, not only Omnikey readers. You may have to experiment with that or contact support.
Set the "Smartcard login" parameter in the Citrix parameters to "on"

Note: For XenDesktop, do not attempt to use the generic USB forwarding mechanism to forward the smartcard reader (it won't be default, you would have to play with the settings). The downside is that then you can't use the reader for login purpose. It would work to forward a reader into the session only (ie without login) if that is what you want.

Advanced configuration

NoTouch comes with reasonable default values and should accomodate all Citrix options that are used by 99% of the people. However sometimes even deeper configuration accesses are necessary. NoTouch comes with an easy-to-use method of modifying Citrix INI files: Citrix Receiver configuration files

Furthermore, you can totally rewrite the files that are used to generate the Citrix configuration, which would work by the template mechanism.

Selecting the Citrix Receiver version

Most NoTouch images have at least two Citrix Receiver versions included. Yes, you read that correctly, two different versions of the Citrix product, so you can select the one that fits your use case better. By default, the newer client will be used. At the time of writing, this is the 13.1 Receiver and the alternative, older Receiver is 12.1.

To switch to an alternative version of the Citrix Receiver, use the "Client version (if present)" parameter in the Citrix options. You may have to scroll down a bit to find it, it is pretty far down below.

Citrix considerations

Citrix has a lot of options, some combinations may have strange effects. Most people are fine with the defaults, in fact Stratodesk recommends to change something only when a) necessary and b) advised to do so. Stratodesk can not provide support for Citrix installation, be sure to have a Citrix professional at hand when troubleshooting.

More detailed information can be found in Citrix Receiver for Linux 13.1 eDocs - you can skip the part about installation and integration, since this is already done in NoTouch.

In case something does not work as expected, always open a Citrix support case before contacting Stratodesk.