XenMobile Configuration Tests and Troubleshooting

XenMobile Configuration Tests and Troubleshooting

After you install and configure each component in your XenMobile deployment, you can test your configuration:

1. You can test your NetScaler Gateway settings by connecting to the appliance.

2. You can install applications that connect to each XenMobile component. For example, you can deploy Worx Enroll to register user devices with Device Manager.

3. You can configure Device Manager and AppController to communicate with each other and then test the connection.

4. You can also test to make sure users can use Worx Home to connect from their mobile devices through NetScaler Gateway by using Micro VPN, and then open and install mobile apps from App Controller.

This section describes the configuration tests you can carry out, and what to do if you experience problems.

Testing Your NetScaler Gateway Configuration

After you configure the initial settings on NetScaler Gateway, you can test your settings by connecting to the appliance.

To test the NetScaler Gateway settings, open a Web browser and type the web address. For example, in the address bar, type https://my.company.com or https:// 192.168.96.183.

At the logon screen, enter the test user name and password from Active Directory. At the logon screen, enter the test user name and password from Active Directory. When you log on, Receiver for Web appears and displays your applications and virtual desktops. NetScaler Gateway passes the user name and password on to Receiver for Web with single sign-on.

Configuring GoToAssist Settings for Worx Apps

App Controller and Citrix GoToAssist integrate to provide continuous technical support for mobile device users who are using WorxMail or WorxWeb. When you configure settings, you can add an email address, phone number, chat information, and ticket information. If the user needs assistance, they can tap a chat button on their mobile device and the GoToAssist web page opens.

To get started, you need to do the following:

1. After you purchase XenMobile, you receive a promotion code for GoToAssist.

2. Log on to the GoToAssist web site.

3. Create a new service for integrating GoToAssist with XenMobile.

When you do these steps, GoToAssist generates the email address that users can use to create a support ticket. This also creates an integration key that you enter in the App Controller management console.

When users start GoToAssist from their mobile device, the Worx app provisions XenMobile App Edition and GoToAssist accounts. GoToAssist sends an account key (token) to XenMobile App Edition which is then sent to the Worx app. Users can use

GoToAssist to receive technical support in the following ways:

a. Enter a valid email address to allow support personnel to contact them.

b. Use chat to contact support personnel.

c. Create an incident form by clicking Create Incident. If support personnel are not available through chat, GoToAssist redirects users to the incident form automatically.

When you configure GoToAssist in App Controller, the settings appear on the Support Options page in Settings. On this page you can view the settings for phone, chat, and ticket options. In Support Options, you can do the following:

a. Edit existing GoToAssist settings for phone, chat, or the ticket.

b. Add email or key support options.

c. Delete an option.

On the Support Options page, you can add the following support information, however Citrix recommends using the GoToAssist page in Settings to configure support settings.

a. Phone numbers

b. Email addresses

c. Chat settings

d. Ticket settings

e. Custom key settings

To configure GoToAssist settings in App Controller

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, under System Configuration, click GoToAssist.

3. In the details pane, next to GoToAssist Configuration, click Edit.

4. In Support email, enter the email address for support personnel.

Users can choose to use the email address to contact support personnel instead of GoToAssist.

5. In Support phone, enter the phone number for users to use to contact support personnel.

6. In GoToAssist chat leave the default token number or enter one of your own. When users request a chat session, this token is sent to the Worx app.

7. In GoToAssist ticket, enter the email address that you can use to differentiate GoToAssist support requests and then click Save.

To edit support settings

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Support Options.

3. In the details pane, next to an item, under Actions, click the pencil icon.

4. In the Add Property dialog box, do the following:

a. In Value, change the value for the support option type.

For example, if you are editing the chat option, enter the new key in this field.

b. In Name, change the name of the value.

c. In Description, add a description for the option.

5. Click Save

The changes appear in the Support Options details pane.

To add support information by using Support Options

You can add a support email address or a custom key.

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Support Options.

3. In the details pane, click Add.

4. In the Add Property dialog box, do the following:

a. In Key, select either SUPPORT_EMAIL or Custom Key.

b. If you select Custom Key, enter a name of the custom key you want to add in the blank field that appears. Keys have two parts: key name and the value, such as GTA_PHONE=5551212.

c. In Value, add the value for the support option type.

For example, if you are editing the chat option, enter the new chat key in this field.

d. In Name, add a name of the value.

e. In Description, add a description for the option and then click Save.

To remove a support option

1. In the App Controller management console, click the Settings tab.

2. In the navigation pane, click Support Options.

3. In the details pane, click an option and then under Actions click the X icon.

4. To confirm, click Yes.

To add a SCEP device policy for iOS

To add a SCEP device policy for iOS

This policy allows you to configure iOS devices to retrieve a certificate using Simple Certificate Enrollment Protocol (SCEP) from an external SCEP server. If you want to deliver a certificate to the device using SCEP from a PKI that is connected to XenMobile, you should create a PKI entity and a PKI provider in distributed mode. For details, see PKI Entities.

1. In the XenMobile console, click Configure > Device Policies.

The Device Policies page appears.

2. Click Add.

The Add a New Policy page appears.

3. On the Add a New Policy page, click More and then under Security, click SCEP.

The SCEP Policy information page appears.

4. In the Policy Information pane, enter the following information:

a. Policy Name: Type a descriptive name for the policy.

b. Description: Optionally, type a description for the policy.

5. Click Next.

The iOS Platform Information page appears.

6. On the iOS Platform Information page, enter the following information:

a. URL base: Type the address of the SCEP server to define where SCEP requests are sent, over HTTP or HTTPS. The private key isn’t sent with the Certificate Signing Request CSR), so it may be safe to send the request unencrypted. If, however, the one-time password is allowed to be reused, you should use HTTPS to protect the password. This step is required.

b. Instance name: Type any string that the SCEP server recognizes. For example, it could be a domain name like example.org. If a CA has multiple CA certificates, you can use this field to distinguish the required domain. This step is required.

c. Subject X.500 name (RFC 2253): Type the representation of a X.500 name represented as an array of Object Identifier (OID) and value. For example, /C=US/O=Apple Inc./CN=foo/1.2.5.3=bar, which would translate to: [ [ ["C", "US"] ], [ ["O", "Apple Inc."] ], ..., [ ["1.2.5.3", "bar" ] ] ]. You can represent OIDs as dotted numbers with shortcuts for country (C), locality (L), state (ST), organization (O), organizational unit (OU), and common name (CN).

d. Subject alternative names type: In the list, click an alternative name type. The SCEP policy can specify an optional alternative name type that provides values required by the CA for issuing a certificate. You can specify None, RFC 822 name, DNS name, or URI.

e. Maximum retries: Type the number of retries allowed when a user enters an incorrect password. The default is 3.

f. Retry delay: Type a time interval after which users exceed the maximum number of retries and a lockout is enforced. The default is 10.

g. Challenge password: Enter a pre-shared secret. This step is required.

h. Key size (bits): In the list, click the key size in bits, either 1024 or 2048. The default is 1024.

i. Use as digital signature: Specify whether you want the certificate to be used as a digital signature. If someone is using the certificate to verify a digital signature, such as verifying whether a certificate was issued by a CA, the SCEP server would verify that the certificate can be used in this manner prior to using the public key to decrypt the hash.

j. Use for key encipherment: Specify whether you want the certificate to be used for key encipherment. If a server is using the public key in a certificate provided by a client to verify that a piece of data was encrypted using the private key, the server would first check to see whether the certificate can be used for key encipherment. If not, the operation fails.

k. SHA1/MD5 fingerprint (hexadecimal string): If your CA uses HTTP, use this field to provide the fingerprint of the CA certificate, which the device uses to confirm authenticity of the CA response during enrollment. You can enter a SHA1 or MD5 fingerprint, or you can select a certificate to import its signature.

7. Under Policy Settings, next to Remove policy, click either Select date or Duration until removal (in days).

8. If you click Select date, click the calendar to select the specific date for removal.

9. In the Allow user to remove policy list, click Always, Password required, or Never.

10. If you click Password required, next to Removal password, type the necessary password.

11. Expand Deployment Rules and then configure the following settings: The Base tab appears by default.

a. In the lists, click options to determine when the policy should be deployed.

i. You can choose to deploy the policy when all conditions are met or when any conditions are met. The default option is All.

ii. Click New Rule to define the conditions.

iii. In the lists, click the conditions, such as Device ownership and BYOD, as shown in the preceding figure.

vi. Click New Rule again if you want to add more conditions. You can add as many conditions as you

would like.

b. Click the Advanced tab to combine the rules with Boolean options.

 The conditions you chose on the Base tab appear.

c. You can use more advanced Boolean logic to combine, edit, or add rules.

i. Click AND, OR, or NOT.

ii. In the lists that appear, choose the conditions that you want to add to the rule and then click the Plus sign (+) on the right-hand side to add the condition to the rule.

At any time, you can click to select a condition and then click EDIT to change the condition or Delete to remove the condition.

iii. Click New Rule again if you want to add more conditions.

In this example, the device ownership must be BYOD, the device local encryption must be True, and the device mobile country code cannot be only Andorra.

12. Click Next. The SCEP Policy assignment page appears.

13. Next to Choose delivery groups, type to find a delivery group or select a group or groups in the list to which you want to assign the policy. The groups you select appear in the right-hand Delivery groups to receive app assignment list.

14. Expand Deployment Schedule and then configure the following settings:

a. Next to Deploy, click ON to schedule deployment or click OFF to prevent deployment. The default option is ON. If you choose OFF, no other options need to be configured.

b. Next to Deployment schedule, click Now or Later. The default option is Now.

c. If you click Later, click the calendar icon and then select the date and time for deployment.

d. Next to Deployment condition, click On every connection or click Only when previous deployment has failed. The default option is On every connection.

e. Next to Deploy for always-on connection, click ON or OFF. The default option is OFF.

15. Click Save to save the policy.

Downloading and Installing the MDX Toolkit

Downloading and Installing the MDX Toolkit

The Citrix MDX Toolkit is available from the Citrix web site. The MDX Toolkit runs on a computer running Mac OS X Versions 10.7 (Lion), 10.8 (Mountain Lion), and 10.9 (Mavericks). The tool is not supported on a Windows-based computer.

Important: You must update to the latest version of Worx Home 8.6 on Android and iOS devices before you wrap apps with the 2.2.321 version of the MDX Toolkit. If not, when you try to open the apps in earlier versions of Worx Home, an incompatibility error message appears.

After you download the tool from the Citrix web site, you install the tool on your computer. When you install the tool, you are prompted for licensing, the location where you want to install the tool, and installation information.

The installation package includes a small utility for removing the MDX Toolkit. You can find the utility at the following location on your computer: /Applications/Citrix/ CGAppPrepTool/Uninstaller.app/Contents. Double-click the utility to start the uninstaller app and then follow the prompts. When you remove the tool, you receive amessage prompting you for your user name and password.

To install the MDX Toolkit

1. Click the installation package that you downloaded to your computer to start the installation and then click Continue.

2. Read and accept the End User License Agreement and then click Continue.

3. Follow the prompts to install the MDX Toolkit.

Upgrading the MDX Toolkit

To upgrade the MDX Toolkit, you must first remove earlier versions of the tool from your computer. Then, you can install the latest version.

To remove the App Preparation Tool

1. On your Mac OS X computer, navigate to the directory Go > Application > Citrix > CGAppPrepTool > Uninstaller.app.

2. Double-click the Uninstaller icon. A message prompts you to confirm the removal of the MDX Toolkit.

3. Click Continue.

4. Enter your user name and password, click OK and then click Done.

After you remove the earlier version of the tool, you can then install the new version of the tool.

Wrapping Android and iOS Mobile Apps

Citrix provides the MDX Toolkit so that you can wrap a mobile app for iOS or Android with Citrix logic and policies. The tool can securely wrap an app that was created within your organization or a mobile app made outside the company. When you install the MDX Toolkit, the Worx SDK libraries also install and appear in the MDX SDK folders on your computer in the tool and data directories. The MDX SDK folders are required for the integration of wrapped iOS mobile apps with Citrix Worx. When you wrap iOS apps that include the Worx SDK libraries, you can publish the apps in the Apple App Store and the Citrix Worx Store. After the app is wrapped, you can upload then the app to XenMobile App Edition. For more information about the Worx App SDK, such as an overview for ISVs, and to download the SDK, see Worx App SDK on the Citrix web site.

Prerequisites

Before you wrap an iOS app, download and install the iOS Distribution Provisioning Profile and Distribution Certificate to your computer. The provisioning profile signs the app for distribution.

Wrapping Android Mobile Apps

For Android apps, you need to follow these basic steps:

1. Specify an Android mobile app APK file. When you click Next , the MDX Toolkit validates the Android SDK path. If the tool cannot validate the path, you can browse to the SDK on your computer.

2. Choose the Java Development Kit (JDK) on your computer for wrapping Android mobile apps. If the JDK is not installed on your computer, the tool prompts you to install the tool. When you click Install, the tool locates the tool on the Web and then installs the JDK on your computer.

3. Choose the Android Software Development Kit (SDK) on your computer for wrapping Android mobile apps and choose the Android APK tool.

4. Choose the keystore for signing Android mobile apps. When you wrap the app, you must provide the keystore that was created when the app was developed. The Android operating system requires that all installed mobile apps be digitally signed with a certificate with a private key that is held by the developer. The certificate does not need to be signed by a Certificate Authority. Android mobile apps can use self-signed certificates. For more information about signing Android mobile apps, see the Android developers web site.

When you wrap the mobile app with the MDX Toolkit, you can select the option Use debug keystore. This option allows you to sign the mobile app if the release keystore is not available during development. To create an Android app that users install on their devices, you must create a retail build of the app and disable Use debug keystore so you can sign the package with a real key. A keystore can contain multiple private keys, in most cases it will be only one key. If the keystore contains multiple private keys, when you wrap the app, you can select the key alias.

When the MDX Toolkit finishes wrapping the app, the app file name includes _andr . The file type is .mdx .

Wrapping iOS Mobile Apps

For iOS apps, you need to following these basic steps:

1. Specify an iOS mobile app IPA file.

2. In the MDX Toolkit wizard, choose the option to deploy the app from XenMobile or to deploy the app from the Apple App Store.

3. Choose the iOS Distribution Provisioning Profile and Distribution Certificate to sign the app for distribution.

When the MDX Toolkit finishes wrapping the app, the app file name includes _iOS . The file type is .mdx.

When you run the MDX Toolkit, the app determines the application type and version. You can select the minimum and maximum operating system versions.

Uploading the Wrapped App and Configuring Policies

After you complete wrapping the app, you then upload the MDX file to App Controller. You use the App Controller management console to configure specific app details and policy settings that Citrix Receiver or the Worx Store enforces. When users log on, the app appears in the store. Users can then subscribe, download, and install the app on their device. For more information about configuring the app details and policy settings in App Controller, see Adding Apps.

Building Your XenMobile Solution

Building Your XenMobile Solution

The XenMobile components you deploy are based on the device or app management requirements of your organization. The components of XenMobile are modular and build on each other. For example, you want to give users in your organization remote access to mobile apps and you need to track the device types with which users connect. In this scenario, you would deploy NetScaler Gateway, XenMobile Device Manager, and App Controller.

This section discusses this and additional scenarios for deploying the XenMobile components in your network, as well as for the NetScaler appliance. The topics include architectural diagrams, information about the Citrix products you can integrate into your deployment, a recommended order in which to deploy the components, and the ways users connect depending on the deployment scenario you implement.

Deploying XenMobile Components

You can deploy XenMobile components to enable users to connect to resources in your internal network in the following ways:

1. Connections to the internal network. If your users are remote, they can connect by using a VPN or Micro VPN connection through NetScaler Gateway to access apps and desktops in the internal network.

2. Device enrollment in Device Manager. Users can enroll mobile devices in DeviceManager so you can manage the devices that connect to network resources.

3. Web, SaaS, and mobile apps from App Controller. Users can access their web, SaaS, and mobile apps from AppController by using Worx Home or Receiver.

4. Windows-based apps and virtual desktops. Users can connect with Citrix Receiver or a web browser to access Windows-based apps and virtual desktops from StoreFront or the Web Interface.

To achieve some or all of these capabilities, Citrix recommends deploying XenMobile components in the following order:

1. NetScaler Gateway. You can configure settings in NetScaler Gateway to enable communication with App Controller, StoreFront, or the Web Interface by using the Quick Configuration wizard. You must install App Controller, StoreFront, or the Web Interface before using the Quick Configuration wizard in NetScaler Gateway.

2. Device Manager. After you install Device Manager, you can configure policies and settings that allow users to enroll their mobile devices.

3. App Controller. After you install App Controller, you can configure mobile, web, and SaaS apps. Mobile apps can include apps from the Apple App Store or Google Play. Users can also connect to mobile apps you wrap with the MDX Toolkit and upload to App Controller.

4. MDX Toolkit. You can wrap .ipa or .apk apps and Worx apps with the MDX Toolkit. After you wrap the apps, you can upload the apps to App Controller.

5. StoreFront (optional). You can provide access to Windows-based apps and virtual desktops from StoreFront through connections with Receiver.

6. ShareFile Enterprise (optional). If you deploy ShareFile, you enable enterprise directory integration through App Controller or Security Assertion Markup Language (SAML). For more information about ShareFile, see ShareFile Enterprise in Citrix eDocs.

If you install all of the XenMobile components in your network, the deployment may look like the following figure:

The topics in this section detail the possible deployment scenarios in your network for the XenMobile components, as well as for the NetScaler appliance. The topics include architectural diagrams, information about the Citrix products you can integrate into your deployment, and the ways users connect depending on the deployment scenario you implement.

Deploying NetScaler Gateway with App Controller and StoreFront

You can deploy NetScaler Gateway at the perimeter of your organization's internal network (or intranet) to provide a secure single point of access to the servers, applications, and other network resources that reside in the internal network. In this deployment, all remote users must connect to NetScaler Gateway before they can access any resources in the internal network.

You can deploy NetScaler Gateway with the following Citrix products:

- XenMobile App Edition

- StoreFront

- XenApp

- XenDesktop

- Web Interface

Users can connect to resources in your internal network by using the following methods:

1. Worx Home for users who connect with mobile devices and need access to MDX mobile apps. Users must connect with Worx Home on the mobile device to access MDX apps.

2. Receiver so users can access Windows-based applications and desktops hosted by XenApp or XenDesktop. To allow users access to their Windows-based apps, you must deploy StoreFront or the Web Interface. If users connect with Receiver on a Windows or Mac computer, MDX apps are not available to users.

3. Optionally, users can also connect with the NetScaler Gateway Plug-in for full VPN access to the internal network. Users can access email servers, files shares, and web servers with the NetScaler Gateway Plug-in for Windows or the NetScaler Gateway Plug-in for Mac.

The way you deploy App Controller in your internal network depends on how users connect: with Worx Home or with Receiver. In either scenario, you install NetScaler Gateway in the DMZ.

You can deploy the App Controller virtual machine (VM) on XenServer, VMware ESXi, or Microsoft Hyper-V located in your internal network. Users can connect to App Controller from an external connection (the Internet) or from the internal network. If users connect from the Internet or a remote location, the connection must route through NetScaler Gateway. App Controller resides in the internal network behind the firewall.

Allowing Access to MDX Apps Through NetScaler Gateway

If users connect with Worx Home and you have MDX mobile apps installed on App Controller, you place StoreFront behind App Controller in your internal network. Users can connect to App Controller through NetScaler Gateway in the DMZ to obtain their web, SaaS, Android and iOS mobile apps, along with documents from ShareFile. StoreFront resides behind App Controller to deliver Windows-based apps and virtual desktops as shown in the following figure:

Deploying Device Manager

In order to get your users' devices under management, users need to enroll their devices into Device Manager. To get started, you install Device Manager in your network. Next, you connect to Active Directory to import users by using the LDAP wizard. Then, you configure the following settings in Device Manager:

- Enrollment

- Policies

- Apps

When you finish configuring Device Manager, you can send enrollment invitations to your users. The invitation contains a link that allows users to download Worx Enroll, which then allows users to enroll their devices in Device Manager. When users log on, Device Manager authenticates the user's identity and enrolls the device.

Citrix recommends that you deploy NetScaler or NetScaler Gateway for security. You deploy NetScaler or NetScaler Gateway in the DMZ with Device Manager, as shown in the following figure. When you deploy NetScaler or NetScaler Gateway, you can use the XenMobile NetScaler Connector (XNC) to control access to email, calendar, and contacts from mobile devices. In this deployment, after enrollment, user devices connect to NetScaler or NetScaler Gateway to access resources.

If users enroll their iOS devices, the devices and Device Manager must communicate with the Apple Push Notification Service (APNS).

The preceding figure also shows the ports you need to open to enable the connections. You must open all of the ports behind the firewall for each identified service. For details about the ports, see Opening Ports for the XenMobile Solution on page 21. For details about the APNS server, also shown in the preceding figure, see Requesting an APNS Certificate in the Device Manager documentation in Citrix eDocs.

Deploying the MDX Toolkit

Mobile app management allows you to securely manage and deliver mobile apps to users. With the Citrix MDX Toolkit, you can wrap iOS and Android apps to secure access and enforce policies. After you wrap the app, you can upload the app to XenMobile App Edition and configure MDX policies. Users can then download and install the app from Citrix Receiver. They can subsequently open and work with the app from an icon on the home screen, on the mobile device, or from the Receiver home page.

For more information about MDX policies for Android and iOS mobile apps in App Controller 2.8, see the following topics in Citrix eDocs:

- Configuring MDX Policies for Android Apps in App Controller

- Configuring MDX Policies for iOS Apps in App Controller

Deploying the Entire XenMobile Solution

If you deploy all of the components of the XenMobile solution, you have successfully completed the following tasks:

- Opened the required ports for communication between each component.

- Installed each component in your network.

- Successfully tested connections from user devices.

The next section discusses the deployment prerequisites and includes a checklist for you to use to get ready for your deployment. The subsequent sections contain component installation steps, and configuration tests you can carry out.

The following figure shows the complete solution:

Deploying the XenMobile 8.6 Solution

Deploying the XenMobile 8.6 Solution

About the XenMobile Solution

XenMobile Enterprise Edition includes the following Citrix products:

- NetScaler or NetScaler Gateway (user licenses for NetScaler Gateway included, but hardware or virtual appliance(s) must be purchased separately)

- XenMobile MDM Edition (with XenMobile Device Manager)

- XenMobile App Edition (with App Controller)

- MDX Toolkit

- Worx Home

You can deploy other Citrix products, such as Receiver, StoreFront, and the Web Interface to work with XenMobile.

XenMobile allows you to manage the following:

- Android, iOS, Windows 8 phones, tablets and Symbian mobile devices with Device Manager

- Access to web, Software as a Service (SaaS), and mobile apps through App Controller

- Provisioning access to ShareFile data and documents through App Controller

- Access to Windows-based apps and virtual desktops through StoreFront or the Web Interface

Users connect from mobile devices by using Worx Home. When users install Worx Home on their mobile device, they can use WorxMail to access their email and use WorxWeb to access web sites.

To allow access to email, calendar, and contacts from mobile devices through NetScaler, you can deploy the XenMobile NetScaler Connector (XNC). The connector allows you to send a list of compliant devices from Device Manager to NetScaler, which in turn controls which mobile devices are allowed to synchronize with the Exchange Server.

This section contains details about the features in each component, and information about integrating the XenMobile Enterprise Edition products to deploy a complete solution to meet your users' needs.

About the XenMobile Solution

Citrix XenMobile is a comprehensive solution that allows you to manage mobile devices, apps, and data. Users can access all of their mobile, SaaS, Web, and Windows-based apps from a unified app store, including seamlessly integrated email, browser, data sharing, and support apps. XenMobile allows you to control mobile devices with full configuration, security, provisioning and support capabilities. In addition, XenMobile securely delivers Worx mobile apps that are built for businesses by using the Worx App SDK and found through the Worx App Gallery. With XenMobile, you can meet your compliance and control needs while giving users the freedom to experience work and life their way.

The XenMobile solution consists of the following components:

1. NetScaler Gateway. NetScaler Gateway allows remote users to securely access internal network resources. Users can connect with any device to access their applications, email, and file shares in the internal network.

2. XenMobile MDM Edition. XenMobile MDM includes Device Manager that allows you to manage mobile devices, set mobile policies and compliance rules, gain visibility to the mobile network, provide control over mobile apps and data, and shield your network from mobile threats. Device Manager simplifies the management of mobile devices.

3. XenMobile App Edition. XenMobile App Edition includes App Controller 2.9, the industry's first unified service broker that aggregates, controls, and securely delivers Windows, web, and SaaS applications, iOS and Android apps, integrated ShareFilebased data, and virtual desktops to any device, anywhere. XenMobile App Edition gives users an intuitive single point of access and self-service for all of their business applications on any device anywhere.

4. MDX Toolkit. The MDX Toolkit is a software application that you can install on Mac OS X computers and use to convert unsigned iOS or Android mobile apps (.ipa or .apk) into signed MDX files. In the process of this conversion, Citrix embeds a policy framework and default set of policies that enable you to configure, securely distribute, and manage each prepared application by using App Controller.

5. Worx apps. Mobile users can connect with Worx Home to access their mobile apps from App Controller. Users can enroll their device in Device Manager by using Worx Enroll. Users can connect to the Worx Store and download Worx Home, WorxMail, and WorxWeb.

6. ShareFile. ShareFile is a cloud-based file sharing service that enables users to easily and securely exchange documents. ShareFile enables users to send large documents by email, securely handle document transfers to third parties, and access a collaboration space from desktops or mobile devices. ShareFile provides users with a variety of ways to work, including a web-based interface, desktop tools, and integration with Microsoft Outlook.

Creating and Updating Notification Templates

Creating and Updating Notification Templates

You can create or update notification templates in XenMobile to be used in automated actions, enrollment, and standard notification messages sent to users. You configure the notification templates to send messages over three different channels: Worx Home, SMTP, or SMS.

Note: If you plan to use SMTP or SMS channels to send notifications to users, you must set up the channels before you can activate them. XenMobile prompts you to set up the channels when you add notification templates if they are not already set up. For details, see Notification in Xenmobile.

1. In the XenMobile console, click Configure > Settings > Notification Templates.

2. Do one of the following:

- Click Add to add a new notification template. If no SMS gateway or SMTP server has been set up, a message appears regarding the use of SMS and SMTP notifications. You can choose to set up the SMTP server or SMS gateway now or set them up later. For details, see .

Note: If you choose to set up SMS or SMTP server settings now, you are redirected to the Configure > Settings > Notification Server page. After setting up the channels you want to use, you can return to the Configure > Settings > Notification Template page to continue adding or modifying notification templates.

Important: If you choose to set up SMS or SMTP server settings later, you will not be able to activate those channels when you add or edit a notification template, which means those channels will not be available for sending user notifications.

- Select an existing template to edit or delete. Click the option you want to use.

Note:

You can delete only notification templates that you have added; you cannot delete predefined notification templates.

When you select the check box next to a notification template, the options menu appears above the notification template list; when you click anywhere else in the list, the options menu appears on the right side of the listing.

XenMobile includes many predefined notification templates that reflect the distinct types of events that XenMobile automatically responds to for every device in the system.

When you click to add a template, the Add Notification Template page appears.

3. On the Add Notification Template page (or the Edit Notification Template page if you are editing an existing notification), enter or modify the following information:

a. Name: Type a descriptive name for the template.

b. Description: Type a description for the template.

c. Type: Select the notification type. Only supported channels for the selected type appear.

Note: For some template types, the phrase Manual sending supported appears below the type. This means that the template is available in the Notifications list on the Dashboard and on the Devices page to let you manually send the notification to users. Manual sending is not available in any templates that use the following macros in the Subject or Message field on any channel:

${outofcompliance.reason(whitelist_blacklist_apps_name)}

${outofcompliance.reason(smg_block)}

Attention: Only one APNS Cert Expiration template is allowed, which is a predefined template. This means you cannot add a new template of this type.

4. Channels: Enter or modify the information for each channel to be used with this notification. You can choose any or all channels. The channels you choose depends on how you want to send notifications:

- If you choose Worx Home, only iOS and Android devices receive the notifications, which appear in

the device's notification tray.

- If you choose SMS, only users using devices with a SIM card receive the notification.

- If you choose SMTP, most users should receive the message because they will have enrolled with

their email addresses.

Worx Home

a. Activate: Click to enable the notification channel.

b. Message: Type the message to be sent to the user. This field is required if you are using Worx Home.

c. Sound File: Select the notification sound the user hears when the notification is received.

SMTP

a. Click Activate to enable the notification channel.

Important: You are only able to activate the SMTP notification if you have already set up the SMTP server. For details, see Notification in Xenmobile.

b. Sender: Enter an optional sender for the notification, which can be a name, an email address, or both.

c. Recipient: This field contains a pre-built macro for all but Ad-Hoc notifications to ensure that notifications are sent to the correct SMTP recipient address. Citrix recommends that you do not modify macros in templates. You can also add recipients (for example, the corporate admin), in addition to the user by adding their addresses separated by a semi-colon (;). To send Ad Hoc notifications, you can enter specific recipients on this page, or you can select devices from the Manage > Devices page and send notifications from there. For details.

d. Subject: Type a descriptive subject for the notification. This field is required if you are using SMTP.

e. Message: Type the message to be sent to the user.

SMS

a. Click Activate to enable the notification channel.

Important: You are only able to activate the SMTP notification if you have already set up the SMTP server. For details, see Notification in Xenmobile.

b. Recipient: This field contains a pre-built macro for all but Ad-Hoc notifications to ensure that notifications are sent to the correct SMTP recipient address. Citrix recommends that you do not modify macros in templates. To send Ad Hoc notifications, you can enter specific recipients, or you can select devices from the Manage > Devices page. For details.

c. Message: Type the message to be sent to the user. This field is required if you are using SMS. Important: You are only able to activate the SMS notification if you have already set up the SMS gateway. For details, see Notification in Xenmobile.

5. Click Add to add the new template or click Save to save your edits. When all channels are correctly configured, they appear in this order on the Notification Templates page: SMTP, SMS, and Worx Home. Any channels not correctly configured appear after the correctly configured channels.

Configuring Deployment Rules

Configuring Deployment Rules

You can set any number of parameters that will affect the deployment outcome of a package.

For example, your package deployment could be based on a specific operating system version, on a particular hardware platform, or some other combination. In this wizard, you will find both a Base and Advanced rule editor. The Advanced view is a free-form editor. The image below illustrates the Deployment Rules screen accessible when adding or editing an app:

Base Deployment Rules

Base deployment rules are comprised of predefined tests and resulting actions. When possible, the results are pre-built into the example tests. For example, when basing a package deployment on a hardware platform, all existing known platforms are populated into the resulting test, drastically reducing your rule creation time and limiting possible errors.

Click New rule to add a rule to the package.
Note: The rule builder includes further information, specific to each test.

To create a new rule, you select a rule template, select the condition type, and then customize the rule. Customizing the rule includes modifying the description. When you finish configuring settings, you add the rule to the package.

You can add as many rules as you want. The package is deployed when all of the rules match.

Advanced Deployment Rules

If you click on the Advanced tab, the Advanced Rule Editor appears.

In this mode, you can specify what relationship is set between the rules. The operators AND, OR, and NOT are available.