ShareFile Enterprise: Advanced Concepts Hands-on lab exercise guide Page 1 Table of Contents Table of Contents .............................................................................................................................................. 2 Overview............................................................................................................................................................. 3 Request a ShareFile trial account .................................................................................................................... 5 Scenario ............................................................................................................................................................... 6 Exercise 1: On-Premise StorageZones........................................................................................................... 7 Exercise 2: User Management ....................................................................................................................... 20 Exercise 3: Enable SSO with ADFS v2 ....................................................................................................... 40 Exercise 4: Configuring On-Demand Sync ................................................................................................. 77 Page 2 Overview Objective Provide hands-on experience with configuring Citrix ShareFile Prerequisites NA Audience Citrix Partners and Customers. Lab Environment Details AD.training.lab ADFS StorageZones Virtual Machine Information VM Name Router (Hidden) AD.training.lab Win7Client IP Address 192.168.10.1 Description / OS Lab Router / Vyatta ADFS StorageZones 192.168.10.30 Microsoft ADFS 2.0 192.168.10.40 ShareFile Storage Center 192.168.10.11 Active Directory 192.168.10.13 Microsoft Windows 7 client Username training\administrator training\administrator training\user1 training\administrator training\administrator Password Citrix123 Citrix123 Citrix123 Citrix123 Citrix123 Service Accounts Username adfsadmin szadmin Password Citrix123 Citrix123 Description ADFS Service Account ShareFile StorageZones Service Account Page 3 How to log into the lab environment Follow the directions below to access the lab environment. Step 1. Action Launch your web browser and go to http://ilt.citrixvirtualclassroom.com. 2. On the website, type in the session code provided by your instructor and your business email address. Click “Get started”. 3. Once you’ve logged in, click the Start Lab button. This will launch your lab session. Note: Please wait for the application to launch. 4. Right-click XenCenter and select Add. 5. On the Add New Server screen enter the XenServer IP address provided on the website and in the Password field enter the password provided on the site. Page 4 Request a ShareFile trial account Follow the directions below to get access to a ShareFile trial account. Step 1. 2. 3. Action Launch your web browser and go to http://www.citrix.com/embedded/download/sharefile/account-registration. On the website, fill out the form and agree to the terms and conditions. Then Submit your registration request. Within a few minutes you will receive an email message from ShareFileFMD@citrix.com. Click on the link provided in the message or go to http://www.sharefile.com/login.aspx in your browser. 4. Provide the email address and password you used during the registration. Then click Log In. 5. After logging in, look at the address bar. This is your ShareFile subdomain that you will need during the exercises. Page 5 Scenario You are the system administrator at Synergy Training Solutions. The CEO wants to enable a cloud-based file sharing solution, so all employees are able to access all their data, any time and from any device, and share that data with their contacts at business partners and customers. The CIO does have some additional requirements, as she has to make sure the company security policies are followed and the solution is compliant with the compliance regulations for your industry. Additional requirements from the CTO: All data has to be stored inside the corporate datacenters. Users accessing the data need to log on using their Active Directory credentials. As the company uses a VDI environment hosted by XenDesktop with pooled desktops, the amount of data synced to the virtual desktops needs to be kept to a minimum. With these requirements in mind, you start implementing a solution based on Citrix ShareFile. To fulfill all the requirements from the CTO, you use ShareFile StorageZones with on-premise storage, federated authentication by using Microsoft ADFS v2.0 and you configure On-Demand Sync for the ShareFile Sync client. Page 6 Exercise 1: On-Premise StorageZones Overview For this exercise, we will create an on-premise storage zone that allows users to store files on premise in a CIFS file share instead of in the ShareFile cloud. An empty file share has been created for you at \\AD\StorageZone. Note: On-premise StorageZones require a server with a public Internet address and a trusted SSL certificate. The Internet Information Services role of Windows Server 2008 R2 in your environment has already been configured with a trusted wildcard certificate to complete the installation. Step-by-step guidance Estimated time to complete this lab: 25 minutes. Step Action 1. Using XenCenter select StorageZones and select the Console tab 2. Log on using the following credentials: Username: TRAINING\administrator Password: Citrix123 3. Open Windows Explorer and go to \\AD\Software. 4. Navigate to the StorageZone Controller 2.0 folder and run the StorageCenter.msi installer. When prompted, click Run. 5. Click Next. Page 7 Step 6. Action Select the Checkbox to accept the License Agreement and click Next. 7. Click Next to accept the default installation location. 8. Click Install. Page 8 Step 9. Action Ensure the Checkbox to Launch Storage Center Configuration Page is unchecked, then click Finish. 10. Click Yes to restart the server. 11. From the Start Menu, launch the Configuration Page under Citrix ShareFile StorageZones Controller. Page 9 Step 12. 13. 14. Action Enter the details for your ShareFile trial account. Select the radio button for Create new Zone and provide a name for your new Zone (Example: California Datacenter). Select the checkbox to enable StorageZone for ShareFile Data, StorageZone Connector for Network File Shares and StorageZone Connector for SharePoint. Page 10 Step 15. Action Fill in the fields to configure the StorageZone, then click Register. Hostname: STORAGEZONES External Address: Refer to the student portal and look for IP2-StorageZones. The external address is the IP address with the dots (.) changed to dashes (-) followed by .mycitrixtraining.net. Example: IP2-StorageZones of 1.1.1.1 would have the external address 1-1-11.mycitrixtraining.net Storage Location: \\AD\StorageZone Storage Login: Training\szadmin Storage Password: Citrix123 Enable Encryption: leave unchecked Create Passphrase: Citrix123 Re-enter Passphrase: Citrix123 Page 11 Step 16. Action You should receive a message saying Storage Center has been configured successfully! 17. Click Monitoring in the menu bar and you should see all green checkmarks. If ShareFile Connectivity from Management Service does not have a green checkmark, wait a moment and then refresh the page. Page 12 Step 18. 19. Action To view the file structure created on the local file share, click Start > Run and enter \\AD\StorageZone and view (but do not modify the folder contents). From your student laptop, open Internet Explorer and go to the URL of your ShareFile account specified in the student worksheet and login using the Email Login and click Log In. Page 13 Step 20. 21. Action After logging in click on Admin in the menu bar. Then click Storage Zones in the right-hand column. Page 14 Step 22. 23. Action Select the name of the StorageZone you just created. Statistics on each StorageZone Controller in the StorageZone are presented on this page. Page 15 Step 24. 25. Action Now you’ll create a new ShareFile folder that uses your on-premises StorageZone for file storage. Click Home in the menu bar followed by the Shared Folders tab to reach a top level folder in the ShareFile account. Click Create Shared Folder. Page 16 Step 26. Action Name the folder Internal SZ Test and select your storage zone name from the drop-down list of storage zones. Click Create Folder. Optionally you can also Add Users to the new shared folder. 27. Test your On-Premises StorageZone by clicking Upload Files to upload a file to your StorageZone Controller. 28. You can view the file objects as they are added to the folder structure beneath \\AD\StorageZone\persistentstorage\sf-usnw-1\ Page 17 Step 29. Action Go to Connectors and click Create Connector to create a new Connector. 30. Add a SharePoint Connector with the following information. Zone: your StorageZone Site: http://sharepoint/Shared%20Documents/Forms/AllItems.aspx Name: SharePoint Doc Library 31. Optional if you have an iOS device: Add your ShareFile account to the ShareFile app on your device. Go to the SharePoint Connectors and click on the SharePoint Doc Library. To authenticate, use username training\administrator with password Citrix123. Summary Page 18 Key Takeaways The key takeaways for this exercise are: With StorageZones, ShareFile allows you to store encrypted user data within your data center, on your own file servers instead of copying user data to the Citrix cloud. StorageZones files are written in a ShareFile object format that is readable only by authenticated ShareFile clients. Page 19 Exercise 2: User Management Overview In this exercise we will automate the ShareFile account creation by using the ShareFile User Management Tool. The UMT will be the link between the Active Directory and the ShareFile platform. Using the UMT to create user accounts will not only save time, but also reduce errors in creating the user accounts. Note: Every ShareFile account needs to have a First Name, Last Name and E-mail Address. For the UMT to create new accounts, make sure that the accounts in the Active Directory have those fields populated. Note: The User Management Tool requires .NET Framework 4.5 to be installed on the server. This prerequisite has already been installed on your lab server. Step by step guidance Estimated time to complete this lab: 25 minutes. Step Action 1. Using XenCenter select ADFS and select the Console tab 2. Log on using the following credentials: Username: TRAINING\administrator Password: Citrix123 3. Open Windows Explorer and go to \\AD\Software\UMT 1.4 4. Double-click Setup_UMT_1.4_x64.msi to launch the installer for the User Management Tool. When prompted, click Run. 5. Click Next. Page 20 Step 6. Action Click Next to start the installation. 7. Click Close to finish the installation. 8. From the Desktop, launch the ShareFile User Management Tool. Page 21 Step 9. Action We need to log on to our ShareFile account. First, specify <yourdomain>.sharefile.com as the Account URL. Provide the user name of the admin account and the password for that user. Click Log on. Page 22 Step 10. Action Next we need to connect to the Active Directory. The account used to connect to the AD only needs LDAP look-up permissions. In our lab we use the account we have pre-created for the ADFS exercise. Specify the following information: Domain: training.lab UserName: adfsadmin Password: Citrix123 Click Connect. Page 23 Step 11. Action First we’re going to sync AD user accounts into ShareFile Employee accounts. Either click on the Users button or select the Users tab. Page 24 Step 12. Action Expand the Active Directory tree and go to training.lab – Synergy – Users. Select the Users OU and on the right-hand side you’ll see the 15 user accounts inside this OU. Click Add Rule. Click OK after the rule has been added. Page 25 Step 13. Action Switch to the Rules tab and click the Options button. This will allow you to change some of the default settings for the accounts that are being created by the UMT. In the User Creation Options screen, provide a Default company name and change the Storage Zone to the StorageZone you have created in Exercise 1. Click OK. Page 26 Step 14. 15. Action Select the Users OU – Sync Users rule. In the right-hand panel, only enable the Create and Update Users actions and disable the other actions (the activated actions will be highlighted in green). Click Simulate Active to see all the actions that committing the rule would perform. After verifying that 14 new user accounts will be created and 1 user account will be updated, click Commit Now. Launch Internet Explorer and go to https://<yourdomain>.sharefile.com. Log on with your administrator credentials. Page 27 Step 16. 17. Action Click on Manage Users, followed by Browse Employees. Notice that the user accounts have been created. Click on one of the newly created user accounts. Page 28 Step 18. Action Take a look at the user account. Notice that the Company field has been filled by the value specified earlier in the Options screen of the UMT and that the StorageZone is indeed the one created in Exercise 1. Page 29 Step 19. 20. Action Expand the Folders menu and click Folders from the tree view. Click Add Folder. Page 30 Step 21. 22. Action Name the new folder Sales. We don’t add new users at this time. Click Create Folder. Switch to the User Management Tool. Click on the Groups tab and scroll down in the list of groups until you see Sales. The User Management Tool will automatically show all the groups inside the Active Directory. Select Sales and click Add Rule. Page 31 Step 23. 24. Action Click Yes to also create a new rule to generate user accounts if new AD accounts are added to this group. By default, a rule based on groups will only create a Distribution Group and update the members of that Distribution Group. You would need another user generating rule to create the user accounts (e.g. based on OU membership or on a different AD group). Switch to the Rules tab. Select the Sales – Sync Group rule and enable the Create and Update Groups actions. Click Commit Now. Page 32 Step 25. Action Switch to Internet Explorer and click Manage Users. Click Distribution Groups and see that a new group has been created with the name Sales. There are no members inside this group yet. Page 33 Step 26. 27. Action First we will grant this new distribution group access permission to our shared folder Sales. Extend the Folders menu and select the Sales folder. When viewing the Sales folder, click Edit to change the access permissions. Click the drop-down menu to Add Users and select Add Distribution Group. Page 34 Step 28. 29. Action Select the Sales distribution group and click Next. Leave the default settings selected and click Add Users. Page 35 Step 30. 31. 32. Action Click Save Changes. The next step is to add AD users to the Sales security group. Switch to the AD.training.lab VM. Open Active Directory Users and Computers from the Desktop. Go to training.lab – Synergy – Groups and double-click the Sales group. Add user2 as a member of the group. Click OK. Page 36 Step 33. 34. Action Switch back to the ADFS VM and go to the User Management Tool. Go to the Rules tab, select the Sales – Sync Group rule and click Simulate Active. Notice that no actions are required. The UMT will only retrieve the AD information on the initial connection to the AD. In the right-hand top-corner, click on the Connect to a domain button. Page 37 Step 35. 36. Action Select training.lab from the drop-down menu. The UserName adfsadmin will automatically be populated. Provide the Password Citrix123 and click Connect. Click the Rules tab once more and select the Sales – Sync Group rule. Notice that now an update will be performed for this rule, we need to update the Sales Distribution Group. Click on Commit Now. Page 38 Step 37. Action Switch to Internet Explorer and go to Manage Users – Distribution Groups. Notice that the Sales group now has 1 member. If you click the Sales group, you’ll see that User2 has been added. Summary Key Takeaways The key takeaways for this exercise are: Every employee that needs to use the ShareFile platform needs to have a ShareFile account. With the User Management Tool you can easily create new ShareFile accounts and distribution lists based on AD Organizational Units and Security Groups. Page 39 Exercise 3: Enable SSO with ADFS v2 Overview In this exercise we will install and configure ADFS v2.0 in order to use SAML based authentication. This will allow ShareFile users to log on with their Active Directory credentials. Step-by-step guidance Estimated time to complete this lab: 25 minutes. Step Action 1. In your XenCenter console, switch to server ADFS. 2. Open Windows Explorer and go to \\AD\Software\ADFS 2.0. Double-click AdfsSetup to start the installer for ADFS v2. When prompted, click Run. 3. On the Welcome Screen, click Next. Page 40 Step 4. 5. Action Mark the checkbox to accept the License Agreement, then click Next. Confirm that you are installing the Federation Server role, then click Next to continue. Page 41 Step 6. Action The installer will notify about the software pre-requisites. The installer will automatically install the missing components. Click Next to continue. 7. The installer will install the ADFS v2 components, as well as the missing pre-requisites. Page 42 Step 8. 9. Action Make sure the checkbox next to Start the AD FS 2.0 Management snap-in when this wizard closes is checked. Then click Finish to continue. In the ADFS 2.0 management console, start the Configuration Wizard to configure the Federation Server. Page 43 Step 10. Action When the Wizard starts, select Create a new Federation Service and click Next. Page 44 Step 11. Action On the Deployment Type screen, select New federation server farm. Then click Next to continue. Page 45 Step 12. Action Because we use a wildcard certificate, we need to specify the Federation Service Name. Go to your Virtual Training Center and look for the IP address under IP1-ADFS. Add this IP address in front of .mycitrixtraining.net (removing the asterisk) and change the dots into dashes. E.g. the Federation Service Name for IP1-ADFS 184.172.20.195 will become 184-172-20-195.mycitrixtraining.net. Double-check that you have used the correct Federation Service Name. If you have misconfigured this, the ADFS server will not be able to service SSO requests to ShareFile. When in doubt if you have configured this correctly, ask one of the facilitators to validate the Federation Service Name you have entered. Page 46 Step 13. Action Specify the Service Account. Click Browse and then search for adfsadmin. Click OK, then provide the password Citrix123. Click Next to continue. Note: the adfsadmin account is a regular Active Directory user without any additional privileges. Page 47 Step 14. Action Review the steps that the ADFS Configuration Wizard will perform (hint: it doesn’t hurt to once again check the correctness of the Federation Service Name). Then click Next to perform the configuration steps. Page 48 Step 15. Action After all the components have been configured, click Close to exit the Wizard. Page 49 Step 16. Action Expand the Service node in the Management Console. Select the Token Signing certificate and click View Certificate in the right-hand console. Page 50 Step 17. 18. Action Go to the Details tab and click Copy to File. The Certificate Export Wizard will launch. Click Next to continue. Page 51 Step 19. 20. Action Select Base-64 encoded X.509 (.CER) as the export format for the certificate. Click Next. Save the certificate file to your Desktop and click Next. Page 52 Step 21. Action Click Finish to save the file to the Desktop. Page 53 Step 22. Action Minimize the ADFS Management Console. Locate the certificate file on the Desktop. Right-click the certificate file and select Open with… Then select Notepad to open the file. Page 54 Step 23. Action Select all the text inside Notepad (CTRL+A) and copy (CTRL+C). Page 55 Step 24. 25. Action Open Internet Explorer and go to your ShareFile account (https://<yoursubdomain>.sharefile.com). Log on with your administrator account. Click Admin, followed by Configure Single Sign-On. Then click Change next to X.509 Certificate under Basic Settings. Paste your certificate information (CTRL+V) and click Save. Page 56 Step 26. Action Check the checkbox next to Enable SAML. Then specify the ShareFile Issuer / Entity ID. Specify <yoursubdomain>.sharefile.com as the value. Page 57 Step 27. Action The value of Your IDP Issuer / Entity ID needs to be configured as https://<yoursubdomain>.sharefile.com/saml/info. Page 58 Step 28. Action Specify the Login URL. Review your Federation Service Name from Step 12 of this exercise. When in doubt, you can check the name inside the ADFS Management Console by viewing the Token-Signing certificate. The value for Login URL should read https://<Federation Service Name/adfs/ls. Page 59 Step 29. Action Change the SP-Initiated Auth Context under Optional Settings to Integrated Windows Authenticated and Minimum. Then click Save. Page 60 Step 30. Action Minimize Internet Explorer and return to the ADFS Management Console. Expand the Trust Relationships node and select Relying Party Trusts. Then click Add Relying Party Trust… from the right-hand side of the console. This will launch the Add Relying Trust Wizard. Page 61 Step 31. Action Click Start to begin specifying a Relying Party Trust. Page 62 Step 32. Action Retrieving the metadata from the ShareFile SAML site can configure the trust automatically for you. Use https://<yoursubdomain>.sharefile.com/saml/metadata as the Federation metadata address (host name or URL). Click Next. Page 63 Step 33. Action Specify a Display Name. Typically you will keep this as <yoursubdomain>.sharefile.com, so you can identify the different trusts from each other. Click Next. Page 64 Step 34. Action Permit all users to access this relying party. Click Next. Page 65 Step 35. Action Verify that all information is correct. Then click Next. Page 66 Step 36. Action Verify that the checkbox for Open the Edit Claim Rules dialog for this relying party trust when the wizard closes is checked. Then click Close. Page 67 Step 37. Action On the Issuance Transform Rules tab, click Add Rule… Page 68 Step 38. Action The first rule will be to Send LDAP Attributes as Claims. Page 69 Step 39. Action Users in the ShareFile platform are identified by their e-mail address. We send the claim as an UPN. Give a descriptive Claim rule name, such as E-mail Address to UPN. Select Active Directory as the attribute store. Finally select E-Mail-Addresses as the LDAP Attribute and UPN as the Outgoing Claim Type. Click Finish. Page 70 Step 40. Action Create a second rule. This rule will be used to Transform an Incoming Claim. Click Next. Page 71 Step 41. Action The incoming claim type will transform the incoming UPN to an outgoing Name ID claim type in the e-mail format. This way we can log on with our UPN and have this one be used as the Name ID on ShareFile, which needs to be in an e-mail format. Give a descriptive name, such as UPN to E-Mail Address. The Incoming claim type is UPN, the Outgoing claim type Name ID. The Outgoing name ID format is Email. Click Finish. Page 72 Step 42. Action Verify that the claims are correct, then click OK. Page 73 Step 43. Action Select your Relying Party Trust and then click Properties from the right-hand pane. Page 74 Step 44. Action Go to the Advanced tab and change the Secure hash algorithm to SHA-1. Click OK. Page 75 Step 45. Action Switch to the Win7Client VM and open Internet Explorer. Type the following address in the address bar: https://<yoursubdomain>.sharefile.com/saml/login. Notice how you will be redirected to the ADFS service and that the authentication method being used is integrated. Log on with username user1 and password Citrix123. You will be redirected once more, this time to the ShareFile page. You will have logged on as user user1 and see the personal files of this user. Summary Key Takeaways The key takeaways for this exercise are: You have installed and configured ADFS v2 and the Single Sign-On options for ShareFile. Page 76 Exercise 4: Configuring On-Demand Sync Overview In this exercise students will learn how to deploy and configure ShareFile On-Demand Sync for nonpersistent desktops. Step by step guidance Estimated time to complete this lab: 25 minutes. Step Action 1. Using XenCenter select AD.training.lab and select the Console tab 2. Log on using the following credentials: Username: TRAINING\administrator Password: Citrix123 3. Launch the desktop shortcut Group Policy Management 4. Expand the training.lab domain 5. Right-click Group Policy Objects and select New 6. Name the New GPO: CTX_ONDEMAND and click OK 7. Right-click the newly created GPO and select Edit Page 77 Step 8. Action In the Group Policy Microsoft Management Console (MMC), click Computer Configuration. Navigate to Administrative Templates, click System, click Group Policy, and then enable the User Group Policy loopback processing mode. Under Options select Mode: Replace Page 78 Step 9. Action Navigate to Computer Configuration, ShareFile, Enterprise Sync node Page 79 Step 10. Action Configure the On-demandSyncDiskVolume policy to set the local sync path’s root drive Page 80 Step 11. Action Navigate to User Configuration, ShareFile, Enterprise Sync node Page 81 Step 12. Action Configure the Account policy with the name of your ShareFile account subdomain.ShareFile.com Page 82 Step 13. Action Select the Authentication Type and choose Active Directory Single Sign-on Page 83 Step 14. 15. 16. 17. 18. 19. 20. 21. 22. Action Set the personal folder to use On-Demand Sync Close the Group Policy MMC Using the Group Policy Management tool expand the Synergy OU Right-click on the Computers OU and select Link and Existing GPO Select CTX_ONDEMAND and click OK Using XenCenter select Win7Client.training.lab and select Reboot Using a web browser on your local laptop login to the your ShareFile website https://<yoursubdomain>.sharefile.com/saml/login using the following credentials: Username: User1 Password: Citrix123 Upload some sample files to your ShareFile account Sample files are available here: https://synergylab.sharefile.com/d/s2cca0742cff4ef8b Select the Console tab and wait for the virtual machine to reboot then log on Page 84 Step 23. 24. Action Log on using the following credentials: Username: TRAINING\user1 Password: Citrix123 Open Explorer and select ShareFile from the Favorites list, right-click and select Properties of one of the files in the directory. Notice the difference between the size of the file and the size on disk. Summary Key Takeaways The key takeaways for this exercise are: ShareFile On-Demand Sync saves you valuable storage space on nonpersistent desktops. Group Policy can be used to automate the configuration of ShareFile OnDemand Sync. Page 85 Revision History Revision Change Description Updated By 1.0 Original Version Dan Brinkmann Rob Sanders 1.1 Updated exercise 1 to StorageZone Controller Rob Sanders 2.0 Date 05/2013 07/2013 About Citrix Citrix Systems, Inc. designs, develops and markets technology solutions that enable information technology (IT) services. The Enterprise division and the Online Services division constitute its two segments. Its revenues are derived from sales of Enterprise division products, which include its Desktop Solutions, Datacenter and Cloud Solutions, Cloud-based Data Solutions and related technical services and from its Online Services division's Web collaboration, remote access and support services. It markets and licenses its products directly to enterprise customers, over the Web, and through systems integrators (Sis) in addition to indirectly through value-added resellers (VARs), value-added distributors (VADs) and original equipment manufacturers (OEMs). In July 2012, the Company acquired Bytemobile, provider of data and video optimization solutions for mobile network operators. http://www.citrix.com © 2013 Citrix Systems, Inc. All rights reserved. Page 86