APM webtop to Citrix - prefilling userid, domain for Citrix logon dialog

Question

Env:  Big-IP 4200v running 11.5.2 plain, APM fully licensed&nbsp;
Context:  APM webtop with Citrix Remote Desktop icon, accessing F5 pool of Citrix XML brokers, replacing Storefront; users login to APM via RSA credentials against RADIUS server, no user login to AD (but userid is the same); Citrix client type is new-ish Receiver (12.3), Citrix XenApp version is 7.1&nbsp;
In the described environment, the user logs in to APM by providing userid and RSA PIN/value, which are validated via RADIUS servers. We do not AD-authenticate as part of the APM login, because our F5s involved are in our DMZ, and we don't want them interacting with AD directly - and so we can't turn on "Auto Logon" in the Citrix desktop object, and can't insert an SSO Credential Mapping object (can i?).  The user gets to a webtop, and and then clicks on the Citrix remote desktop icon, they are prompted for their AD userid, password and domain, with an F5 generated dialog that will in turn provide the credentials to the XML brokers.  In this flow, we would like to pre-fill the userid from what they entered as part of their RADIUS login, and their domain from a hard-coded value.  &nbsp;
I inserted into the policy an Assignment object, I manually set session.logon.last.domain to our desired domain string, but the Citrix logon dialog did not pick it up. And I can't figure out how to insert the username from the session variable that holds it.&nbsp;
Is what I'm attempting possible?  Do I in fact need to insert an SSO Credential Mapping, even though we are just pre-filling variables, not actually doing SSO?&nbsp;

hamish · Answer

You can use auto-login. You just have to get the user to enter their AD password into the login form, and then use THAT password din the auto-login configuration.&nbsp;
I've done this when using secureID auth and AD. The APM authenticates using the secureID, and the AD password is saved in a DIFFERENT variable on the login form. The AD password isn't checked by APM, it's simply used to auto-login the user to Citrix. if the user gets their AD password wrong, they get all the web top icons, EXCEPT the ones that would appear from the Citrix XMLBroker.&nbsp;

lucas_thompson_ · Answer

You can do this, yes, but you'd have to manually edit the webtop code. Don't attempt it unless you have (or are a) a web developer on hand. Edits like these are not supported, and will not be preserved on upgrade or sync, such as between blades in a multi-blade environment. After you do these edits, you'll have to issue a "bigstart restart" to clear out the cache and regenerate it.

The file is here:
/var/sam/www/php_include/webtop/renderer/webtop_full/full/common/webtop_common.inc

Near the top of this file, you'll find some variable defs that look like:
var x = %{session.y}

Add these:

var mydomain = %{session.logon.last.domain};

var myusername = %{session.logon.last.username};

Note that you actually have access to all of the session variables, so this same sort of technique can be used to make any edits to this webtop that you want, and input custom information set during access policy execution.

Next look for the areas where "userInput" and "domainInput" are defined. This is the pop-up that appears when the citrix auto logon is unsuccessful. Add these lines so that the js sets the values you want:

domainInput.setAttribute('value',mydomain);

userInput.setAttribute('value', myusername);

You should back up the original page in case you encounter any trouble.

daboochmeister · Answer

Interesting (and good to know in general) - if Hamish's auto-login approach doesn't work for us for whatever reason, and we fall back to pre-populating the dialog fields, we'll try this.  Thanks!

hamish · Answer

Nope. No SSO credential mapping required. I did have to set the appropriate variable for the auto-login (Because secured requires the token code to be in the password variable).&nbsp;
H&nbsp;

hamish · Answer

Although in a later iteration, I added a code block BEFORE the Citrix auto-login (Which is part of the resource you attach) to copy the supplied AD password to the password field. That way could re-use the Citrix auto-login for both secured and AD password authenticated APM endpoints. (You probably won't need that :) )&nbsp;
H&nbsp;

Forum Discussion

APM webtop to Citrix - prefilling userid, domain for Citrix logon dialog

7 Replies

Recent Discussions

Chrome V 124+ on MacOS - Virtual Server Access Issue

vulnerabilities (CVE-2020-36363), CVE-2016-0736,CVE-2019-6593-FOR VERSION BIGIP LTM-16.1.4

Port Group on F5OS network setting

Advise on setting up IRULE

F5 iRule to replace host to path

Related Content

Webtop and icons

Creating a SSL VPN Using F5 Full Webtop

APM - Track clicks on webtop resources

Webtop Return Without Reauthentication

Webtop Return Without Reauthentication