Web Computing with MetaFrame

Web Server Configuration

Three configuration tasks may be required in order to set up your Web server to support Web-enabled MetaFrame applications:

• MIME type configuration is required whether or not you'll be implementing NFuse.

• Installation of the ICA Java client is required in order to support the Java applet on the client browser.

• Installation and configuration of the NFuse Java objects is required only if you're implementing NFuse.

MIME Type Configuration

When a Web server passes a file to a client's Web browser, it tells the browser what type of file it is, so that the browser can select the appropriate application to process the file. The Web server can recognize a file type by mapping the file's extension to a list of Multipurpose Internet Mail Extension (MIME) types. For a Web client to be able to process an ICA file, you need to register the proper MIME type information on the Web server. Here's the MIME type information:

Microsoft Internet Information Server (IIS) 4.0/5.0

You configure the MIME type information on an IIS server by opening the Microsoft Management Console (MMC), right-clicking the Internet Information Services entry, and selecting Properties from the menu. Then click the Edit button for the Computer MIME map and click the New Type button to open the dialog box shown in Figure 15.18.

Figure 15.18
 MIME type configuration in IIS 5 on Windows 2000.

Apache

For Apache, you use the AddType directive in the httpd.conf configuration file to add the ICA MIME type. The syntax is as follows:

AddType application/x-ica ica

You need to stop and restart Apache for the changes to take effect.

ICA Java Client Configuration

If you plan to provide access to published applications using the ICA Java client running as a Java applet, you must install the client on the Web server. The installation instructions are identical to those given in the earlier section "Installing the Java Client," with one exception. Make sure that you install the class files in a directory that's accessible by all clients from a Web browser. If you're running IIS, you could place the Java files in a directory called JICA11 off the Inetpub\wwwroot directory.

After the ICA Java class files have been installed, you only need to configure the Web page to access the appropriate signed Java archive. I talk about Web page creation shortly.

NFuse Web Server Configuration

Different NFuse Web server installation files are available, depending on the operating system and Web server software you're running. On Windows, NFuse supports Microsoft IIS 4.0 and higher; on UNIX, NFuse supports Netscape Enterprise Server and Apache Web server. Both sets of installation files can be downloaded from the Citrix Web site (http://www.citrix.com/). For 2000/NT, the installation file is called NFuseWebExt.exe; for UNIX it's NFuseForUNIX.tar.gz.

---

Warning - As I mentioned earlier in the chapter, unless SSL is being used to encrypt the HTTP data between a Web browser and an NFuse-enabled Web server, the user credentials (user ID, password, and domain) will be transmitted in clear text. The NFuse logon page should never be hosted on an unsecured Web server.

---

Microsoft Internet Information Server

---

Warning - The installation of the NFuse Web component requires that the IIS service be stopped on the server. Make sure that your Web server is not currently servicing user requests before you perform this installation.

---

Do the following to install the NFuse Web extensions on IIS:

1. Log on to your IIS server and launch NFuseWebExt.exe.

2. If the ISS services are currently running, the setup program warns you that they must be stopped for installation to continue. If you say Yes, all necessary services will be stopped before the installation continues.

3. After selecting the destination location for the installation files, choose typical or custom installation. I recommend that you install the sample files along with the NFuse components.

4. In the dialog box shown in Figure 15.19, provide the name and port for the MetaFrame server that's currently running the NFuse service. Enter the appropriate hostname and click Next.

5. Indicate where the root URL is located on the physical file system. Be sure to enter the complete path.

6. The next screen summarizes the selections you made. When you're satisfied, click Next to complete the installation. After installation is complete, the IIS service is automatically restarted. You don't have to restart the Windows server.

Figure 15.19
Selecting the MetaFrame host and port where the NFuse service is running.

The values entered during the installation, plus some other system-wide settings for NFuse, are located in the file NFuse.properties, which can be found in the %systemroot%\java\trustlib directory on an NT server. The following is a sample of the contents of this file:

CitrixPN_ContentType=text/html
SessionFieldLocations=Script,Template,Url,Post,Cookie,Properties
Timeout=60
Version=Preview
SessionField.NFuse_CitrixServer=NFuseSvc
SessionField.NFuse_CitrixServerPort=80
SessionField.NFuse_IconCache=/NFuseIcons/
SessionField.NFuse_TemplatesDir=C:\\Inetpub\\wwwroot\\NFuseURLMapping./=C:\\Inetpub\\wwwroot

Notice that the MetaFrame server, port number, and URL home information are stored here. Changes to this file don't take effect until you stop and restart the Web server.

Apache Server on Red Hat Linux

The installation of the NFuse component for Linux is fairly straightforward. After downloading and extracting NFuseForUNIX.tar.gz, start the text-based setup program by running setupNFuse.

1. After selecting to install the NFuse components and accepting the license agreement, select the Web server software that you're running and press Enter.

2. You must provide the full path to the document root for the Web server. The Apache default is /usr/local/apache/htdocs. Provide the correct path and then press Enter to continue.

3. Provide the location for the NFuse Java objects. The default is /usr/local/jserv/NFuse. Press Enter after entering the desired path.

4. You're asked whether you want to install the sample NFuse Web site. I recommend that you do so because it will provide you with some sample pages on which you can base your site. The default target location is the NFuse directory under your Web root.

5. Provide the virtual directory for servlets on your server.

6. Specify the directory in which NFuse icons will be stored to assist in generating the user-specific Web pages. The default is Nfuseicons off the Web root. I recommend providing an alternate name for this directory, because it's set up as writeable by everyone.

7. Provide the hostname for the MetaFrame server on which the NFuse service is running.

8. The final prompt asks you to provide the port number for the NFuse service. After the necessary files are copied, you're returned to the main setup screen, where you can exit the installation.

9. The final step you need to perform is to update the CLASSPATH line in the appropriate .profile file to include the full path to nfuse.jar, ctxxml4j.jar, and NFuse.properties.

10. Restart Apache for the changes to take effect.

The values entered during the installation, plus some other system-wide settings for NFuse, are located in the file NFuse.properties, which can be found in the directory that you specified for the NFuse Java objects during the installation. By default, this is /usr/local/jserv/NFuse. The following is a sample of the contents of this file:

Version=Preview
SessionFieldLocations=Script,Template,Url,Post,Cookie,Properties
SessionField.NFuse_ContentType=text/html
URLMapping./=/usr/local/apache/htdocs
SessionField.NFuse_IconCache=/NFuseIcons/
SessionField.NFuse_TemplatesDir=/usr/local/apache/htdocs/NFuseTemplates
SessionField.NFuse_CitrixServer=NFuseSvc
SessionField.NFuse_CitrixServerPort=80
DTDDirectory=/usr/local/jserv/NFuse/Timeout=60

Notice that the MetaFrame server, port number, and URL home information are stored here. Changes to this file won't take effect until you stop and restart the Web server.

Developing the HTML Page

Now that you have the ICA client, MetaFrame, and Web servers configured, the final step is the creation of the Web page and ICA files that users will use to connect to the available published applications.

Two different tools are available for creating the HTML and ICA files. Which one you use depends on whether you're implementing NFuse. The two tools are as follows:

• Citrix ALE Wizard. This tool is provided as part of the Published Application Manager on each MetaFrame server. It's used if you're not implementing NFuse.

• Citrix Web Site Wizard. This tool is provided as part of the NFuse MetaFrame installation component. It allows you to create a simple NFuse interface that you can then customize or use as is.

Citrix ALE Wizard

To make your published application available to Web clients, you must create a Web page with the proper information in it. Citrix provides the ALE Wizard to assist you in creating both a properly configured HTML file and an accompanying ICA file if required. You don't have to use this wizard to create your Web page, but the generated file does demonstrate what HTML tags you need to use and provides a nice template that you can then customize as required.

The ALE Wizard is accessed from within the Published Application Manager, located under Start, Programs, MetaFrame Tools (Common). To create a Web page using the ALE Wizard, follow these steps:

1. To start the ALE Wizard, right-click the icon for the application that you want to place in the Web page. Select the Write HTML File option, as shown in Figure 15.20. (You can also find this option under the Application menu.)

Figure 15.20
Selecting the Write HTML File option.

2. The first dialog box prompts you to decide how much assistance you need. If this is your first time using this tool, I suggest that you select A Lot! Please Explain Everything. This option provides detailed information on every dialog box. In contrast, the other option, Not Much. I've Done This Before, displays the minimum dialog boxes required to generate the HTML and ICA file. For this example, select the A Lot! option, and then click Next.

3. Decide whether to use an existing ICA file or create a new one. In this example, I'll select Create a New ICA File.

4. The dialog box shown in Figure 15.21 appears. Here you specify the size and color depth at which to display the application when it's accessed through the Web page. I chose 640x480 and 256 colors.

Figure 15.21
The ICA File Window Size and Colors dialog box.

5. The next screen lets you select the required encryption for the MetaFrame session. Even though you can select any encryption level, the actual level used depends on what encryption is available on the MetaFrame server that's publishing the application. If you need strong encryption, make sure that the MetaFrame server has been configured with the SecureICA option pack. Select the desired level and then click Next.

6. You're prompted to provide a name for the ICA file. When choosing a name, it's suggested that you select one that's eight characters or less to ensure that all browsers will be able to access it properly. Be sure to include the .ICA extension.

7. The next dialog box prompts you to specify whether the application is embedded or launched. If you select Launched, skip ahead to step 10; otherwise, continue with step 8.

8. If you selected Embedded, you have the choice of creating a page based on the Netscape plug-in/ActiveX control or the Java ALE client (see Figure 15.22). Choose the desired client type and click Next. For this example, I'll choose the Java client.

Figure 15.22
Selecting the desired ALE client type for an embedded application.

---

Tip - In order for the Java ALE client to work, the ICA Java client must be installed on the Web server. Refer back to the "Web Server Configuration" section of this chapter for more information.

---

9. Specify the size of the window on the Web page. This is the space allocated on the page for the application, not the dimensions of the application itself. The application will be contained within this window. I recommend that you specify this size to equal the window size that you selected in step 4. Enter the width and height and click Next.

10. The next dialog box asks whether you want to create a verbose page. The verbose page includes comments and additional content that help explain how the page is configured. The non-verbose page contains only the HTML source required to display the application window or link.

11. The final dialog box prompts you to provide a name for your Web page (see Figure 15.23). Again, it is suggested that you use a filename consisting of eight characters or fewer to ensure compatibility with all browsers. Remember to include the .HTM or .HTML extension. I recommend that you give this page the same filename that you assigned to the ICA file in step 6.

Figure 15.23
Specifying the HTML filename.

After you click Finish, a screen explains that the generated Web page is only a template and requires editing before it can be used in a production environment. In particular, you need to update the CODEBASE property in the HTML file to point to the location where you installed the Java classes. Here is the resulting HTML file that I created for embedding Outlook Express within a Web page using the Java client:

<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML//EN">
<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<meta name="METAMARKER" content="null">
<title>Demo Application Page</title>
<script language="VBScript">
<!—
option explicit
dim majorver
dim ua
dim ie3
dim ie4
dim aol
dim minorver4
dim update
dim winplat
dim nav
dim intButton
set nav = navigator
ua = "Mozilla/2.0 (compatible; MSIE 3.02; Windows NT)"
minorver4 = ""
if len(ua) >=1 then 'nav object is supported
  winplat = mid(ua,instr(ua,"Windows") + 8, 2)
  majorver = mid(ua,instr(ua,"MSIE") + 5, 1)
  ie3 = majorver = 3 and (winplat = "NT" or winplat = "95" or winplat = "32")
  ie4 = majorver = 4 and (winplat = "NT" or winplat = "95" or winplat = "32")
  update = instr(ua,"Update a")
  aol = instr(ua,"AOL")
  if ie4 then minorver4 = mid(ua,instr(ua,"MSIE") + 7, 3)
end if
—>
</script>
</head>
<body>
<script language="Javascript">
<!—
 var browserType=navigator.userAgent;
 if (browserType.indexOf("Mozilla")!=-1 &&browserType.indexOf("/4.")!=-1)
   {
    document.write("<applet codebase=. code='com.citrix.JICA.class'
     archive='JICAEngN.jar' width=640 height=480><!—");
   }
 else
   {
    document.write("<applet codebase=. code='com.citrix.JICA.class'
     archive='JICAEng.zip' width=640 height=480><!—");
   }
// —>
</script>
    <applet codebase=. code='com.citrix.JICA.class' archive='JICAEngJ.jar'
     width=640 height=480>
<script language="Javascript">
<!—
 var browserType=navigator.userAgent;
 if (browserType.indexOf("Mozilla")!=-1 || browserType.indexOf("MSIE")!= -1)
   { document.write("—>"); }
—>
</script>
    <param name=cabbase value='JICAEngM.cab'>
    <!param name=Address    value="n.n.n.n">
    <param name=Address   value="Outlook Express">
    <param name=TCPBrowserAddress   value="192.168.1.5">
    <param name=Start   value="auto">
    <!param name="Username"  value="whatever">
    <!param name="Domain"   value="whatever">
    <!param name="Password"  value="whatever">
    <param name="InitialProgram" value="#Outlook Express">
    <!param name="WorkDirectory" value="dir">
    <!param name=EndSessionTimeout value=n>
    <param name=Border value=on>
    <!param name=BorderWidth value=6>
    <!param name=ICAPortNumber value="whatever">
    <!param name=LargeCacheSize value="6543210">
</applet>
</body></html>

---

Tip - An exclamation point (!) before the <param name> tag simply comments out that information.

---

Notice that the file contains JavaScript to use the appropriate signed Java archive based on the user's Web browser.

To test the resulting files, you should do the following:

• Update the HTML file to point to the location where you installed the ICA Java client files. For example, if they're located in the directory JICA11 off the root directory for the Web server, the CODEBASE entries would be updated to read as follows:

  codebase=/JICA11/

  And the CABBASE value for the Java CAB file would be updated to read this way:

  "/jica11/JICAEngM.cab"

• Copy the files (HTML and ICA) to the desired location under the root of the Web server. You should place both of these files in the same directory.

• Launch your Web browser and point it to the desired file.

To test the generated files, make sure that they're located in the same directory and then access the HTML page through a Web browser. Figure 15.24 shows the Web page that I generated with Outlook Express embedded within the Web page.

Figure 15.24
Outlook Express running as an embedded application within a Web page.

The following is the accompanying ICA file that was also generated by the ALE wizard for my embedded Outlook Express example. Notice that the browser address entry is automatically populated with the IP address. You can modify this to use the server name instead.

[WFClient]
Version=2
TcpBrowserAddress=192.168.1.5
[ApplicationServers]
Outlook Express=
[Outlook Express]
Address=Outlook Express
InitialProgram=#Outlook Express
DesiredHRES=640
DesiredVRES=480
DesiredColor=2
TransportDriver=TCP/IPWinStationDriver=ICA 3.0

Citrix Web Site Wizard

NFuse's answer to the ALE wizard is the Web Site Wizard (WSW). The Web Site Wizard is a separate component that, although a part of the MetaFrame installation component, can be run on any 32-bit operating system. The installation of the wizard is straightforward. Launch the NFuse MetaFrame component (NFuseForMF.exe). When you reach the screen where you select the components to install, select only the Web Site Wizard (see Figure 15.25). If you run the setup on a non–MF server, only this option will be selected by default. You will be able to start using WSW immediately, because a reboot is not required.

Figure 15.25
Selecting the Web Site Wizard to install.

The wizard is automatically added to the Web Site Wizard folder under Programs on the Start menu. When launched, it guides you through eight steps to creating a simple interface to your NFuse environment:

1. The first screen simply introduces you to the wizard.

2. The second screen enables you to override the default MetaFrame server and port that you provided during the NFuse Java object installation on the Web server. I don't recommend doing this unless you're directing this page at a specific server, such as a test or development MetaFrame machine. Managing load using a strategy such as DNS round-robin helps to remove this dependency from the Web pages.

3. Next you can select a scheme for your Web site. The choices are fairly standard but provide a starting point for developing your own custom sites.

4. In the fourth dialog box, specify how the Web site will be generated (see Figure 15.26). You can choose between Citrix-enhanced HTML tags and scripting-based using Active Server Pages or JavaServer pages. When possible, I recommend using the scripting-based implementation appropriate for your Web server.

Figure 15.26
Selecting the layout model for your Web site.

5. The fifth dialog box allows you to specify whether the application will be launched or embedded within the Web page (see Figure 15.27). The decision depends on how you're planning to implement your NFuse environment. Typically, when you're using NFuse, applications are launched so that they run independently of the browser and allow users to continue surfing to other locations without losing their application sessions. If users are running the Win32 ICA client, a launched application can also be configured to run seamlessly. When selecting the embedded mode, you can specify which ALE client is supported, or you can configure it so that the user can decide which client to use.

Figure 15.27
Specify how the applications are viewed.

6. The next dialog box contains the options that control how application links will appear on the Web page. Here are the available options:

   • Show Icon. Displays the application's icon on the page. This option provides a nice visual cue to the user.

   • Show Name. Displays the application's name as well.

   • Show Details. Displays the associated description for the published application. Normally you won't need to provide this information to the user.

   • Show Folders. When publishing applications to a server farm, you have the option of creating them in subfolders in the application set. This way, you can group common applications within a folder. When Show Folders is selected, users have links on their pages that take them to the corresponding folder containing the application links. If this option is deselected, all applications appear on a single page.

   • Allow user to view application settings. Checking this option creates a View Settings button on the generated Web site that, when clicked, displays the settings for each application. Users won't need this information under most circumstances, but it may be helpful during testing to possibly assist in debugging.

7. In the next-to-last dialog box, you choose how users will authenticate in your environment (see Figure 15.28). By default, the Allow Explicit Logins option is selected because this is the most common configuration in which to use NFuse. You can force users to authenticate against a specific domain; however, the information is simply generated within the resulting Web page, so it's not really hidden from users who might want to find out what domain they're authenticating against. By requiring a user to provide the domain information, you're demanding one more piece of information that an unauthorized user needs in order to gain access to your environment.

   You can allow guest logons by providing a user ID, password, and domain in the appropriate fields. This information will be written into the appropriate file and used to automatically log on with those credentials. For example, when using Microsoft Active Server Pages, the guest credentials are stored in the file GUESTAPPS.ASP, which contains the plaintext information on this guest account, including the password. Never configure the guest account to automatically connect with a user ID that may have anything other than guest privileges.

Figure 15.28
Selecting the form of user authentication to employ.

8. In the final dialog box, verify the options you've selected and provide a destination location for the files that will be generated automatically to support an NFuse Web environment.

Figures 15.29 and 15.30 demonstrate an example of the automatically generated NFuse logon screen and an application-set page that was automatically generated based on the user's credentials.

Figure 15.29
The NFuse logon prompt.

Figure 15.30
The user's automatically generated application-set page, including folders.

As mentioned earlier, NFuse uses a template ICA file, which it populates with the necessary information before passing it to the client to be used to establish the connection. The following is a sample template created by the Web Site Wizard. Each of the substitution tags in the file is contained in square brackets ([]) and begins with the word NFuse.

<[NFuse_setSessionField NFuse_ContentType=application/x-ica]>
<[NFuse_setSessionField NFuse_WindowType=seamless]>
[WFClient]
Version=2
ClientName=[NFuse_ClientName]
[ApplicationServers]
[NFuse_AppName]=
[[NFuse_AppName]]
Address=[NFuse_IPV4Address]
InitialProgram=#[NFuse_AppName]
DesiredColor=[NFuse_WindowColors]
TransportDriver=TCP/IP
WinStationDriver=ICA 3.0
Username=[NFuse_User]
Domain=[NFuse_Domain]
Password=[NFuse_PasswordScrambled]
[NFuse_IcaWindow]
[NFuse_IcaEncryption]
[EncRC5-0]
DriverNameWin32=pdc0n.dll
[EncRC5-40]
DriverNameWin32=pdc40n.dll
[EncRC5-54]
DriverNameWin32=pdc54n.dll
[EncRC5-128]DriverNameWin32=pdc128n.dll

Within this template file, you perform any of the customizations that you want for all connections to your MetaFrame server. A number of parameters can be added to this file, allowing you to set options such as persistent cache size, use of sound, and tuning of the mouse and keyboard response.

Of particular interest in this example is this entry:

Address=[NFuse_IPV4Address]

It specifies the server that the user will connect to in order to run the published application. One of the features of NFuse is the server-side communication with the master ICA browser in order to find published application information. This entry tells NFuse that it should determine what server the user should connect to instead of the user doing it.

Alternatively, you can modify the template file so that the user's ICA client is responsible for locating the master browser and selecting the server on which to run the published application. This is done simply by changing the entry to read as follows:

Address=[NFuse_AppName]

This forces the client to broadcast for the published application. You can enter one or more server location values by including the TCPBrowserAddress entries. The following shows an example of adding two server addresses:

TCPBrowserAddress=192.168.10.25
TCPBrowserAddress2=192.168.10.26

For more information on ICA browsing and server location entries, see Chapter 3.

---

Tip - For a complete list of available template options, review the NFuse online PDF document available on the Citrix Web site at this address:

http://download.citrix.com/pub/server/nfuse/NFuseAdmin.pdf

---