Published through Citrix Xenapp Google Chrome fails after ver. 54 update

If after update, published through XenApp Chrome fails to launch or starts with corrupted screen (black screen), launch Chrome with Command Line

"C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" --no-sandbox --disable-infobars --disable-gpu

Xenmobile 9.0 MDM MAM Untrusted enterprise developer

Recently we had a problem with updating our mobile apps using Citrix Xenmobile 9.0 MDM + MAM. The problem was that during updating process the icon of updated app become blank and when you click on it, it shows this message "Untrusted Enterprise Developer".

We tried to go to profiles and click the button Trust there, but it was not our case (there wasn't any button), maybe because in case you use MDM trusted relationsip is setted automatically. 

After trying all rolling patches from 2 to 4 we didn't succeed.

Then I recalled that I did install this patch http://support.citrix.com/article/CTX204322 when we experienced problems with installing apps during update from ios8 to ios9. I applied it and it didn't work anyway, but unfortunately I leaved it (didn't roll back). I deleted this patch (it's enough to delete this file a_patch_900_9924.jar from \XenMobile Device Manager\tomcat\webapps\[instance_name]\WEB-INF\lib and restart XenMobile Service) and then it's worked.

There is also the the case that rolling back from MDM patch 4.0 to 3.0 is helped.

http://discussions.citrix.com/topic/380606-unstrusted-enterprise-developer-updating-worx-apps/

Политики XenMobile для управления мобильными устройствами

Политики разделены по платформам и, в зависимости от платформы, сильно разнятся.

В левой части окна управления политиками перечислены платформы поддерживаемых мобильных устройств (скриншот MDM консоли XenMobile версии 9).

На скриншоте представлены общие настройки для устройств на платформе Android: 

Для устройств Samsung на платформе Android представлены отдельные (специфичные) политики:

Политики для iOS устройств:

Пример iOS политики "Restrictions":

Некоторые политики для iOS работают только на supervised устройствах (подробнее можно почитать здесь: https://www.codeproof.com/blog/enabling-supervised-mode-for-iphone-ipad-and-ipod/)

Политики для устройств на платформе Windows Phone 8.x:

  

Не исключено, что в XenMobile 10 появились новые плафтормы и политики.

Партнеры Citrix могут заказать лабу XenMobile на сайте https://demo.citrix.com/ Развертывание тестовой среды происходит в автоматическом режиме и занимает около 6 часов.

XM9-XM10 Enterprise Upgrade Tool - Now Available

Hello,


XenMobile 10.1 Edition Upgrade Tool is now available. For upgrade you need to have running XenMobile 9.x with AppController.

Documentation available here: http://docs.citrix.com/en-us/xenmobile/10-1/xmob-upgrade-tsk.html

Short description of upgrade step:
1. Upgrade proccess doesn't move data from XM 9 to XM 10. It's copy data. Everything in XenMobile 9.0 remains intact until you move the XenMobile 10.1 server into production. Move to production means you put XM 10.1 server under LB vServer if you load balancing XM or you edit your main DNS entry with IP address of new XM 10.1 server.


2. First of all you need to copy production configuration data from XM 9 to XM 10.1 to feel how migration happens.

3. After succsessful copy of configuration data (enrolled devices are not included) you need to start copy process from scratch and do full production data copy (enrolled devices are included). Do it in isolated environment. After you have validated full production data copy, you can movie it to production environment.

Note: When users connect to XenMobile 10.1 in production, if for some reason you want to revert to XenMobile 9.0, those users must re-enroll in XenMobile 9.0. So be carefull when you put XM 10.1 in production. Try to fully validate this upgrade before you put it in production.

Citrix PVS: device is active so action cannot be done, but no device is active

Hi

Sometimes when you update your vDisk via diskUpdateDevice and then shutdown diskUpdateDevice to promote maintenance version to production, diskUpdateDevice status don't updated correctly and hangs on active status. You cannot delete vDisk maintenance version or delete the whole vDisk, you always get warning message "device is active so action cannot be done".

You can't mark down diskUpdateDevice either because there is no option for mark diskUpdateDevice down. But you can do it via powershell.

Open CMD as Administrator and run command:
"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\InstallUtil.exe" "C:\Program Files\Citrix\Provisioning Services Console\McliPSSnapIn.dll"

1. Open powershell
2. Type: Add-PSSnapin -Name McliPSSnapIn

3. Next connect to PVS if you are not launched power shell console at PVS server:
MCLI-Run setupconnection -p server=pvsservername,port=port

4. To find vDisk with name vD_02 type:
mcli-get disklocator -p disklocatorname="vD_02", storename=store1, sitename=cod

Return:
Executing: Get disklocator
Get succeeded. 1 record(s) returned.
Record #1
diskLocatorId:
diskLocatorName: vD_02
siteId:
siteName: COD
storeId:
storeName: STORE1
description:
menuText:
serverId:
serverName:
enabled: 1
role: 100
mapped: 0
active: 1
rebalanceEnabled: 0
rebalanceTriggerPercent: 25
subnetAffinity: 0
diskUpdateDeviceId: f6579c7d-413-4593-956f-4e02956786ea
diskUpdateDeviceName: XA_02

5. Our update device is "diskUpdateDeviceName: XA_02"

6. Next we need to find this device.
Go to vDisk Update Management - vDisks and find XA_02 in "VM" column.

7. Type:
mcli-get diskupdatedevice -p deviceName=XA_02

8. You will get:
mcli-get diskupdatedevice -p deviceName=XA_02

Executing: Get diskupdatedevice
Get succeeded. 1 record(s) returned.
Record #1
deviceId:
deviceName: XA_02
virtualHostingPoolId:
virtualHostingPoolName: vCenter
diskLocatorId:
diskLocatorName: vD_02
siteId:
siteName: COD
storeId:
storeName: STORE1
description:
deviceMac: 00-67-11-34-77-12
port: 6901
active: 1
adTimestamp:
adSignature:
logLevel: 0
domainName:
domainObjectSID:
domainControllerName:
domainTimeCreated:
ip: 10.
serverPortConnection: 6943
serverIpConnection: 10.
serverId:
serverName: PVS01
diskVersion: 40
status: 9
licenseType: 7
makLicenseActivated: 0
model:
license: 0

We see that device status is active (active: 1) though the device is shutted down.

9. So we need just change the device status.
Type:
mcli-run markdown -p devicename=XA_02
Executing: Run markdown
Run succeeded.

10. Now check status of diskupdatedevice by command:
mcli-get DiskUpdateDevice -p devicename=XA_02
You will see that status has been changed from "active: 1" to "active: 0"

Now you can delete maintenance version or whole vDisk.

2. Citrix XenMobile: Configuring Citrix AccessGateway and Citrix AppController 9

For configure AccessGateway to proxy connections to AppController you need:
1. Accessgateway with at least 10.1: Build 126.1203.e.nc (e means enhanced) in SmartAccessMode;
2. Configure authentication policy for AppController on AccessGateway;
3. Configure Session policy for ApPController on AccessGateway;
4. Add AccessGateway callback information in AppController settings.

In expression for AppController I'm using "zenprise", it works with android and iOS devices.

For multiple domain environment just create new authentication policy for sub domain and don't use SSO Name Attribute (leave field empty). Also, leave empty Single Sign-on domain domain in session policy PL_WX.

Now we need to configure AppController fo access from AccessGateway:

1. Go to https://appcontroller.company.com:4443/ControlPoint/

2. Click "Settings" - "Deploy" and configure accessgateway infromation like on the screenshot.

Thats it. You can verify your settings by connecting to accessgateway.company.com with WorxHome client (don't forget to uncheck "Require Device Manager enrollment in Settings -XenMobile MDM on AppController).

1. Citrix Xenmobile: Deploy prerequisites
2. Citrix Xenmobile: Configuring Citrix AccessGateway and Citrix AppController 9

1. Citrix Xenmobile: Deploy prerequisites

I'm trying to improve my writing English skill. A little awkward but I'm trying my best :)

Here we go!

Servers:
1. Two Xenmobile Device Manager servers for load balancing and redundancy.
2. Two Appcontroller servers for high availability (active/standby). You can use HA or cluster (with netscaler), you can't use LBVIP for load balancing Appcontroller servers.
3. Two Storage Zone Controller servers for load balancing and redundancy.
4. One license server with version 11.12
5. MPX or VPX Netscaler with 10.1: Build 126.1203.e.nc or 10.5 with e (e means enhanced, this version of build have Xenmobile or Sharefile Wizard which helps you quickly configure LBVIP for these servers). Its recomended to have Enterprise license. You can use Standrart license too, but you will not be able to use Xenmobile Wizard because for this you will need to have AAA feature enabled which included only to Enterprise Netscaler license. Imortant: You need to switch your AccessGateway from Basic Mode to SmartAccessMode and install Access Gateway Universal License (http://support.citrix.com/article/CTX126049). It's need for Micro VPN feature to be enabled. You still will be able to access your storefront through this accessgateway after switching to SmartAccessMode.
6. Optional. If you want to access to XenMobile/XenDesktop apps/desktops from WorxHome you will need two Storefront servers for load balancing and redundancy.

Public IP:
1. Public IP for Xenmobile Device Manager servers. If you want to load balance this servers you need to publish this LBVIP to external network.
2. Public IP for Access Gateway which will work as a proxy for AppController servers. If you already have Access Gateway published to external network with storefront (or WebInterface) session polices you can use this Access Gateway. Just add additional session policy for AppController.
3. Public IP for Storage Zone Controller servers (Sharefile Enterprise). If you want to load balance this servers you need to publish this LBVIP to external network.

External DNS records:
1. For Xenmobile Device Manager servers or LBVIP. For example: xmdm.company.com
2. For Access Gateway (if you not already have one). For example: agee.company.com
3. For Storage Zone Controller servers or LBVIP. For example: sharefile.company.com

Public SSL certificate:
1. For Xenmobile Device Manager servers you need public signed SSL certificate installed on Xenmobile Device Manager servers if you use SSL_BRIDGE (http://support.citrix.com/article/CTX136952) or on LBVIP if you use SSL Offload (http://blogs.citrix.com/2013/12/13/xenmobile-configure-ns-ssl-offload-for-device-manager/)
2.For Access Gateway which will work as a proxy for AppController servers. If you already use Access Gateway for Storefront with public SSL certificate,  you won't need additional public SSL certificate.
3. For Storage Zone Controller servers. If you want to load balance this servers you need to install SSL public certificate on LBVIP.

Internal SSL certiciate:
1. For AppController if you use Access Gateway.
2. For Storage Zone Controller servers. Internal SSL certificate need to be installed on IIS on each Storage Zone Controller server which you load balance.

Great thing for this is a wildcard certificate.

External Ports:
To:
1. 80, 443, 8443 to Xenmobile Device Manager servers or LBVIP.
2. 443 to Access Gateway.
3. 443 to Storage Zone Controller servers or LBVIP.

From:
1. Xenmobile Device Manager servers to:
1.1 Apple Push Notification Service (APNS):
gateway.push.apple.com:2195
feedback.push.apple.com:2196

It's good to use a whole Apple network 17.0.0.0/8 for this ports, because APNS host servers are load balancing and changing their IP addresses sometimes.
1.2 Appstore and Google play:
itunes.apple.com: 80 and 443
ax.itunes.apple.com: 80 and 443
ax.itunes.com: 80 and 443
play.google.com: 80 and 443
android.clients.google.com: 80 and 443

2. AppController servers to:
2.1 Appstore and Google play (Important thing: you need to open ports to appstore and google play from Xenmobile Device Manager and Appcontroller at the same time):
itunes.apple.com: 80 and 443
ax.itunes.apple.com: 80 and 443
ax.itunes.com: 80 and 443
play.google.com: 80 and 443
android.clients.google.com: 80 and 443

2.2 Sharefile Enterprise Account (company.sharefile.com for US or company.sharefile.eu for Europe. You will get this address when you will buy Sharefile licenses):
company.sharefile.com:443

Trusts:
You need trust relationship between:
1. Access Gateway and AppController (use only DNS (not IP), add and link root certificates in netscaler and appcontroller, use only 443 port).
2. Access Gateway and Storefront.
3. AppController and Storefront.

If you use same wildcard certificate to configure all servers you don't need additional configuration.

1. Citrix Xenmobile: Deploy prerequisites
2. Citrix Xenmobile: Configuring Citrix AccessGateway and Citrix AppController 9