[Secure Web not redirecting back to mobile app after auth with idp on IOS.]

We have an issue with Secure Web not being able to redirect back to mobile app after authentication with our idp. 

The scenario is: mobile app starts - enter user name - secure web starts - performs auth - instead of redirecting back to mobile app, i get an error "SecureWeb cannot open the page because the address is invalid" 

In this test case all restrictions (open in etc) are set to unrestricted and this regards ONLY iOS devices. Android works just fine. 

Any ideas? 

[Certificate based auth in new Xenmobile setup gives 404 not found error]

Hi 

 In a new XenMobile setup with NS vpx in front (12.1) and one xms (10.14) using certificate based auth and configured all according to http://arnaudpain.com/2019/03/15/citrix-endpoint-management-on-premise-certificate-based-authentication-step-by-step/#sthash.zcGvvjIM.dpbs gives the following:

 

Enrollment set to user name & pw i enter in SecureHub, the path for the xms server then user name and pw. It contiues to show me information about enrollment then i get to a window called iOS over the air enrollment logon stating "authentication failed". If i enter username and pw again it will continue showing "HTTP Status 404 - NotFound" 

Whats the flow here and where does it stop? I can´t see any devices in AdmUI and the invite is still Pending.

What did i missed? 

 

/Marius

[Failed to add citrix gateway details in xenmobile 10.14]

Hi

 

When testing citrix gateway connectivity from a new on-prem xenmobile setup  i get this error in attached pic. How is this check performed; what ipadress need to be able to communicate with the netscalers MGMTIP? Is it the xms internal adress or is it the xms LB ip adress? Also what port is used in this case.

 

I am setting upp a new XenMobile environment with certificate based auth. and i cannot execute any SSL schecks against the xenmobile external ip. For the gateway vip it works just fine by showing the certificate chain but not for the xenmobile address. 

 

Thanks/Marius  

[SecureMail stuck in authorization loops showing app must be approved in securehub.]

Hey all. 

For some month ago, IOS users started to experinence authorization loops when opening SecureMail app. 

What happens is that when the user starts the Mail-app (which can happen any time of the day), the app shows that it needs to be aproved in securehub. The user then enters the pin code and then nothing happens. The "my apps" view is shown in ScureHub and nothing else. If the user presses SecureMail, same procedure repeats again and again and again. 

As workaround we told the users to kill the Hub and Mail app in the background and start Mail app again, which sorted out the problem for most users, but they cannot choose to kill the app every time this happens as it can be several times a day for some or once every day som others. 

The timeouts for XenMobile were set after https://support.citrix.com/article/CTX224958  recomendation for SecureEnvironment but no change. The auth loops are still there and the users are getting very frustrated now... 

Anybody else experiences this? 

 

We are on an on-prem cluster of four xms´s and MPX netscalers in HA pair, with XMS 10.12 RP1 & 2

 

/Marius

 

[SecureWeb - external site with bearertoken log on question.]

Hi, i have a customer that wants to be able to sign to a car rental deal through secureweb. The user receives an email with a link pointing toward the users "my pages" account at the car dealer and a token for sso to surf directly to the rental deal for acknowledgement.

The problem is that instead of the site showing the contract it surfs to the netscalers access interface page not forwarding to the external site. ex. https://netscalervip.com /vpns/portal/homepage.html

The site the user wants to open is: https://mypage.hertzpolestar.net/go/bearertoken

 

Does the sso policies interfere here and tryies to use the users company creds to log on or what can be the case? 

Thanks

 

onprem Xenmobile 10.11 with 2 physical netscalers in HA mode. (12.0.60.10)

[XenMobile 10.3.6 Patch Experiences]

We encounter also the same issue though only 2 times. The app must be authorized 2 times before you can gain access to it. This may have something to do with the time out settings as the messages only appear then. 

 

it behaves in this way: message app must be authorized, gets back to worxhome, enter pincode, worxmail starts, same message, gets back to worxhome, NO pincode this time, worx mail starts again, enter touch id, worxmail is now up.  

[XenMobile 10.3.6 Patch Experiences]

anyone else out there has noticed that on IOS passing join meetings from worxweb to skype has stopped working? In our setup it still works if IOS 9.3.5 is installed but not IOS10. I´m suspecting that the new restrictions (VPN) in IOS10 is messing this up? 

[XenMobile 10.3.6 Patch Experiences]

I´ve the same issue.

"Unable to fetch the reqiured assets to continue.

 

We use Toolkit 10.3.10.24 to wrapped the apps.

XenMobile Server 10.3.6.310.

 

Should the issue fix with 10.3.6 rp?

 

Do you have any experience with that?

 

Thanks!

Did you check the device logs from WorxHome? Could you see the 403 errors which i mentioned in my post? 

 

I did receive a possible solution from Citrix for a while back but i can´t confirm that is working as i did try it with my device but the issue was still there. The solution involves some SQL quieries (to be performed on the Xen-DB) and the xms´s needs to be restarted at least 2 times during the process which is not what i prefer in an production environment and a cluster setup... 

[XenMobile 10.3.6 Patch Experiences]

System ver: 10.3.6.310 now

 

Changing the persistence method to use source IP fixed the 417 issue.

Another issue which some users have (ios and android) is the error message "Unable to fetch required assets.." when accessing worxstore. From the device logs i can see that when accessing worxstore this error is common for both IOS and Androids:

 

"Received an unexpected HTTP 403 response" on android and 

"Request failed: forbidden (403) on IOS

 

I cant see any difference between these devices and other devices which are working fine. 

 

The above problem i´m having on my IOS device and the only way to fix this is to factory reset the device and set it up as new and not from a backup. That is confirmed by another user som it may be a device issue but i´m trying to find a pattern here...

If theres anybody out there with same issue please reply.

 

Thanks/Marius

[XenMobile 10.3.6 Patch Experiences]

After major issues in 10.3.5 in a cluster setup, the 10.3.6 update solved some of the issues but new problems have come up. 

Sporadically HTTP error 417 when start to install the profiles for IOS; some users can´t even get past these errors and not been able to access WorxStore giving "unable to fetch the required assets to continue, please try again" error loop for both android and IOS.

 

Not good at all....