Access Citrix Virtual Apps and Desktops resources with the Web Interface

One or more computers running Citrix Virtual Apps and Desktops creates a server farm. If your enterprise network contains a server farm, you can deploy Citrix Gateway to provide secure Internet access to published applications or virtual desktops by using the Web Interface.

In such deployments, Citrix Gateway supports the Web Interface and the Secure Ticket Authority (STA) to provide authentication, authorization, and redirection to published applications hosted on a computer running Citrix Virtual Apps or to virtual desktops provided by Citrix Virtual Desktops.

This functionality is achieved by integrating Citrix Gateway with the Web Interface, Citrix Virtual Apps, and Desktops. This integration provides advanced authentication and an access control option to the Web Interface. For more information about the Web Interface, see the Web Interface documentation in the Citrix documentation library.

Remote connectivity to a server farm does not require the Citrix Gateway plug-in. To access published applications or desktops, users connect by using Citrix Workspace app.

Integrate Citrix Gateway with Citrix Virtual Apps and Desktops

When you configure Citrix Gateway for user connections, you can include settings for network traffic to Citrix Virtual Apps, Citrix Virtual Desktops, or both. To do so, you configure Citrix Gateway and the Web Interface to communicate with each other.

The tasks for integrating these products include:

• Creating a Web Interface site in the Citrix Virtual Apps and Desktops farm.
• Configuring settings within the Web Interface to route user connections through Citrix Gateway.
• Configuring Citrix Gateway to communicate with the Web Interface and the Secure Ticket Authority (STA).

You can also configure Citrix Gateway to communicate with a Citrix Virtual Apps server farm by deploying Citrix Gateway in a double-hop DMZ. For more information, see Deploying Citrix Gateway in a Double-Hop DMZ
.

Citrix Gateway and Web Interface use the STA and Citrix XML Service to establish user connections. The STA and XML Service run on the Citrix Virtual Apps and Desktops server.

Establish a secure connection to the server farm

The following example shows how Citrix Gateway deployed in the DMZ works supports the Web Interface to provide a secure, single point-of-access to published resources available in a secure enterprise network.

In this example, the following conditions exist:

• User devices from the Internet connect to Citrix Gateway by using Citrix Workspace app.
• The Web Interface resides behind Citrix Gateway in the secure network. The user device makes the initial connection to Citrix Gateway and the connection is passed to the Web Interface.
• The secure network contains a server farm. One server within this server farm runs the Secure Ticket Authority (STA) and the Citrix XML Service. The STA and the XML Service can run on either Citrix Virtual Apps and Desktops.

Process Overview: User Access to Published Resources in the Server Farm

1. A remote user types the address of Citrix Gateway; for example, https://www.ag.wxyco.com, in the address field of a web browser. The user device attempts this SSL connection on port 443, which must be open through the firewall for the connection to succeed.
2. Citrix Gateway receives the connection request and users are asked for their credentials. The credentials are passed back through Citrix Gateway, users are authenticated, and the connection is passed to the Web Interface.
3. The Web Interface sends the user credentials to the Citrix XML Service running in the server farm.
4. The XML Service authenticates the user credentials and sends the Web Interface a list of the published applications or desktops the user is authorized to access.
5. The Web Interface populates a webpage with the list of published resources (applications or desktops) that the user is authorized to access and sends this webpage to the user device.
6. The user clicks a published application or desktop link. An HTTP request is sent to the Web Interface indicating the published resource that the user clicked.
7. The Web Interface interacts with the XML Service and receives a ticket indicating the server on which the published resource runs.
8. The Web Interface sends a session ticket request to the STA. This request specifies the IP address of the server on which the published resource runs. The STA saves this IP address and sends the requested session ticket to the Web Interface.
9. The Web Interface generates an ICA file containing the ticket issued by the STA and sends it to the Web browser on the user device. The ICA file generated by the Web Interface contains the fully qualified domain name (FQDN) or the Domain Name System (DNS) name of Citrix Gateway. The IP address of the server running the requested resource is never revealed to users.
10. The ICA file contains data instructing the web browser to start Citrix Workspace app. The user device connects to Citrix Gateway by using the Citrix Gateway FQDN or DNS name in the ICA file. Initial SSL/TLS handshaking occurs to establish the identity of Citrix Gateway.
11. The user device sends the session ticket to Citrix Gateway and then Citrix Gateway contacts the STA for ticket validation.
12. The STA returns the IP address of the server on which the requested application resides to Citrix Gateway.
13. Citrix Gateway establishes a TCP connection to the server.
14. Citrix Gateway completes the connection handshake with the user device and indicates to the user device that the connection is established with the server. All further traffic between the user device and the server is proxied through Citrix Gateway. The traffic between the user device and Citrix Gateway is encrypted. The traffic between Citrix Gateway and the server can be encrypted independently, but is not encrypted by default.