Looking for:
Citrix workspace timeout. StoreFront 2203 LTSR CU2 through 3.5 – Basic Configuration |
Citrix workspace timeout -
Asked by Andy Vanderbeken. I then configured - for testing and validation purposes - in Storefront that logons to this website should timeout and logoff 1 minute after no activity as follows:. When testing logging in from for instance a Chromebook from an external internet line through the Netscaler Gateway I validated succesfully that I get the " logoff successful " page after 1 minute inactivity but when testing the same from a Windows app for windows I cannot get authentication to pop-up.
No authentication pop-up happens. Instead the workspace app for windows reconnects to the existing previously disconnected Citrix session immediately which is a potential security breach according to our company policy. Update, solution and conclusion for future reference to all that it may concern or interest:. After more rigorous testing and searching I have found my remaining answers to enforce a strict security plan against Session hijacking after a computer theft for people connecting to your Citrix session from any possible external resources Android, Ipad, Windows laptops and computers, Chromebooks, To summarize there are 3 levels that can be controlled of which 2 are essential and necessary as well as sufficient while the third one can be considered optional as well as incomplete:.
For this I found the only true working -under all conditions- solution to be The Citrix policy " Server Idle Timer interval ". Practically it means that regardless of which client device or way of connecting remotely or internally, any Citrix session where no input has been detected for X minutes will be disconnected but remains available for instant reconnecting after for instance a lunch break.
This timer value is set and defined in the Netscaler Gateway " Global Settings " section under the " Client Experience " tab in the " Session Time-out " field. By setting it there it will apply to all scenario's and sessions coming in through Netscaler gateway.
In other words all external connections where the risk is largest and control least. Internal connections go directly to the storefront server and come from internal computers that are subject to policies where we have full control over these timers so they are out of scope for this case. Note also that there is a random extra timer automatically being added to the timer you define of up to a few minutes due to internal gateway working in mysterious ways.
This is a big caveat and set me on the wrong foot causing me to wrongfully conclude and dismiss this field as not-working-properly during my initial testings. For instance if you define 1 minute and start testing by clicking the icon again after you timing 60 seconds on your chronometer you will see your setting does not take effect yet and reconnect still happens immediately without re-authentication.
However if you define 1 minute and wait seconds on your chronometer you will always get the authentication prompt as it should. So add 2 minutes at least when testing. This is essentially what causes the logged on website to redirect itself to an empty page with the words "Your session has timed out due to invactivity" or "you have been logged off More specific this option even only applies to a single exact storefront website you set it for while typically multiple will be needed in order to handle all scenario's.
So using nr 1 and 2 alone I was able to enforce that -regardless of which device or connection or scenario- people are always enforced to re authenticate after X minutes.
This is handy in scenario's where for instance careless employees get their chromebook stolen from the car while a chromebook typically allows the ' lucky finder ' to immediately reconnect to and take over an existing Citrix session because of default Chromebook behaviour.
I'm sure you can think of many other possible scenario's that will be considered a 'potential security leak' by your company policy. Screenshots below. Feel free to leave a comment or vote up if you find this solution useful. I am very interested in what you come up with this testing. Citrix support hasn't been much assistance here because they say that full receiver should only be used for internal use and thus managed by the workstation lock and logout policies.
This however will time out the session at least in previous testing, it may have changed in newer releases I do, however, see a new setting after recent NetScaler upgrades for Forced Time Out Warning which hasn't been there previously, so they may have improved the functionality and I haven't tested it yet.
I am interested in hearing how things work for you in your testing. I will look for some time to test this again as well. I had tried those already in fact. The new ones apply to the "Netscaler gateway plugin" which is not the same so doesn't apply here. I had already tried all of those to no avail before posting here. I'm going nuts on this little thing that seems so simple yet I cannot get it to work.
I do see however that if I wait long enough or is it just random?? Thanks for doing all the research and testing. Your finding are what I found as well, with the additional information about the "random extra timer" that I didn't know about. The biggest issue we have with the setting though is that number 2 is not an idle timer, but a hard timeout. It doesn't matter if the user clicks an icon during the time, they will be force to re-authenticate at X minutes.
There is no "inactivity" timer. It is better than nothing. You are right. It is indeed a hard timer. The "after X minutes idle" timer should have been the option just below it or at least I guess, because I tested that one rigorously as well but I every time I tested -no matter how long I waited- the icons would simply immediately reconnect.
In other words this field does not seem to affect anything at all. That being said a hard timeout is fine for the Netscaler gateway session since it's only a 1-time-hurdle-to-pass while the actual Citrix HDX session itself can have many periods of user inactivity so there we do need an idle timer that resets itself when the user continues.
Luckily that specific policy provides just that. Thank you for time and efforts for the update. I'm on the same boat but still no luck with the timeout of Citrix Workspace app. I took the nr. In our case we have several HP t thin clients NOT part of a domain, so this is the only option to control inactivity of the Citrix Workspace.
I did tried the guide here regarding the Citrix App but still no success. You will be able to leave a comment after signing in. Welcome to the Citrix Discussions. Our site does not support outdated browser or earlier versions.
To use our site, please take one of the following actions:. Jump to content. Ask question. Upvote if you also have this question or find it interesting.
Learn more. Follow, to receive updates on this topic. Sign in to follow this Followers 0. Andy Vanderbeken Andy Vanderbeken Aficionado Members posts. Posted July 18, I then configured - for testing and validation purposes - in Storefront that logons to this website should timeout and logoff 1 minute after no activity as follows: When testing logging in from for instance a Chromebook from an external internet line through the Netscaler Gateway I validated succesfully that I get the " logoff successful " page after 1 minute inactivity but when testing the same from a Windows app for windows I cannot get authentication to pop-up.
Share this post Link to post. Recommended Posts. Mark this reply as best answer, if it answered your question. Upvote if you found this answer helpful or interesting. Posted July 31, Update, solution and conclusion for future reference to all that it may concern or interest: After more rigorous testing and searching I have found my remaining answers to enforce a strict security plan against Session hijacking after a computer theft for people connecting to your Citrix session from any possible external resources Android, Ipad, Windows laptops and computers, Chromebooks, To summarize there are 3 levels that can be controlled of which 2 are essential and necessary as well as sufficient while the third one can be considered optional as well as incomplete: 1.
Practically it means that regardless of which client device or way of connecting remotely or internally, any Citrix session where no input has been detected for X minutes will be disconnected but remains available for instant reconnecting after for instance a lunch break 2.
Dennis Parker Dennis Parker Aficionado Members posts. James Kindon 2, I don't believe this is, or has ever been possible I am with Dennis in being very curious. Joe Robinson Joe Robinson Master Members 1, posts. Posted February 14, It saved me a lot of time! DDimitrov 0. DDimitrov 0 Members 1 post. Posted August 11, edited. Please sign in to comment You will be able to leave a comment after signing in Sign in now. To use our site, please take one of the following actions: Upgrade your version of Internet Explorer.
You can find more information here Install the Google browser. You can find more information here Install the Firefox browser.
No comments:
Post a Comment