Before you Begin

This manual is for system administrators responsible for installing, configuring, and maintaining Citrix ICA Windows Web Clients. This manual assumes knowledge of:

Citrix MetaFrame Application Server for Windows or Citrix WinFrame

The operating system of the client systems

Web browsers in use on client systems

Installation, operation, and maintenance of network and printing hardware

Citrix offers three ICA Clients for use as Web clients: an ActiveX control, a Netscape Plug-in, and a Java applet. This manual describes the ActiveX control and Netscape Plug-in versions of the Citrix ICA Web Client. For information on the Citrix ICA Java Client, see the Citrix ICA Java Client Administrator's Guide.


How to Use this Guide

To get the most out of the Citrix ICA Client Administrator's Guide, review the table of contents to familiarize yourself with the topics discussed.

This guide contains the following sections:

Chapter	Contents
Chapter 1, "Introduction to the Citrix ICA Windows Web Clients"	Gives a list of features and system requirements.
Chapter 2, "Configuring Citrix Web Computing"	Describes how to configure the Web server and Citrix servers on your network for Citrix Web computing.
Chapter 3, "Installing the Citrix ICA Windows Web Clients"	Describes how to install the Citrix ICA Windows Web Clients.


Conventions

The following conventional terms, text formats, and symbols are used throughout the printed documentation:

Convention	Meaning
Bold	Indicates boxes and buttons, column headings, command-line commands and options, icons, dialog box titles, lists, menu names, tabs, and menu commands.
Italic	Indicates a placeholder for information or parameters that you must provide. For example, if the procedure asks you to type filename, you must type the actual name of a file. Italic also indicates new terms and the titles of other books.
ALL UPPERCASE	Represents keyboard keys (for example, CTRL, ENTER, F2).
[brackets]	Encloses optional items in syntax statements. For example, [password] indicates that you can choose to type a password with the command. Type only the information within the brackets, not the brackets themselves.
...(ellipsis)	Indicates a command element can be repeated.
Monospace	Represents examples of screen text or entries that you type at the command line or initialization files.
	Indicates a procedure with sequential steps.
•	Indicates a procedure with only one step.
	Indicates a list of related information, not procedural steps.
The Citrix ICA Clients allow users to connect to MetaFrame servers and WinFrame servers. When describing a feature or procedure common to MetaFrame and WinFrame servers, this manual uses the term Citrix server. When describing a feature unique to a MetaFrame or WinFrame server, this manual specifies either a MetaFrame or WinFrame server.


Finding More Information

This manual contains conceptual information and installation and configuration steps for the Citrix ICA Windows Web Clients. For additional information, consult the following manuals:

The Citrix ICA Client Administrator's Guides for the ICA DOS, Win16, Win32, Java, Macintosh, and UNIX Clients.

For instructions on installing, configuring, and maintaining your Citrix servers, see the documentation included in your MetaFrame or WinFrame package.

This manual and other Citrix documentation is available in Adobe PDF format in the documentation directory of your MetaFrame or WinFrame CD-ROM. Using the Adobe Acrobat Reader, you can view and search the documentation electronically or print it for easy reference. To download the free Adobe Acrobat Reader, please visit Adobe's Web site at http://www.adobe.com.

Important   Consult the Readme.txt files for MetaFrame, WinFrame, and the Citrix ICA Clients for any last-minute updates, installation instructions, and corrections to the documentation.


Citrix on the World Wide Web

Citrix offers online Technical Support Services at http://www.citrix.com that include the following:

Downloadable Citrix ICA Clients, available at http://download.citrix.com

A Frequently Asked Questions page with answers to the most common technical issues

An FTP server containing the latest service packs and hotfixes for download

An Online Knowledge Base containing an extensive collection of technical articles, troubleshooting tips, and white papers

Interactive online support forums


Year 2000 Readiness

For a detailed description of the Year 2000 Readiness of Citrix products, see our Web site at http://www.citrix.com/misc/y2000.htm.


Introduction to the Citrix ICA Windows Web Clients
Chapter 1 - Introduction to the Citrix ICA Windows Web Clients

Downloading and running applications written for 16- and 32-bit Windows desktops consumes a lot of time and network bandwidth over the Internet or an intranet. As a result, standard Windows applications have been excluded from Internet and intranet Web pages. Citrix Web Computing provides a solution to these limitations.

Citrix Web Computing allows users running a Web browser empowered with one of the Citrix ICA Web Clients to execute Windows applications on a Citrix server. The Citrix ICA Web Clients work with Web sites that have a hyperlink to a Citrix server. Users must have an active TCP/IP connection to an Internet or intranet Web server to use the ICA Web Clients.

Note   Citrix offers three ICA Clients for use as Web clients: an ActiveX control, a Netscape Plug-in, and a Java applet. This manual describes the ActiveX control and Netscape Plug-in versions of the Citrix ICA Web Client. For information on the Citrix ICA Java Client, see the Citrix ICA Java Client Administrator's Guide.


Application Launching and Embedding (ALE)

Application Launching and Embedding (ALE) allows full-function Windows-based applications to be launched from or embedded into HTML Web pages without rewriting application code. Using ALE, administrators can provide online access to existing applications over intranets or the Internet. The application looks and feels as if it were running locally, even though it is actually executing on the Citrix server. There are two ways to run an application from a Web page: launching and embedding.

Launching an application from a Web page involves clicking a hyperlink that references an ICA file. Clicking the hyperlink causes the application to start and appear in a separate window on the local desktop. You can then use this application as if it were installed and running on your local computer.

Embedding an application places the window in which the program runs within the Web page.


Citrix Web Computing Architecture

Citrix Web Computing consists of four components:

Web server. The Web server software can run on the Citrix server or on a separate computer. The only step needed to enable the Web server for Citrix Web Computing is to register ICA as an application MIME type. Any Web server that supports application MIME types can be used.

One important distinction that sets Citrix Web Computing apart from the CGI and Microsoft Active Server Pages models is that the Web server does not execute any additional software to support Citrix Web Computing. The Web server contains ICA files that are downloaded to the Web browser for processing by the ICA Web Client.

Citrix server. To the Citrix server, an ICA connection from a Web client is no different than a connection from any other ICA Client. The same security and user configuration guidelines used for published applications apply to Web Computing.

By default, the ICA connections created during Setup support an unlimited number of connections. See your Terminal Server documentation for instructions on limiting the number of concurrent users.

Fifteen anonymous user accounts are created automatically during installation. There must be sufficient user accounts to support the expected number of concurrent users. If necessary, use User Manager for Domains to manually create additional user accounts.

Citrix ICA Web Client. The ICA Windows Web Clients work with any Web browser that supports configurable MIME types. The Citrix ActiveX control for Internet Explorer and Plug-in for Netscape Navigator and Netscape Communicator allow these Web browsers to display ICA sessions embedded in Web pages.

When a user clicks a hyperlink to an ICA file or loads an HTML page containing an embedded ICA session, the Web browser passes the ICA file to the ICA Web Client, which then initiates a session on the Citrix server using the information contained in the ICA file and the application definition. Video, keyboard, and mouse data are passed between the session on the Citrix server and the ICA Web Client using the Citrix ICA protocol.

ICA file. ICA files are text files containing a series of command tags. These tags define the attributes of the session to be launched on a Citrix server. The Web browser downloads the ICA file and passes it to the ICA Web Client, which then initiates the ICA session on the Citrix server.

You can use either Published Application Manager or the ICA File Editor to create ICA files. See Chapter 2, Configuring Citrix Web Computing for more information.


Citrix ICA Web Client Features

This release of the ICA Windows Web Clients support the following features:

Client drive mapping. Client drive mapping allows drive letters on the Citrix server to be redirected to drives that exist on the client computer; for example, drive H in a Citrix user session can be mapped to drive C of the local computer running the Citrix ICA Client. These mappings can be used by the File Manager or Explorer and your applications just like any other network mappings.

Client printer mapping. Client printer mapping allows a remote application running on the Citrix server to access printers attached to the client computer. Any printers detected when you connect to a Citrix server are automatically added to the Print Manager. Client printers can be browsed and connected to in the same way as network printers.

Clipboard support. Users can cut and paste data between ICA sessions and local applications using the Windows clipboard.

16 and 256 color ICA sessions. You can specify whether the ICA session displays 16 or 256 colors.

Basic and Strong encryption. By default, the Citrix ICA Windows Web Clients support Basic encryption. The ICA Web Clients also support using Citrix SecureICA Services. This server extension (available in North American and Global versions) adds advanced RSA RC5 encryption to the Citrix server and ICA Clients. See the SecureICA Services documentation for more information.

Persistent caching. The ICA Web Clients can save copies of graphics appearing in ICA sessions on the client system's hard disk. Persistent caching of these images increases client performance by reducing the amount of data sent to the ICA Client.

Support for published applications. Application publishing is a method of making specific applications available to ICA Client users as ICA connections. Published applications contain only the specified application in the ICA session and do not involve the ICA Client user in the mechanics of the Windows NT server environment hosting the session.

Load balancing. If Citrix Load Balancing Services is installed on your Citrix servers, you can publish an application on multiple servers.When a published application configured for multiple servers is launched, load balancing support selects which server will run the application based on server load. The ICA Client contacts the master browser, which maintains a list of servers configured to run the published application, to find the address of a server containing the published application. The master browser selects one of the servers based on load and returns the address of that server to the ICA Client.


Citrix ICA Web Client Requirements

The following table describes the minimum configuration requirements for the Citrix ICA Web Clients. The ICA Web Clients support only TCP/IP connections.

Category	Minimum requirement
Web browser	See Supported Web Browsers for more information
Microprocessor	80486 or higher as required for Web browser
Memory	8MB of RAM as required for Web browser
Operating System	As required for Web browser
Video	VGA or SVGA adapter with color monitor as required for Web browser
Hard disk capacity	At least 2.5MB of free disk space
Network card or modem	As required for Web browser
Mouse	As required for Web browser


Supported Web Browsers

The browsers you can use with the ICA Windows Web Clients depend upon whether you are using the Web Clients to embed or to launch ICA sessions.

The following Web browsers support application embedding:

ICA Web Client	Web browser
ActiveX Control	Microsoft Internet Explorer 3.x and 4. x for Windows 95 and Windows NT 4.0
Netscape Plug-in	Netscape Navigator 2.02, 3. x, and 4. x for Windows 3.1, Windows 95, and Windows NT 4.0 Netscape Communicator 4.x for Windows 3.1, Windows 95, and Windows NT 4.0
When launching applications, you can use the ICA Web Clients with any Windows-based Web browser that supports configurable MIME types.

See Chapter 3, Installing the Citrix ICA Windows Web Clients for information on how to use either the ActiveX Control or Netscape Plug-in to configure 16-bit and 32-bit browsers for application launching.


Configuring Citrix Web Computing

The first step in setting up your network for Citrix Web Computing is to prepare your Web server and Citrix servers. This chapter describes how to configure your Web server to facilitate communication between ICA Web Clients and Citrix servers. This chapter then describes how to configure your Citrix servers to host ICA sessions.


Tasks to Complete

In this chapter you will complete the following tasks.

Configure your Web server:

Register the ICA MIME type

Configure your Citrix server(s):

Configure users

Publish applications

 Create an ICA file and HTML file users can access to start launched or embedded ICA sessions


Configuring Your Web Server

To configure your Web server to support Citrix Web Computing, you must add the ICA MIME type. Your Web server can be running on the same machine as your Citrix server or it can be on another local or remote server.

Citrix Web Computing has been tested with Microsoft Internet Information Server, Netscape Communications Server, Netscape Fast Track, and Apache HTTP Server. Citrix Web Computing works with almost any Web server that supports configurable MIME types because the MetaFrame application launching capability uses standard HTML features.

In addition to adding the ICA MIME type, you must supply your Web server with HTML pages and ICA files that users can use to initiate ICA sessions on Citrix servers. These topics are covered later in this chapter in Configuring the Citrix Server.


Registering the ICA MIME Type

To allow application launching from a Web server, you need to register the ICA MIME type with the server. Procedures for doing this vary by Web server. Refer to the sections below for information on how to set up ICA MIME support for your Web server software, or refer to the documentation provided with your Web server on how to add an application MIME type.

The MIME type to configure is application; the MIME subtype is x-ica; and the file extension is .ica. The exact method and syntax for entering this information varies by server.

The next four procedures describe how to register the ICA MIME type on the following supported Web servers:

Microsoft Internet Information Server (IIS) Versions 1.0, 2.0, 3.0, and 4.0. Microsoft Internet Information Server Version 4.0 registers the ICA MIME type during installation and does not require further configuration.

Netscape Fast Track Server.

Netscape Communications Server Version 1.1.

Apache Web Server Version 1.0.3.

To register the ICA MIME Type on Microsoft Internet Information Server Versions 1.0, 2.0, and 3.0

1.	Stop IIS if it is currently running:

A.	Click the Start button and then point to Programs.

B.	Point to the Microsoft Internet Server folder and then click Internet Service Manager. The Microsoft Internet Service Manager starts.

C.	Right-click the icon for the WWW service and then click Stop. Repeat for the FTP and Gopher services.

2.	From the Start menu, click Run.

3.	Type regedt32 and click OK.

4.	In the Registry Editor, select the following key:

\\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\
InetInfo\Parameters\MIMEMap

5.	On the Edit menu, click Add Value.

6.	Enter the following values:

Value Name	application/x-ica,ica,,5

Data Type	REG_SZ

Click OK when finished.

Note  The commas in the Value Name are important and must be entered exactly as shown. REG_SZ is the default data type and can be left alone. You do not need to specify a value for the string; the presence of the registry variable is the relevant information.

7.	Exit the Registry Editor. Restart IIS.

To register the ICA MIME type on Netscape Fast Track Server

1.	Edit the following four files:

path\bin\admserve\cfgstuff\MIME.types

path\bin\httpd\install\misc\MIME.types

path\admserve\httpd-servername\MIME.types

path\httpd-servername\MIME.types

where path is the directory containing the Netscape Fast Track server and servername is the name of the Fast Track server.

2.	Add the following line to the end of each file:

type=application/x-ica	exts=ica

To register the ICA MIME type on Netscape Communications Server Version 1.1

1.	Edit the file path\ns-home\httpd-80\config\MIME.types

where path is the directory containing the Fast Track server.

2.	Add the following line to the end of the file:

type=application/x-ica	exts=ica

This line supports an optional icon=filename parameter if you want to specify a default icon for ICA files displayed, for instance, during ftp browsing.

To register the ICA MIME type on Apache Web Server Version 1.0.3

1.	Edit the file path\conf\srm.conf

where path is the directory containing the Apache Web server.

2.	There is a section in this file where the AddType statements are contained, but new lines can be added anywhere in the file. Add the following line to enable ICA file type support:

AddType application/x-ica .ICA


Configuring the Citrix Server

This section describes how to configure your Citrix server to publish applications on the Internet and/or intranets. To configure your Citrix server(s) you must:

Configure users

Security considerations

Publish applications

Create an ICA file

Create an HTML file


Configuring Users

Before publishing applications, consider your base of ICA Client users and the Windows NT user accounts they must use to access the applications you publish. Application publishing provides ICA session access to two types of user accounts: anonymous and explicit.

Note  The total number of users, whether anonymous or explicit, who can be logged on to the MetaFrame server at the same time is contingent upon your licensed user count.


Anonymous Users

During MetaFrame installation, the Setup program creates a special user group called Anonymous. By default, this Citrix-created Windows NT user group contains 15 user accounts with account user names in the format Anonx, where x is a number in the form 000, 001,... up to 015. Anonymous users have guest permissions by default. If an application published on the Citrix server can be accessed by guest-level users, the application can be configured (using Published Application Manager) to allow access by anonymous users. When a user starts an anonymous application, the Citrix server does not require an explicit user name and password to log the user onto the server, but selects a user from a pool of anonymous users who are not currently logged on.

Anonymous user accounts are granted minimal ICA session permissions. Anonymous user ICA session permissions include the following properties that differ from standard ICA session permissions for the default user:

Ten minute idle (no user activity) timeout

Logged off on broken connection or timeout

No password is required

User cannot change password

Anonymous user accounts do not have a persistent identity; no user information is retained when an anonymous user session ends. Any desktop settings, user-specific files, or other resources created or configured by the ICA Client user are discarded at the end of the ICA session.

Note  Anonymous users are not supported on a Citrix server configured as a primary or backup domain controller.

The 15 anonymous user accounts created during MetaFrame installation usually do not require any further maintenance but their properties can be modified using User Manager for Domains.

Adding and Modifying Anonymous Users

If you install additional user licenses, anonymous users are not automatically created. Adding anonymous users is simply a matter of creating new users and assigning them to the Anonymous group. For security reasons, these user accounts should not belong to any other groups. The easiest way to create additional anonymous users is to copy an existing anonymous user account.

To add anonymous users

1.	Run User Manager for Domains: on the MetaFrame desktop, click Start, point to Programs, point to Administrative Tools, and click User Manager for Domains.

2.	In the User menu, click Select Domain.

3.	Enter the computer name of the Citrix server in Domain and click OK.

4.	Select an existing anonymous user.

5.	In the User menu, click Copy.

6.	Enter a unique name in Username and click Add.

Though not a requirement, it is best to use names of the form Anonxxx, following the pattern of the existing anonymous users. (You can use any name as long as the user is part of the Anonymous group.)

7.	Repeat to add multiple users.

8.	After the last anonymous user is added, click Close.

9.	Exit User Manager for Domains.

The new user accounts are not available until the MetaFrame server is rebooted.

Use the following procedure to change settings for anonymous users.

To modify anonymous user settings

1.	Run User Manager for Domains.

2.	In the User menu, click Select Domain.

3.	Type the computer name of the MetaFrame server in Domain and click OK.

4.	Select the anonymous users.

5.	In the User menu, click Properties.

6.	Change the properties as desired.

7.	Click OK in the User Properties dialog box.

8.	Exit User Manager for Domains.


Explicit Users

An explicit user is any conventional MetaFrame user who is not a member of the Anonymous group. Explicit users are created and maintained with User Manager for Domains. Explicit users have a "permanent" existence: their desktop settings, security settings, etc. are retained between sessions for each user in a user profile. Explicit users can be of any user class and are generally created for a specific purpose.

Note  Never assign an explicit user to the Anonymous group.


Security Considerations

In addition to using standard Windows NT security features and practices, access to Citrix servers can be restricted in several ways:

All users on a specific connection type can be restricted to running published applications only. By restricting users to only predefined applications, you can prevent unauthorized users from obtaining access to a Citrix server or a command prompt. Use the Advanced Connection Settings dialog box in Citrix Connection Configuration to restrict users to running only published applications.

Published Application Manager lets you restrict an application to specified users or groups of users (explicit user access only).

Citrix supports Internet firewalls that can be used to restrict Internet access to the Citrix server. The ICA Web client also includes support for SOCKS proxy servers, which allows controlled firewall traversal. See the topic "Configuring a SOCKS Proxy Connection" for more information.

Users can be required to enter a user name and password in order to execute an application (explicit user access only).

Citrix and most Web professionals recommend you either disassociate your Web site from your production system or rigorously restrict external access. Any system accessible through the Internet is, by definition, a security risk and can give anyone unauthorized access to your production site through the Web. Therefore, unless you have very robust security and plan to use Citrix Web Computing with an intranet, keep your Web server on a separate network loop outside your firewall, if you have one.

The Aclcheck utility examines the security ACLs associated with your files and directories and can report on any potential security exposures. See the "MetaFrame Command Reference" in the MetaFrame Administrator's Guide for more information about this command.

The Application Execution Shell (App) lets you write application execution scripts that perform actions before executing the application and perform cleanup after the application terminates. See the "MetaFrame Command Reference" in the MetaFrame Administrator's Guide for more information about this command.


Configuring a SOCKS Proxy Connection

You can configure the ICA Web Client to connect to a Citrix server through a SOCKS proxy server. This section describes:

Why you use a SOCKS proxy server

Where to locate your SOCKS proxy server


Using SOCKS to Direct ICA Traffic Through Firewalls

To limit access into and out of your Citrix servers, configure a SOCKS proxy server to handle connections between clients and the server. You can place the proxy server on either side of the firewall, or in some situations, on both sides of the firewall.

The benefits of using a SOCKS proxy server include:

Information hiding, where system names inside the firewall are not made known to systems outside the firewall through DNS (Domain Name Service)

Authentication between an ICA Client and SOCKS proxy servers

Authentication between two SOCKS proxy servers

Relaying between two SOCKS proxy servers

Channeling different TCP connections through one connection

UDP proxying

Note  The ICA Web Client supports only clear text username and password authentication.

The general procedure for connecting the ICA Web Client through a proxy is:

1. 	Be sure that your firewall is configured and working properly.

2. 	Install your SOCKS proxy server and test that it works with Web browsers.

1. 	Configure the .ica file associated with the connection.

2. 	Deploy the ICA Web Client.


Locating Your Proxy Server

You can locate your proxy server on either side of your firewall. In some situations, you may want to locate a proxy server on both sides of the firewall. Typical SOCKS proxy configurations are described below. See your proxy documentation for further details about placement and implementation of your proxy server.


Setting Up a Proxy between Clients and a Firewall
(for Outbound Connections)

To restrict clients from connecting directly to servers outside your firewall, install a proxy server between the client systems and the firewall, as shown below.

The proxy server uses its authentication features to determine whether ICA Clients can access networks outside the firewall. Configure the firewall to pass only network traffic that comes from the SOCKS proxy server.


Setting Up a Proxy Between Citrix Servers and a Firewall (for Inbound Connections)

To protect your Citrix servers, install a proxy server between your servers and the firewall. You can configure the firewall in two ways:

Maximize Trust. Configure the firewall to pass only network traffic that is directed to the SOCKS proxy server. The proxy server performs the authentication of the ICA Client.

Minimize Risk. Configure the firewall to allow only connections from specific machines in addition to passing only network traffic that is directed to the SOCKS proxy server.


Setting Up a Virtual Private Network Using Two Proxy Servers

You can create a Virtual Private Network (VPN) between two sites by configuring a proxy server inside the firewall at both the client and server sites. Set up the firewalls to allow only directed UDP traffic between the two SOCKS proxy servers and TCP on the SOCKS port. For additional security, configure the SOCKS proxy server on the ICA Client side to authenticate with the SOCKS proxy server on the Citrix server side. To obtain the address of a SOCKS proxy server within an outside firewall, contact the system administrator responsible for configuring that firewall.

For more information about configuring the ICA Web Client to use with a SOCKS proxy server, see "Configuring a Web Client Connection Through a SOCKS Server " later in this chapter.


Publishing Applications

The next step in preparing your Citrix server(s) for Web computing is application publishing. Application publishing is a method of making specific applications available to ICA Client users as ICA connections. Published application ICA connections contain only the specified application in the ICA session and do not involve the ICA Client user in the mechanics of the Windows NT server environment hosting the session.

Note  You can also configure published applications to contain the entire Windows NT desktop environment if necessary.

MetaFrame includes a utility called Published Application Manager that is the point of administration for application publishing.

The ICA Windows Web Clients let users access published applications. When an ICA Web Client user encounters an ICA file in an HTML page, the ICA Web Client uses the information contained in the ICA file to contact a specified Citrix server and initiate an ICA session containing a specified application. Published application connections are configured for the following connection properties:

Whether the application can be used by explicit or anonymous users

The command line and working directory associated with the application

The groups and/or users allowed to run the application

If the application title bar should be hidden

If the application should be maximized at startup

The servers that can be used to run the application (the ability to run on more than one server requires Load Balancing Services)

If you have not already published the applications you want to make available to ICA Windows Web Client users (and ICA Client users in general), see the MetaFrame Administrator's Guide, WinFrame System Guide, or the online Help for Published Application Manager for introductory and procedural information.


Creating an ICA File

Published Application Manager also includes two wizards that let you create the ICA files and HTML pages you can place on your Web server for users to visit to initiate ICA sessions. After publishing an application, use the Write ICA File wizard to create an ICA file for the application.

The following ICA session attributes are stored in ICA files:

The address of the Citrix server or the name of the published application definition to run

The user name, password, and domain name to use when connecting to the Citrix server

The encryption level to use when connecting to the Citrix server

The size and color depth of the application window when launched from a Web page, expressed in pixels or as a percentage of the window size

Note  Applications embedded in Web pages are sized according to the height and width tags specified in the Web page. The size specifications in the ICA file are ignored.

To create an ICA file

1.	Start Published Application Manager. (On the MetaFrame desktop, click Start, point to Programs, MetaFrame Tools, and then click Published Application Manager.)

2.	In Published Application Manager's main window, select an entry in the list of published applications.

3.	In the Application menu, click Write ICA File, or right-click the published application and select Write ICA File.

4.	Follow the directions on screen. When prompted, save the ICA file to some location on the Web root of your Web server.

You can test ICA files on any system on which you have installed one of the ICA Windows Web Clients and that can access the MetaFrame server using TCP/IP. Copy the ICA file to that computer and then double-click it in File Manager or Windows Explorer.

See the online Help for Published Application Manager for more information on the Write ICA File wizard.


Creating an HTML File

After creating an ICA file for a published application, use Published Application Manger's Write HTML File wizard to create an HTML document that references the ICA file.

The Write HTML File wizard lets you create a Web page for a launched or embedded ICA session. Create a page that launches the application if you:

Want the application to appear in its own window

Want your applications to run at the maximum resolution supported by the client systems

Must support client systems that are not a browser that supports application embedding

Create a page that embeds the application if you:

Want the application to appear in the browser window

Require precise placement of the application in relation to the text in a Web page.

Important  Chapter 3 "Installing the ICA Windows Web Clients" describes how to install the ICA Web Clients using either an installation diskette or by using a Web browser on the client system to download the ActiveX Control or Netscape-Plugin. The Web-based installation method requires that you create an HTML page that embeds an ICA session and that the browsers on your client systems support application embedding. If you want to remotely install ICA Web Clients, create a page that embeds an application. See the topic Supported Web Browsers in Chapter 1 "Introduction to the Citrix ICA Windows Web Clients" for a list of supported browsers.

Whether you choose to launch or embed your application, the Write HTML File wizard gives you the option of making a simple or verbose page. The verbose page illustrates how you can place explanatory text around the embedded ICA session. Once you are familiar with the process, you may find it easier to customize a simple page.

To create an HTML file

1.	Start Published Application Manager. (On the MetaFrame desktop, click Start, point to Programs, MetaFrame Tools, and then click Published Application Manager.)

2.	In Published Application Manager's main window, select the desired published application.

3.	In the Application menu, click Write HTML File, or right-click the published application and select Write HTML File.

4.	When prompted to specify an ICA file on which this page will be based, specify the location and file name of the ICA file you created for this application. If you have not created an ICA file, the wizard can guide you through creating one.

5.	When prompted, save the HTML file to the same location where you saved the ICA file on the Web root of your Web server. In order for the HTML file to correctly launch or embed an ICA session, the ICA file and HTML file must be saved in the same public directory on your Web server.

See the online Help for Published Application Manager for more information on the Write HTML File wizard.

If you created a page to embed an application, please see Embedded Applications. This section describes how to configure the HTML file so that it can be used for remote installation of the ICA Windows Web Clients on client systems.

If you created a page to launch an application, please see Launched Applications below for information on the HTML code that launches an application.


Launched Applications

HTML pages that launch ICA sessions contain a hyperlink to a valid ICA file that is located in some public HTML directory. For example, if you have an ICA file named Word.ica that executes Microsoft Word 7.0 on a MetaFrame server when invoked, your HTML page should contain the following reference:

<a href="Word.ica">Microsoft Word 7.0</a>

When clicked, this hyperlink downloads the file Word.ica to the client system. The client computer then passes Word.ica to the ICA Web Client, which uses the parameters in the .ica file to launch Microsoft Word 7.0 on your desktop.


Embedded Applications

Rather than creating separate Web pages for Microsoft Internet Explorer and Netscape Navigator users, the Write HTML File wizard creates a single page containing the two types of HTML tags used to embed applications for Internet Explorer and Netscape Navigator. VBScript and JavaScript programming in the Web page determines which Web browser type and version the client computer is running and then generates the necessary HTML tags. For browsers that do not support JavaScript or VBScript, the Write HTML File wizard includes links in the HTML file to launch the application instead.

The following parameters can be specified in the HTML file:

Parameter	Description
icafile	The location of the .ica file.
Width and height	The size of the embedded application in pixels.
Start	If Auto, the session starts immediately when the Web page is loaded. If Manual, the session does not start until the user clicks on the session box.
Border	If On, a border is drawn around the session window.
Hspace and vspace	Use these parameters to position the session further from surrounding text. This works similar to the hspace and vspace parameters for the IMG HTML tag.
Cabloc	The location of the ActiveX .cab file.
Plugrefloc	The URL of the page to display if the Netscape Plug-in is not installed.
The Cabloc and Plugrefloc parameters are included for remote installation of the ActiveX Control and Netscape Plug-in. When creating an HTML page that embeds an ICA session, these parameters are set by default to the Citrix ICA Client download site.

To set the download site to some other location (for example, a Web server on your intranet) set these parameters to point to a directory on your Web server and place the ActiveX Control cabinet file (Wfica.cab) and Netscape Plug-in (Wfplug16.exe for 16-bit Windows Web browsers and Wfplug32.exe for 32-bit Windows Web browsers) in that directory.

Important  Remote installation is supported only for client systems using a Web browser that supports embedding applications. See the topic Supported Web Browsers in Chapter 1 "Introduction to the Citrix ICA Windows Web Clients" for a list of supported browsers.

To set the Cabloc parameter for Internet Explorer users

1.	Use the Create HTML File wizard to create an HTML page that embeds a published application. See Creating an ICA File and Creating an HTML File for more information.

2.	Open the HTML file in a text editor.

3.	Search for the line that begins with the following text: var cabLoc =.

4.	Replace the value after the variable with the URL of the ActiveX Control cabinet file. For example, if you have a Web server named "Webserver" and have stored the cabinet file in a directory called "Download" off the Web server's Web root directory, specify

"http://Webserver/Download/wfica.cab";

Make sure you include the quotation marks and semicolon.

5.	The ActiveX Control supports version checking of the ICA Client when users who have already installed the ActiveX Control access an HTML page containing an embedded ICA session. Add the text #Version=x,x,x,x to the end of the URL for Cabloc, where x,x,x,x is a version number for the ActiveX Control. For example, setting Cabloc to the following values forces the following update scenarios:

"http://Webserver/Download/wfica.cab"; Specifying no version information deactivates version checking. When users running the ActiveX Control access a page containing this parameter, no version check occurs, and therefore no update of the ActiveX Control occurs either. This scenario does download and install the ActiveX control for client systems that have not yet had the client installed.

"http://Webserver/Download/wfica.cab#Version=-1,-1,-1,-1"; Specifying
-1 four times forces an update for each user who visits the HTML page, regardless of the version of the ActiveX Control on the client systems.

"http://Webserver/Download/wfica.cab#Version=actual client version number"; Specifying an actual client version number forces an upgrade for client systems that have a version of the ActiveX Control installed that is older than the version referenced in the Cabloc parameter. To determine ActiveX Control version number, use a cabinet viewer to extract the file Wfica.ini from Wfica.cab. Look for the parameter FileVersion in the section named [wfica.ocx].

6.	Save the file and make sure it is stored on your Web server with the ICA file for the embedded session. When users visit the HTML page, Internet Explorer automatically downloads and installs the ActiveX Control.

To set the Plugrefloc parameter for Netscape Navigator users

The Netscape Plug-in remote installation procedure does not automatically download and install the Plug-in. This method prompts the user to follow a hypertext link to a download site for the software. The following procedure describes how to create a simple download page for Netscape users.

1.	Use the Create HTML File wizard to create an HTML page that embeds a published application. See Creating an ICA File and Creating an HTML File for more information. Save the file and make sure it is stored on your Web server along with the ICA file for the embedded session.

2.	Using a text editor, create an HTML page like the following:

<html>

<a href="wfplug32.exe">Click here to download the Netscape Plug-in for 32-bit Windows Web browsers</a>

<a href="wfplug16.exe">Click here to download the Netscape Plug-in for 16-bit Windows Web browsers</a>

</html>

Name the file (Plug-in.htm, for example) and save it in a public directory on your Web server. Copy the Netscape Plug-in files (Wfplug16.exe and Wfplug32.exe) from your CD-ROM to this directory.

3.	Open the HTML file created in Step 1 in a text editor.

4.	Search for the line that begins with the following text: var plugRefLoc =.

5.	Replace the value after the variable with the URL of the page created in Step 2. For example, if you have a Web server named "Webserver" and have stored the HTML page created in Step 2 and the Netscape Plug-in files in a directory called "Download" off the Web server's Web root directory, specify

"http://Webserver/Download/Plug-in.htm";

Make sure you include the quotation marks and semicolon.

When users visit the HTML page containing the embedded ICA session, Netscape Navigator prompts them to visit the secondary page and download the Netscape-Plug-in. Users must download the file, exit all instances of Netscape Navigator, and double-click the file. After installation is complete, users can start Netscape Navigator again and begin using the embedded ICA session.


Configuring a Web Client Connection through a SOCKS Server

To configure a Web client to connect through a SOCKS server, set up the html and .ica files as for a normal connection to a MetaFrame server. You then need to edit the .ica file associated with the connection in two places:

To edit the .ica file to allow connections through a SOCKS proxy server

1.	Open the .ica file in a text editor. Under the section headed [WFClient], add the following four lines:

TcpBrowserAddress=10.1.1.11

ICASOCKSProtocolVersion=0

ICASOCKSProxyHost=10.1.1.13

ICASOCKSProxyPortNumber=1080

Note that the TcpBrowserAddress line may already be present in your .ica file, depending on how you configured it using the ICA file creator. The address you specify for the TcpBrowserAddress is the address of the Citrix server to which you are connecting. This address is needed for application and server browsing.

The address you specify for the ICASOCKSProxyHost parameter is the address of your SOCKS server. The port your SOCKS server uses for network traffic is specified using the ICASOCKSProxyPortNumber. Typically this is 1080, but it can vary if your SOCKS server has been configured differently.

2.	Under the section headed [YourConnection] , where YourConnection is the name of the application or server to which you are connecting, add the following three lines:

ICASOCKSProtocolVersion=0

ICASOCKSProxyHost=10.1.1.13

ICASOCKSProxyPortNumber=1080

As in Step 1, specify the address and port number of your SOCKS server after the ICASOCKSProxyHost and ICASOCKSProxyPortNumber parameters.


Sample .ica Connection File

The following file is a sample .ica connection file that allows a Web client to connect to a Citrix server called Beta through a SOCKS proxy with IP address 10.1.1.13:

[WFClient]

Version=2

TcpBrowserAddress=10.1.1.11

ICASOCKSProtocolVersion=0

ICASOCKSProxyHost=10.1.1.13

ICASOCKSProxyPortNumber=1080

[ApplicationServers]

BETA=

[BETA]

Address=BETA

TransportDriver=TCP/IP

WinStationDriver=ICA 3.0

DesiredHRES=640

DesiredVRES=480

DesiredColor=2

ICASOCKSProtocolVersion=0

ICASOCKSProxyHost=10.1.1.13

ICASOCKSProxyPortNumber=1080


Installing the Citrix ICA Windows Web Clients
Chapter 3 - Installing the Citrix ICA Windows Web Clients

You can install the Citrix ICA Windows Web Clients by using a Web browser on the client system to access a Web page that contains an ICA session or from an installation diskette. This chapter describes both of these installation methods.

This chapter also covers ICA Windows Web Client client-side security configuration.


Tasks to Complete

In this chapter you will complete the following tasks:

Visit a Web page that contains an embedded ICA session to install one of the ICA Windows Web Clients—(5 minutes per client machine)

Alternately, create the Citrix ICA Windows Web Client diskette and use it to install one of the Citrix ICA Windows Web Clients—(5 minutes per client machine)


Installation Methods

The ICA Windows Web Clients provide two methods of installation:

Remote installation lets client system users who do not have access to a Web Client installation diskette install an ICA Windows Web Client. You can use this installation method only with browsers that support application embedding. See Supported Web Browsers in Chapter 1 of this manual for a list of supported browsers.

Diskette-based installation lets you use a diskette to install the ICA Windows Web Clients on client systems within your local network. These client systems must have a floppy disk drive. This installation method can be used for any Windows Web browser that supports configurable MIME types.

For remote installations, see Remote Installation of the ICA Windows Web Clients.

For diskette-based installations, proceed to Diskette-based Installation of the ICA Windows Web Clients below.


Remote Installation of the ICA Windows Web Clients

Remote installation lets client system users download and install an ICA Windows Web Client over an intranet or the Internet. Remote installation of either the ActiveX Control or the Netscape Plug-in involves using a Web browser on the client system to visit an HTML page that contains a reference to an embedded ICA session.

For information on creating an HTML page that contains an embedded ICA session, see Creating an ICA File and Creating an HTML File in Chapter 2, "Configuring Citrix Web Computing." These topics describe how to use Published Application Manager's Write HTML File and Write ICA File wizards to create an HTML page that embeds an ICA session.


Remote Installation of the ActiveX Control

If the ActiveX Control has not already been installed, the first time a user accesses a hypertext document that contains an embedded ICA session, Internet Explorer automatically downloads and installs the ActiveX Control.

Note   By default, the HTML pages you create using the Write HTML File wizard download and install the ActiveX Control from the Citrix Web site. If you want to change this download site to an internal site on a Web server, see Embedded Applications in Chapter 2, "Configuring Citrix Web Computing."

To download and install the ActiveX Control

1.	Start Internet Explorer on the client system.

2.	In the Address field, enter the URL for the HTML document that contains an embedded ICA session.

3.	The Security Warning dialog box appears:

Click Yes to install the Citrix ICA Web Client ActiveX Control. The browser downloads and installs the ActiveX Control. After a short delay, the ICA session begins.


Remote Installation of the Netscape Plug-in

If the Netscape Plug-in has not already been installed, the first time a user accesses a hypertext document that contains an embedded ICA session, Netscape Navigator or Communicator prompts the user to get the Plug-in. The user can then follow the link to the download site for the Netscape Plug-in.

Note   By default, the HTML pages you create using the Write HTML File wizard download and install the Netscape Plug-in from the Citrix Web site. If you want to change this download site to an internal site on a Web server, see Embedded Applications in Chapter 2, "Configuring Citrix Web Computing."

To download and install the Netscape Plug-in

1.	Start Netscape Navigator or Communicator on the client system.

2.	In the Location field, enter the URL for the HTML document that contains an embedded ICA session.

3.	The Plug-in Not Loaded dialog box appears:

This dialog box displays the URL of the Web page that lets you download the Netscape Plug-in.

Click Get the Plug-in.

4.	Another instance of Netscape is started and displays the HTML page containing a link to the Netscape Plug-in.

5.	Download the Netscape Plug-in and save it to some directory on the client system.

6.	Close all instances of Netscape Navigator and double-click the file to install the Netscape Plug-in.

7.	Restart the browser to begin using the Netscape Plug-in.


Diskette-based Installation of the ICA Windows Web Clients

Citrix servers include a utility called the ICA Client Creator that lets you create installation diskettes for Citrix ICA Clients. For the ICA Windows Web Clients, the ICA Client Creator can create a single diskette that lets you install the ActiveX Control, Netscape Plug-in, or the ICA Client engine itself for other browsers.

Note   Both WinFrame and MetaFrame servers include the ICA Client Creator. Make sure you run the ICA Client Creator on the latest version of WinFrame or MetaFrame on your network to create client installation diskettes containing the most recent version of the ICA Client.

To create an installation diskette with the ICA Client Creator

1.	Have a formatted 3.5-inch disk ready.

2.	On MetaFrame, click Start and then point to Programs. Point to MetaFrame Tools, then click ICA Client Creator.

On WinFrame, open the Administrative Tools group and double-click ICA Client Creator.

3.	The Make Installation Disk Set dialog box appears.

4.	Select ICA Client for Web Computing from the list and click OK.

5.	Follow the directions on your screen.


Using the Citrix ICA Windows Web Client Diskette

The following procedures describe how to install the:

ActiveX Control on a client system running Internet Explorer

Netscape Plug-in on a client system running Netscape Navigator or Communicator

ICA Web Client engine on any Windows Web browser that supports configurable MIME types

To install the ICA ActiveX control from diskette

1.	Exit any Web browsers before beginning installation.

2.	Insert the ICA Web Client diskette in drive A (or other appropriate drive) of the client computer.

3.	Click Start and then click Run.

4.	Type copy a:\Activex\* x, where x is some directory on the client system. This directory must be a permanent directory where you will store the ICA Web Client files. For example, if you want to install the ICA Web Client in a directory called Webclnt on the root of a client system's C drive, type copy a:\Activex\*.* c:\Webclnt\

5.	Change directories to the directory created in Step 4.

6.	Type wfica32.exe /setup

7.	After setup is complete, a dialog box appears to confirm successful installation. Click OK.

Internet Explorer is now configured to use the ActiveX Control to launch and embed ICA sessions.

To install the ICA Netscape Plug-in from diskette

1.	Exit any Web browsers before beginning installation.

2.	Insert the ICA Web Client diskette in drive A (or other appropriate drive) of the client computer.

3.	On a Windows 3.1 client system, select Run from the File menu in Program Manager.

On a Windows 95 or Windows NT 4.0 client system, click Start and then click Run.

4.	On a Windows 3.1 client system, type a:\Nsplugin\Wfplug16.exe and press ENTER.

On a Windows 95 or Windows NT 4.0 client system, type a:\Nsplugin\Wfplug32.exe and press ENTER.

5.	Click Yes when asked if you would like to install the Netscape Plug-in. The installation program displays the progress of installation. Click OK when setup is complete.

The browser is now configured to use the Netscape Plug-in to launch and embed ICA sessions.

To configure other Windows Web browsers

Web browsers typically support configurable MIME types, giving you the ability to define how the browser reacts when it receives a file with a certain file extension (the characters that appear after the period in the file name; for example Filename.ica, where .ica is the file extension). Web browsers use Helper or Viewer applications for the different MIME types encountered.

The following procedure describes how to configure a Windows Web browser to support launched ICA sessions. Embedded ICA sessions are not supported for Web browsers other than Internet Explorer and Netscape Navigator or Communicator.

1.	Copy the ICA Web Client engine from the installation diskette to the client system.

If you are configuring a client system running Windows 95 or Windows NT 4.0 (and any browser), manually copy the file Wfica32.exe from the installation diskette to the Windows \System32 directory on the client system's hard disk. The file Wfica32.exe is located in the Activex directory on the installation diskette.

2.	If you are configuring a client system running Windows 3.1 (and any browser), manually copy Wfica16.exe to the Windows \System directory on the client system's hard disk. In order to retrieve a copy of this file, you must run the file Wfplug16.exe (located in the Nsplugin directory on the installation diskette) on a machine that has a copy of a 16-bit Netscape browser installed. After installation completes, locate the file Wfica16.exe.

3.	Configure the browser's MIME type.	Each browser's MIME type configuration dialogs will differ. In general, configure the ICA MIME type on the Web browser as follows:

Mime type/subtype: application/x-ica

File Extension: .ica

Viewer program: Wfica32.exe (32-bit) or Wfica16.exe (16-bit)


Configuring ICA Windows Web Client Security

The ICA Windows Web Clients monitor ICA session access to disk drives on client systems. Users can control the level of access published applications have to client system disk drives and the frequency with which they are warned of attempted access.

The first time a published application attempts to access a client system disk drive, the ICA Windows Web Client displays the following dialog box:

In the What access should be allowed field, users can select:

No Access. Selecting this option prevents a published application from reading or writing to client system disk drives.

Read Access. This option allows a published application to read client system disk drives while preventing disk writes.

Full Access. Selecting this option allows a published application to read and write to client system disk drives.

The Do you want to be asked again field lets users specify how frequently the ICA Web Client notifies them of attempted disk access by published applications:

Always ask me once per connection. Selecting this option causes the ICA Web Client to display the ICA Client File Security dialog box once per ICA connection (when the published application first attempts disk access).

Never ask me again for this application. This option discontinues notification for all connections to this published application.

Never ask me again for any application. Selecting this option discontinues notification for all connections to any published application.

Settings chosen for level of access and warning frequency are stored in the file Webica.ini. This file is located in the client system's %SystemRoot% directory (and/or profiles directory on multi-user systems).

Users can check and edit published application access at any time by invoking the ICA Client File Security dialog box (for example, if a user wants to change access level after choosing to never be warned about security again).

To determine published application access to client drives

1.	Start an ICA session using an ICA Windows Web Client.

2.	Click the ICA icon in the title bar in the upper left corner of the ICA session window. In the menu that appears, click Client Security Status. The ICA Client File Security dialog box appears.

Users must log off and then log back onto the published application before changes take effect.