Gateway

Access Citrix Virtual Apps and Desktops resources with the Web Interface

January 8, 2024

Contributed by:

One or more computers running Citrix Virtual Apps and Desktops creates a server farm. If your enterprise network contains a server farm, you can deploy Citrix Gateway to provide secure Internet access to published applications or virtual desktops by using the Web Interface.

In such deployments, Citrix Gateway supports the Web Interface and the Secure Ticket Authority (STA) to provide authentication, authorization, and redirection to published applications hosted on a computer running Citrix Virtual Apps or to virtual desktops provided by Citrix Virtual Desktops.

This functionality is achieved by integrating Citrix Gateway with the Web Interface, Citrix Virtual Apps, and Desktops. This integration provides advanced authentication and an access control option to the Web Interface. For more information about the Web Interface, see the Web Interface documentation in the Citrix documentation library.

Remote connectivity to a server farm does not require the Citrix Gateway plug-in. To access published applications or desktops, users connect by using Citrix Workspace app.

Integratr Citrix Gateway with Citrix Virtual Apps and Desktops

When you configure Citrix Gateway for user connections, you can include settings for network traffic to Citrix Virtual Apps, Citrix Virtual Desktops, or both. To do so, you configure Citrix Gateway and the Web Interface to communicate with each other.

The tasks for integrating these products include:

Creating a Web Interface site in the Citrix Virtual Apps and Desktops farm.
Configuring settings within the Web Interface to route user connections through Citrix Gateway.
Configuring Citrix Gateway to communicate with the Web Interface and the Secure Ticket Authority (STA).

You can also configure Citrix Gateway to communicate with a Citrix Virtual Apps server farm by deploying Citrix Gateway in a double-hop DMZ. For more information, see Deploying Citrix Gateway in a Double-Hop DMZ.

Citrix Gateway and Web Interface use the STA and Citrix XML Service to establish user connections. The STA and XML Service run on the Citrix Virtual Apps and Desktops server.

Establish a secure connection to the server farm

The following example shows how Citrix Gateway deployed in the DMZ works supports the Web Interface to provide a secure, single point-of-access to published resources available in a secure enterprise network.

In this example, the following conditions exist:

User devices from the Internet connect to Citrix Gateway by using Citrix Workspace app.
The Web Interface resides behind Citrix Gateway in the secure network. The user device makes the initial connection to Citrix Gateway and the connection is passed to the Web Interface.
The secure network contains a server farm. One server within this server farm runs the Secure Ticket Authority (STA) and the Citrix XML Service. The STA and the XML Service can run on either Citrix Virtual Apps and Desktops.

Process Overview: User Access to Published Resources in the Server Farm

A remote user types the address of Citrix Gateway; for example, https://www.ag.wxyco.com, in the address field of a web browser. The user device attempts this SSL connection on port 443, which must be open through the firewall for the connection to succeed.
Citrix Gateway receives the connection request and users are asked for their credentials. The credentials are passed back through Citrix Gateway, users are authenticated, and the connection is passed to the Web Interface.
The Web Interface sends the user credentials to the Citrix XML Service running in the server farm.
The XML Service authenticates the user credentials and sends the Web Interface a list of the published applications or desktops the user is authorized to access.
The Web Interface populates a webpage with the list of published resources (applications or desktops) that the user is authorized to access and sends this webpage to the user device.
The user clicks a published application or desktop link. An HTTP request is sent to the Web Interface indicating the published resource that the user clicked.
The Web Interface interacts with the XML Service and receives a ticket indicating the server on which the published resource runs.
The Web Interface sends a session ticket request to the STA. This request specifies the IP address of the server on which the published resource runs. The STA saves this IP address and sends the requested session ticket to the Web Interface.
The Web Interface generates an ICA file containing the ticket issued by the STA and sends it to the Web browser on the user device. The ICA file generated by the Web Interface contains the fully qualified domain name (FQDN) or the Domain Name System (DNS) name of Citrix Gateway. The IP address of the server running the requested resource is never revealed to users.
The ICA file contains data instructing the web browser to start Citrix Workspace app. The user device connects to Citrix Gateway by using the Citrix Gateway FQDN or DNS name in the ICA file. Initial SSL/TLS handshaking occurs to establish the identity of Citrix Gateway.
The user device sends the session ticket to Citrix Gateway and then Citrix Gateway contacts the STA for ticket validation.
The STA returns the IP address of the server on which the requested application resides to Citrix Gateway.
Citrix Gateway establishes a TCP connection to the server.
Citrix Gateway completes the connection handshake with the user device and indicates to the user device that the connection is established with the server. All further traffic between the user device and the server is proxied through Citrix Gateway. The traffic between the user device and Citrix Gateway is encrypted. The traffic between Citrix Gateway and the server can be encrypted independently, but is not encrypted by default.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Access Citrix Virtual Apps and Desktops resources with the Web Interface

January 8, 2024

Contributed by:

January 8, 2024

Contributed by:

Access Citrix Virtual Apps and Desktops resources with the Web Interface

Integratr Citrix Gateway with Citrix Virtual Apps and Desktops

Establish a secure connection to the server farm

Process Overview: User Access to Published Resources in the Server Farm

In this article