Welcome Guest!   Register | Login | Login Assistance
Extending your Citrix and Terminal Server
environment using .NET and other technologies.

Controlling Access to Web Interface using Web Interface Access Control Center

 

Have you ever had a need to allow only a subset of your users access to Citrix Web Interface or Secure Gateway? This is especially useful if you use an internal Web Interface and an external Web Interface/Secure Gateway environment. You might want to let anybody log on through the internal Web Interface, but restrict access through the external Web Interface/Secure Gateway. Sam Jacobs created a utility to do just that at http://www.ipm.com/home/freecode/RestrictedUsers.zip. The basic concept of this modification is to place a list of users in a text file on your Web Interface server. Then, the code looks in this file at login time to see if the authenticating user is allowed to continue.

This concept works quite well, but I had a request to allow non-technical people to control the access list. Rather than give them rights to the server to modify the text file, I came up with a slightly different solution - the Web Interface Access Control Center. This solution involves placing the allowed users in a database table and comparing the authenticating user to the database table, rather than a text file, at login time. As an added bonus, this solution logs all access attempts to the database as well.

To help implement this solution, I created an ASP.NET interface to allow adding and removing users from the list. This utility integrates with Active Directory to display available users to add to or remove from the access list. In addition, the utility analyzes usage and presents this information in a drill-down format.

Download the Web Interface Access Control Center


The Components

The Web Interface Access Control Center consists of three logical components; a database to store allowed users and access activity, a Citrix Web Interface server, and an IIS Web Application server running the .NET Framework version 2.0 to host the end-user utilities. I say these are three logical components because all three components can reside on the same physical server.

The Database
The database can be any ODBC compliant database such as Microsoft SQL, MSDE, MySql, etc. The database has a very simple structure consisting of only two tables; the WI_Access table to store which users are permitted access via Web Interface, and WI_AccessLog to store access attempts.

The Web Interface Server
Naturally you will need a Citrix Web Interface server. You will need to make one modification in order for this solution to work. The modification instructions can be found in the setup instructions accompanying the download. One thing to note however is if there is a firewall between the Web Interface server and the database, port 1433 will need to opened in order for SQL communication to occur.

The IIS Web Application Server
The IIS Web Application server reads information from the database and reports this information in a drill down fashion. The virtual directory that the web application runs from will need to be configured to use the .NET Framework version 2.0 (this is covered in the setup instructions).


Component Communications

Web Interface Access Control Center Communications


Screen Shots

Access Control List

Click to enlarge


Usage Calendar

Click to enlarge


Day Detail

Click to enlarge


Hour Detail

Click to enlarge


User Detail

Click to enlarge


I hope you find this tool useful. But, keep in mind that while every effort has been made to test this tool, this tool is still in "beta" and may contain bugs. Also, the modification made to Web Interface is not supported by Citrix.






Published: April 04, 2006
Last Modified: April 14, 2008
Tags: Customization Web Interface Databases Citrix Presentation Server
Current Rating:



Comments

Very Cool
Nice work Jason. Now can you create one like this that goes against the IMA data store? Can this intergrate into AD and use groups?
This has been my favorite site for cool Citrix stuff and fun things to ponder and play with!!!

MF Boston

Reply
Very Impressive
An elegant solution to the problem ! My original solution was also not optimal when you had to keep multiple web servers in sync. Keeping the users in a database neatly solves that problem.
Another approach that I've presented is to control access from the CMC (where it should be) by publishing an "authentication" application to authorized users and filtering out the app from the application list.
That approach is discussed in the following Citrix Support Forum post:
http://support.citrix.com/forums/thread.jspa?messageID=297420
It still doesn't have your cool graph, though !

Sam

Reply
Wildcard?
I'd like to use this tool purely for the reporting and allow anyone to connect but it doesn't appear to allow for wildcards. Is that the case or am I missing something?

robert@asgr.com

Reply
Re: Wildcard?
Wildcard's are not currently allowed. I plan on updating the Web Interface Access Control Center soon with some additional functionality. I will include your suggestion in a future release! In the mean time, check out Thomas Koetzing's Analyze Center for Web Interface 4.x.

Reply
Application working, UI incomplete
Jason,

I got the WI access utility working by adding names to the WI_Include table manually.

I do not want to connect to AD from the DMz, hence I have used these settings for the web interface:

"ManagementGroup" value="\administrators"

also tried setting "LDAPDomain" =

The UI only shows reporting and I cannot add new users. I even used Windows Authentication for the Virtual directory.

Any suggestions?

Kevin Smith
Senior Systems Engineer
IMG-LLC
ksmith@infomg.com

Reply
Re: Application working, UI incomplete
I agree that opening up AD from the DMZ to the LAN is a bad idea. The way I intended for this to be set up is to use a separate Web Server on the LAN to host the Web Application. The Web Application server is only used for adding users to the access control list and reporting on usage. The Web Interface/Secure Gateway server never contacts the Web Application server. This way, you only have to open port 1433 (SQL) from the Citrix Web Interface server in the DMZ to your SQL server. All the Active Directory LDAP traffic stays on the LAN in this scenario. You can combine the SQL and Web Application server on the same physical box if you desire.

Reply
Web.config syntax
I am getting "access denied" on the /admin/manageaccess.aspx page.

Here are my settings in web.config:






The user "WI_Admin" has been assigned "db

I get the usage calendar and user detail, but cannot manage user access. I have verifed that my sql user can insert and delete from the table.

any ideas?

Thanks,

Kevin Smith

Reply
Re: Web.config syntax
The most likely cause of this is improper settings in the Web.Config file. Verify the following entries:

<add key="LDAPDomain" value="domain"/>
<add key="ManagementGroup" value="domain\group"/>

Where domain = your Active Directory domain, and group = a valid Active Directory group you belong to.

One thing to note, you may have to use your pre-Windows 2000 domain name.


Reply
Re: Re:Web.config syntax
Problem solved: I was using "ManagementGroup = \administrators. This is actually a "builtin" group. I changed the group to \domain admins and all is good.

For LDAPDomain, the DNS format works.

Thanks for building a great tool for Citrix!

Kevin Smith
Senior Systems Engineer
IMG-LLC

Reply
Reports for Remote Users Only
HI,

I got WI 4.2 on DMZ and i only need to log external user connection ( TIME/ DTAE). Is that possible with this utility or do i need to modify?

I got MF XPa 1.0 FR3 And is that possible to get that sort of information with this utility? or any other tool?

Reply
Re: Reports for Remote Users Only
With a slight modification you can accomplish this.
Open up WIACC.cs and find the following text:

try
{
...
}

Replace everything between { and } with the following:

conn.Open();
boolAllowed = true;
string strSQLAllowed = string.Format("INSERT INTO WI_AccessLog (username, logintime, remote_addr, success) VALUES ('{0}', '{1}', '{2}', '{3}')", strUsername, DateTime.Now.ToString(), clientIP, "yes");
System.Data.SqlClient.SqlCommand sqlCmdAllowed = new System.Data.SqlClient.SqlCommand(strSQLAllowed, conn);
sqlCmdAllowed.ExecuteNonQuery();

Reply
This does not work for me
I have setup the application according to the notes but when I access the citrix portal I just get an internal error.

Am I doing something wrong ??

Reply
Re: This does not work for me
What version of Web Interface are you using?

Reply
Almost working - No reporting
Hi Jason, it's Stuart from the Citrix support forum here, we chatted over beers at Briforum in Germany !

I've setup the app as described, inserting users directly into the SQL table works for me, so I guess I'm half there..... but

On browsing to the web site setup as a virtual direcotry, I get the Access log calender, which does not show login attempts on the dates ? Should there also be another button to manage users here ?

Below the calender is the following error:

"The conversion of a char data type to a datetime data type resulted in an out-of-range datetime value"

Also if I try to browse to the /admin/manageaccess.aspx page directly I get the "access denied" message as detailed above.

Thanks

Stuart

Reply
Re: Almost working - No reporting
There are two issues here. This first is to do with the reporting. It looks like you need to add the following to Web.Config:

- Add ";Current Language=English" after the password on your connection string.

- Add
<globalization requestEncoding="utf-8" responseEncoding="utf-8" culture="en-US" uiCulture="en-US" enableClientBasedCulture="false" responseHeaderEncoding="utf-8" enableBestFitResponseEncoding="false" /> to Web.Config right after <system.web>

The second issue has to do with your LDAP specification in Web.Config. Try using a tool such as ADSI Edit to ensure you are specifying the correct domain name and group.

Reply
Re: Re: Almost working - No reporting
Thanks for your reply Jason.

That's that's fixed the first issue, I can now see the entries in the caleder and get the cool graph when I click.

I'll take a look at the LDAP domain and user string tomorrow and let you know.

Thanks again

Stuart

Reply
admin page not working
Having the same issue as abouve. All works well but if I cannot get manageaccess.aspx to work. I do not see any buttons to add users either. Manually entering users in the database does work. Im trying to use the Domain Admins group with Win2k AD.

Reply
Server Error in '/' Application
Probably something i'm doing wrong...but I am receiving the following error:

Server Error in '/' Application.
--------------------------------------------------------------------------------

Configuration Error
Description: An error occurred during the processing of a configuration file required to service this request. Please review the specific error details below and modify your configuration file appropriately.

Parser Error Message: It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS.

Source Error:


Line 30:
Line 31:
Line 32:
Line 33:
Line 34:


Source File: c:\inetpub\wwwroot\citrix\wi_access\web.config Line: 32



Show Additional Configuration Errors:


It is an error to use a section registered as allowDefinition='MachineToApplication' beyond application level. This error can be caused by a virtual directory not being configured as an application in IIS. (c:\inetpub\wwwroot\citrix\wi_access\web.config line 33)




--------------------------------------------------------------------------------
Version Information: Microsoft .NET Framework Version:2.0.50727.42; ASP.NET Version:2.0.50727.42

Any ideas??

Reply
Related to POST Above..LINE 32
Line 32:

Reply
No authentication as administrator
Hi Jason
I also got the WI access utility working by adding names to the WI_Include table manually.

The UI only shows reporting and I cannot add new users. I even used Windows Authentication for the Virtual directory.
I checked the Domainentry and the membergroup very carefully - but I use it on a german-System. I think WI dont find the domain??
The Domainname is lbs-hartberg???
Any suggestions?

Wolf Greiner
LBS Hartberg
w.greiner@lbs-hartberg.ac.at

Reply
everything working but only 50% of users enumerated
Hi all,

I have everything working but the user list is incomplete. The LDAP domain is right and i am a full admin in the group specified for managing. i cannot login to the WI as i get access denied

Reply
No reporting
Hi Jason,
I can restrict access, but i can“t to see the reports..

I get the Access log calender, which does not show login attempts.

What I need to do??

Reply
Re: No reporting
This sounds like your Web.Config file's connection string is not properly configured.

Reply
error message received at WI
I have tried everything and cannot get all users to enumerate from AD. I get about half. i cannot see my own user name in the list and am a member of the group assigned to manage.

If i try access the WI i get the following
Unauthorized Access Attempt

You have not been permitted external access to Web Interface.

This access attempt has been logged.

If you feel this message is in error, please contact the system administrator

If anyone is reading this it would be great to get some help

Reply
Re: error message received at WI
Will you send me the rendered source of the page? Just right-click on the page showing half of the users and select "View Source" (or similar). Then save the source as a text file and email to me.

Thanks,
Jason

Reply
Application Error
i am getting a following error while trying to view "show denied login".
'lbUsers' has a SelectedIndex which is invalid because it does not exist in the list of items.
Parameter name: value.
Stack Trace:
[ArgumentOutOfRangeException: 'lbUsers' has a SelectedIndex which is invalid because it does not exist in the list of items.
Parameter name: value]
System.Web.UI.WebControls.ListControl.set_SelectedIndex(Int32 value) +1777006
PerUserUsage.lbUsers_DataBound(Object sender, EventArgs e) +24
System.Web.UI.WebControls.BaseDataBoundControl.OnDataBound(EventArgs e) +86
System.Web.UI.WebControls.ListControl.PerformSelect() +60
System.Web.UI.WebControls.BaseDataBoundControl.DataBind() +70
System.Web.UI.WebControls.BaseDataBoundControl.EnsureDataBound() +82
System.Web.UI.WebControls.ListControl.OnPreRender(EventArgs e) +26
System.Web.UI.WebControls.ListBox.OnPreRender(EventArgs e) +9
System.Web.UI.Control.PreRenderRecursiveInternal() +77
System.Web.UI.Control.PreRenderRecursiveInternal() +161
System.Web.UI.Control.PreRenderRecursiveInternal() +161
System.Web.UI.Page.ProcessRequestMain(Boolean includeStagesBeforeAsyncPoint, Boolean includeStagesAfterAsyncPoint) +1360

any help would be appreciated.
i am using Windows 2000 Server SP4, WI 4.2

Reply
Globalisation (or Globalization, as you would put it)
Thanks for this excellent control.

Two things I would like to add. Most environments will find that the virtual folder for the Website will work best when set to Basic Authentication only. Might be worth adding to the setup instructions, and anyone experienced enough with IIS can always choose to ignore it.

Secondly, I have found that it has some issues when used on a server with non-US date/time formats (ie where the date format is dd/mm/yyyy)

The trick is that datetime representations in SQL statements are ALWAYS mm/dd/yyyy format, whereas everywhere else in .NET code it will use the local formats. So whenever we read or write from the SQL, we need to be sure its in the expected format!

To get it all to work smoothly I found the following changes were required:

WIACC.cs
============
Insert these two lines above the line that starts: //Retrieve the username...

System.Globalization.CultureInfo cultureUS;
cultureUS = new System.Globalization.CultureInfo("en-US", true);

Replace two instances of
DateTime.Now.ToString()
with
DateTime.Now.ToString(cultureUS)


UsageCalendar.aspx.cs
======================
function loadDays()
-------------------
Insert these two lines into above the line that starts: //Set up SQL query parameters

System.Globalization.CultureInfo cultureUS;
cultureUS = new System.Globalization.CultureInfo("en-US", true);

replace the line
tmpDate = DateTime.Parse(strMonth + "/1/" + strYear);
with
tmpDate = DateTime.Parse(strMonth + "/1/" + strYear,cultureUS);

replace the line
strSQL = String.Format("SELECT logintime, success FROM WI_AccessLog WHERE logintime BETWEEN '{0}' AND '{1}'", startDate.ToShortDateString(), endDate.ToShortDateString());
with
strSQL = String.Format("SELECT logintime, success FROM WI_AccessLog WHERE logintime BETWEEN '{0}' AND '{1}'", startDate.ToShortDateString(cultureUS), endDate.ToShortDateString(cultureUS));

HourDetail.aspx.cs
=====================
function Page_Load()
---------------------
Insert these two lines at the top of the function:

System.Globalization.CultureInfo cultureUS;
cultureUS = new System.Globalization.CultureInfo("en-US", true);

Replace these lines
int intMonth = Int16.Parse(strDate.Split('/')[0]);
int intDay = Int16.Parse(strDate.Split('/')[1]);
int intYear = Int16.Parse(strDate.Split('/')[2]);
with
DateTime dtTmp = DateTime.Parse(strDate);
int intMonth = dtTmp.Month;
int intDay = dtTmp.Day;
int intYear = dtTmp.Year;

Replace these lines
string strStart = string.Format("{0} {1}:00:00", strDate, strHour);
string strEnd = string.Format("{0} {1}:59:59", strDate, strHour);
with
string strStart = string.Format("{0} {1}:00:00", dtTmp.ToString("d",cultureUS), strHour);
string strEnd = string.Format("{0} {1}:59:59", dtTmp.ToString("d",cultureUS), strHour);

DayDetail.aspx.cs
========================
function loadUserList()
------------------------
Insert these two lines at the top of the function:

System.Globalization.CultureInfo cultureUS;
cultureUS = new System.Globalization.CultureInfo("en-US", true);

replace these lines
sqlUsers.SelectParameters[0].DefaultValue = strStart;
sqlUsers.SelectParameters[1].DefaultValue = strEnd;
with
DateTime dtStart = DateTime.Parse(strStart);
DateTime dtEnd = DateTime.Parse(strEnd);
sqlUsers.SelectParameters[0].DefaultValue = dtStart.ToString(cultureUS);
sqlUsers.SelectParameters[1].DefaultValue = dtEnd.ToString(cultureUS);

generateXMLChartData.aspx
===========================
Insert after the line


function Page_Load()
--------------------------
Insert these two lines at the top of the function:

System.Globalization.CultureInfo cultureUS;
cultureUS = new System.Globalization.CultureInfo("en-US", true);

Insert above the line: string strAnimation = "1";
DateTime dtStartDate = DateTime.Parse(strStartDate);
DateTime dtEndDate = DateTime.Parse(strEndDate);


Replace the line
string strSQL = String.Format("SELECT logintime FROM WI_AccessLog WHERE logintime BETWEEN '{0}' AND '{1}'", strStartDate, strEndDate);
with
string strSQL = String.Format("SELECT logintime FROM WI_AccessLog WHERE logintime BETWEEN '{0}' AND '{1}'", dtStartDate.ToString(cultureUS), dtEndDate.ToString(cultureUS));


Reply
Re: Globalisation (or Globalization, as you would put it)
comment1, table of suffixes, http://ppcdoorway.com/prefixes/table-of-suffixes table of suffixes, 11262, prisons jails bars, http://ppcdoorway.com/bars/prisons-jails-bars prisons jails bars, >:DD, retail coffee mugs, http://ppcdoorway.com/mugs/retail-coffee-mugs retail coffee mugs, 8]], cheerleader shorts, http://ppcdoorway.com/shorts/cheerleader-shorts cheerleader shorts, tke, burn and download free music, http://ppcdoorway.com/music/burn-and-download-free-music burn and download free music, pdvl, printable coin wrappers, http://ppcdoorway.com/wrappers/printable-coin-wrappers printable coin wrappers, 84434,

Reply
Re: Globalisation (or Globalization, as you would put it)
comment2, girls of cap d'agde, http://ppcdoorway.com/cap/girls-of-cap-dagde girls of cap d'agde, 702, prison cell design, http://ppcdoorway.com/bars/prison-cell-design prison cell design, =-[, sports posters for sale, http://ppcdoorway.com/poster/sports-posters-for-sale sports posters for sale, 4949, recipes using wonton wrappers, http://ppcdoorway.com/wrappers/recipes-using-wonton-wrappers recipes using wonton wrappers, 673, elephant ear plant nurseries, http://ppcdoorway.com/ears/elephant-ear-plant-nurseries elephant ear plant nurseries, hssuo, prison bars photographs, http://ppcdoorway.com/bars/prison-bars-photographs prison bars photographs, =-DDD, buy regulation straight jacket, http://ppcdoorway.com/jacket/buy-regulation-straight-jacket buy regulation straight jacket, xhvywk,

Reply
Re: Globalisation (or Globalization, as you would put it)
comment5, texas telephone prefixes, http://ppcdoorway.com/prefixes/texas-telephone-prefixes texas telephone prefixes, 2290, kansas telephone prefix, http://ppcdoorway.com/prefixes/kansas-telephone-prefix kansas telephone prefix, 460, funny t shirt in uk, http://ppcdoorway.com/shirt/funny-t-shirt-in-uk funny t shirt in uk, lsofw, rattan bar stools, http://ppcdoorway.com/bars/rattan-bar-stools rattan bar stools, rej, easy to learn musical notes, http://ppcdoorway.com/music/easy-to-learn-musical-notes easy to learn musical notes, 8658,

Reply
Re: Globalisation (or Globalization, as you would put it)
comment1, women's board shorts, http://ppcdoorway.com/boards/womens-board-shorts women's board shorts, 016064, take off my bra, http://ppcdoorway.com/shirt/take-off-my-bra take off my bra, pxafo, bar chairs, http://ppcdoorway.com/bars/bar-chairs bar chairs, hrxl, hieroglyphic writing, http://ppcdoorway.com/translators/hieroglyphic-writing hieroglyphic writing, bxzayq, women's travel vest, http://ppcdoorway.com/vest/womens-travel-vest women's travel vest, 8-O,

Reply
Re: Globalisation (or Globalization, as you would put it)
comment4, breathable waterproof trousers, http://ppcdoorway.com/trousers/breathable-waterproof-trousers breathable waterproof trousers, nywuz, memorable graduation quotes, http://ppcdoorway.com/cap/memorable-graduation-quotes memorable graduation quotes, 16785, sports gift baskets, http://ppcdoorway.com/gifts/sports-gift-baskets sports gift baskets, 665, napkin printers, http://ppcdoorway.com/napkins/napkin-printers napkin printers, 607146, coin values, http://ppcdoorway.com/wrappers/coin-values coin values, 869, safari travelers vest, http://ppcdoorway.com/vest/safari-travelers-vest safari travelers vest, :D, arabic mathematics, http://ppcdoorway.com/translators/arabic-mathematics arabic mathematics, %-),

Reply
John Lewis
http://geneneric-pharma.info

Reply
Re: Globalisation (or Globalization, as you would put it)
Hmm - two lines got filtered out here, presumably because they're native HTML. Not sure of the syntax I should use, so see if you can make sense of this:

generateXMLChartData.aspx
===========================
Insert at the second line in the file (below >%@ Page Language="C#" %< ):
>%@ Import Namespace="System" %<





Reply
Access denied on /admin/manageaccess.aspx
Everything is working exept for admin page. If I try to browse the /admin/manageaccess.aspx page directly I get the "access denied" message.

- My server is not member of the domain.
- LDAP require authentification
- The web server is on DMZ
- WI 4.2, Win2k3, CSG 2.0
- I can add users manually for testing but...

1) How LDAP query can work if the LDAP server is not specified ?
2) I'm not a programmer, but is it possible to include LDAP parameters like it's included in the Victor Viudez restrict access code (LDAP Server, Username, password) ?
http://www.thomaskoetzing.de/index.php?option=com_content&task=view&id=57&Itemid=97

3) Otherwise, how can I restrict access to the Citrix Web Interface with the Access Control Center ?

Tks

Reply
Re: Access denied on /admin/manageaccess.aspx
Turn on integrated authentication for /admin

Reply
Access Denied for Manager
I've attempted every combination I can think of to get the Admin Access to work. I'm not sure what could be going wrong. I went through all the other posts and tried any fixed I found. Here is a copy of my web.config:































I have several domain in my forest as well, so that may add to the issue.

PreWin2k should be PHOTO\Domain Admins
AD is photo.com.

The web server is joined to the root domain.

Thanks for any help you can provide.



Reply
Re: Access Denied for Manager
I think the permissions thing is a common thread. Could anyone show what they have put in for the LDAP values?

key="LDAPDomain" value="????"

key="ManagementGroup" value="???\???"

Reply
Re: Access Denied for Manager
Didn't like my pasting of code.


#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#
#

Reply
Re: Re: Access Denied for Manager
Dang.






Reply
Re: Re: Re: Access Denied for Manager
Dang again. Sorry.


key="LDAPDomain" value="us.photomask.com"

key="ManagementGroup" value="USDPI\Domain Admins"

Reply
Hide Applications based on user name
I want to hide a applications based on a username. I am using a WI4.5 and Metaframe 1.0 Fr2

Reply
Access Denied for Manager
If you are having problems accessing the "Manage Access" portion of the program make sure "Enable Anonymous Access" is UNCHECKED and "Integrated Windows authentication" is CHECKED in the IIS settings for this specific Virtual Directory under Directory Security tab/Authentication and access control.

Reply
Updated URL for text based version
I have a relatively small install where the text based version would work just fine. However, the URL at the top of this listing is no longer valid. Does anyone know a current url for that version of this solution?

Reply
ASP error message when loading admin page
I have set up the WIACC and and trying to access the administration page to add users. However as soon as I log into the admin page i get the following message: Server Error in '/' Application. -------------------------------------------------------------------------------- Runtime Error Description: An application error occurred on the server. The current custom error settings for this application prevent the details of the application error from being viewed. Details: To enable the details of this specific error message to be viewable on the local server machine, please create a tag within a "web.config" configuration file located in the root directory of the current web application. This tag should then have its "mode" attribute set to "RemoteOnly". To enable the details to be viewable on remote machines, please set "mode" to "Off". Can anyone lead me in the right direction here

Reply
Will this app still work with Web Interface 4.6
I am trying to configure this with WI 4.6, but some of the site folder structure has changed. Is is possible to to modify the install to work with 4.6?

Reply
getting unauthorized access
I've got most everything working at this point, except, when I manually key in usernames into WI_Include table OR do it through the Manage Access UI, I continue to get "Unauthorized Access", even when my username is in the database. Also no data is populating the usage calendar. At this point, I would just like the restricted access to work! any help would be great, thanks

Reply
Re: getting unauthorized access
From the details you provided of your issue, it sounds like there might be a SQL communication issue from your Web Interface server to the SQL server. Ensure that you can telnet from your WI server to your SQL server on port 1433. Also, when using SQL Express, remote access is disabled by default. Make sure remote access is enabled for your SQL instance.

Reply
E-directory
Hey Jason....looks like an awesome product. Can this be configured to work with e-directory?

Thanks,
Jason

Reply
Re: E-directory
Everything would work with the exception of the user interface to add users to the "allowed" list. You would need to manually add them to the SQL table.

Reply
Access Denied - ManageAccess
I have set this up on my web server following the information on this page and in the setup doc. Everything is working except for the manageAccess. When I go there, I get an access denied. My setup is as follows. Web server in the DMZ (not part of the domain) SQL installed on WEB server LDAP port opened on the firewall I have tested LDAP communication with Softerra LDAP Browser, ldp.exe, and also adsiedit. The only way LDP works with no input but Softerra and adsiedit require credentials to access the domain (user name and password). This is in the form of domain/user. I am thinking this is why I am getting a access denied from the ManageAccess page. For another test I changes the ManageAccess.aspx.cs and removed the Response.End() line. This allow the page to display but gave an error under the Non-Members stating "Logon failure: unknmown user name". Is there any way to add this information to the script so that the scripts can access the AD, or have a prompt come up asking for this information

Reply
Re: Access Denied - ManageAccess
Does your IIS website allow anonymous authentication?

Reply
Re: Re: Access Denied - ManageAccess
No it does not.

Reply
Re: Re: Re: Access Denied - ManageAccess
any suggestions?

Reply
Internal error on WI4.6
I installed everything and I am able to add/deny users. However, I do have 2 errors which do not allow me to use the application as of this moment. When entering the Citrix WebInterface (4.6 with CSG in DMZ) I get an internal on the "default.aspx" file where I load the WIACC.cs.
Also, in the management interface, when I click to filter "DeniedLogins" in the userdata I get an error saying the selected index for lbUsers does not exist (perhaps OK since the app doesn't work for me ?)

Can anyone clarify, has anyone installed this on 4.6 yet ?

Reply
Re: Internal error on WI4.6
OK, I no longer get the internal error. But even though I added users, I always get that it is not allowed. I can telnet to the SQL server from my WI/DMZ server. I can setup an ODBC connection as well, AND I can see the users in the DB table. Anyone ?

Reply
Re: Re: Internal error on WI4.6
Ok, finally got everything to work (stupid SQL issue), but now it seems that the AccessLog table remains empty. Do I need to do anything to get it up & running ? Adding/removing users works without problems.

Reply

 
Post your comment:
Posting as: Guest. Don't want to post as Guest? Login or Register.
Title:  
Comment:  
Verification Code: