GoToMeeting, GoToWebinar & GoToTraining. Active Directory Connector Administration Guide Hollister Avenue Goleta CA 93117

(1)

7414 Hollister Avenue • Goleta CA 93117 http://support.citrixonline.com

GoToMeeting, GoToWebinar & GoToTraining

Active Directory Connector Administration Guide

(2)

Get Started with the Active Directory Connector

The Citrix Active Directory Connector (ADC) solution allows company administrators to provision/de-provision GoToMeeting, GoToWebinar and GoToTraining seats from the Active Directory domain controller.

Introduction

The Active Directory is the primary system for configuring users and groups. The Citrix Active Directory Connector is a separate system that admins can use to do the following:

• Add and remove users to provisioning groups • Delete existing users from provisioning groups • Rename provisioned users

• Enable, disable and delete provisioned users (organizers) • Write logs to both files and the Windows Event Viewer

After making changes in the Active Directory Connector, the changes will automatically sync with Citrix’s platform and be reflected in the Corporate Admin Center. However, making changes to users directly in the Corporate Admin Center is not recommended since the changes will not sync with the Active Directory Connector.

The Active Directory Connector currently does not support the following: • Authentication and SAML

(5)

System & Configuration Requirements

• Active Directory Forrest with functionality level “Windows Server 2003” • AD Connector requirements:

• Windows Server 2008 R2 (not necessarily a domain controller) • Memory: 2GB RAM or greater recommended

• Available disk space: Minimum 200MB, depending on log level and storage period • Display: Minimum 1024 x 768

• SMTP(S) server for sending status information

• SMTP service account (user/password) for sending emails, only if it's necessary for your SMTP server.

• SSL certificate

• Optional to connect to the SMTP server securely. • Optional to connect to the Domain Controller securely. • Active Directory service account

• User/password for reading access in the AD. Password may not expire. • Active Directory product groups

• Users that are members of an AD product group will be provisioned to use the specified “GoTo” product. You may use the same group name as many times as you'd like. You can add groups with names of your choice for the following product(s):

• GoToMeeting

• GoToWebinar with GoToMeeting • GoToTraining with GoToMeeting • GoToMeeting corporate admin account • Citrix Online API Key

• Used by ADC to communicate with the GoToMeeting, GoToWebinar and GoToTraining servers.

• Register via https://developer.citrixonline.com with the email address you use to administrate your GoToMeeting corporate account and click Apply for Developer Key. (Note: you will receive an email response containing an alpha-numeric Citrix Online API key).

Enter the following data in the registration form: • Application Name: AD Connector • Description: AD Connector • Product API: GoToMeeting

• Application URL: <your company's home page>

• The Citrix Online API key has to be set to "production level" to be able to handle a large number of requests. After registering, please email the API key to developer-support@citrixonline.com and request your profile be changed to “production level”.

(6)

• Firewall Settings

<source server>

<target server>:<port>

<ADC Server Name> api.citrixonline.com:443 (interface for provisioning)

<ADC Server Name> Active Directory Domain Controller:389 (LDAP) (for insecure connections)

<ADC Server Name> Active Directory Domain Controller:636 (LDAPS) (for secure connections)

<ADC Server Name> SMTP server:25 (optional – useful if sending Windows Event logs via email) (for insecure connections or secure connections via STARTTLS)

<ADC Server Name> SMTP server:465 (optional – useful if sending Windows Event logs via email) (for secure connections)

(7)

Install the Active Directory Connector

To set up and register the Active Directory Connector service, you'll need to run the "Active Directory Connector Installer.exe". The InstallShield Wizard will help you modify, repair or remove the Active Directory Connector.

Requirements

• Windows Server 2008 R2

• .NET Framework 4.5 full setup (the installer will download it if required) See the full system and configuration requirements.

Set up & install the Active Directory Connector for the first time

1. Click the Citrix Active Directory Connector Setup file to begin the installation process.

2. Run the "Citrix Active Directory Connector Setup.exe" file. The installer will set up the installation and try to automatically close the application if it's running.

(8)

4. Click Next to install the application to the specified folder, or click Change to browse for a different folder location. Then click Install > Finish to exit the wizard and complete the installation. A desktop shortcut called "Launch ADCAdminUI" will appear, which you can use to launch the Active Directory Connector Administration.You'll need to start the Active Directory Connector service and configure your account.

(9)

Update to a newer version of the Active Directory Connector

1. Run the most recent version of the Citrix Active Directory Connector Setup to begin the installation process.

2. When prompted to perform an upgrade, click Yes.

3. When the installer launches, click Next > Finish to complete the upgrade. The upgrade process preserves the existing configuration file, so the next time you open the Active Directory Connector Administration, you'll be running the latest version and won't need to reconfigure your account (but you'll need to restart the Active Directory Connector service).

(10)

Uninstall the Active Directory Connector

1. Open the Active Directory Connector installer.

2. Click Remove to uninstall the Active Directory Connector from your computer. If you want to remove the configuration files, select the "Remove configuration from harddisk".

(11)

FAQs

Do I need to keep logging in to the AD Connector Administration console? No, you shouldn't need to keep logging in to the console.

Can I use the AD Connector to create groups?

No, you can't create groups from the Active Directory Connector. However, you can assign, edit and delete groups by browsing for groups in the Active Directory or by entering the Active Directory group SID.

If I create groups in the Corporate Admin Center, what happens to the AD Connector?

If you create groups in the GoToMeeting, GoToWebinar and GoToTraining Corporate Admin Center via http://admin.citrixonline.com, it will neither affect nor change the Active Directory Connector

Administration.

Can I delete or suspend the administrator on the account?

No, you cannot delete or suspend the administrator. The administrator is the person who's been added on the Citrix collaboration account via the Connections tab.

If my system crashes, will the AD Connector service automatically restart, or will I need to manually start it?

You will need to manually restart the service by launching the Active Directory Connector Administration, navigating to the Operation tab and clicking Start.

Are .pac files supported?

(12)

Which AD attributes are used to access the Active Directory?

Attributes are used to collect info about groups or members. The following table represents required group and user attributes.

Required Group Attributes

Required User Attributes

distinguishedName distinguishedName member objectSid objectSid uSNChanged uSNChanged mail name userAccountControl sAMAccountName sn givenName accountExpires

(13)

Configure Your Account

To begin using the Active Directory Connector, you must complete all of the following steps: • Connect the Active Directory and Citrix account

• Provisioning Groups

• Provisioning Options

Connect the Active Directory and Citrix account

For full details, see the System & Configuration Requirements. 1. Open the Active Directory Connector Administration.

2. Select the Connections tab. In the Active Directory section, enter the following information from the Active Directory:

• URL of domain controller (fully qualified domain name without preceding protocol – e.g., LDAP:\\) • LDAP Port 389 or 636

• Username • Password

3. In the "Citrix collaboration account" section, enter the email address and password you use to log in to GoToMeeting, GoToWebinar and/or GoToTraining. You will be considered the administrator on the account and cannot be deleted.

4. Then enter the API key you use with the Citrix GoTo Developer Center. If you don't have an API key, register and apply for one to access the GoToMeeting, GoToWebinar and GoToTraining APIs. 5. In the API URL field, enter https://api.citrixonline.com.

6. If you want to use proxy settings (optional), select the "Use proxy settings" check box and fill out the proxy fields below.

7. Click Apply changes. You will need to restart the service from the Operations tab to begin using the Active Directory Connector.

(14)

Provisioning options

Provisioning options define how the Active Directory Connector handles actions on your Citrix account after you make changes in the Active Directory.

For example, if an Active Directory user is a member of more than 1 Active Directory provisioning group and is already provisioned in the GoToMeeting, GoToWebinar and GoToTraining Admin Center, removing all of the user's memberships will then result in the Active Directory Connector removing all related products on the GoToMeeting, GoToWebinar and GoToTraining Admin Center.

1. Open the Active Directory Connector Administration.

2. Select the Provisioning tab. In the Options section, you'll see the following provisioning options: • Delete Citrix account of deprovisioned users

• Yes, delete account and data (the deprovisioned user will be deleted and the user's data will not be saved)

• No, suspend account only (the Active Directory Connector will suspend a user without deleting the user's information)

• Activate event logging for reporting (enables logging events on the local server) • Modify email address before provisioning - Add prefix

• Modify email addresses before provisioning - Add suffix

• Modify email addresses before provisioning - Replace domain name

You can modify the email addresses new organizers use when logging in to GoToMeeting, GoToWebinar and GoToTraining. You can create unique usernames for each product by adding prefixes or suffixes and even replacing the domain name (e.g.,

john.doe@citrixsystems.com).

For example, if you're a system admin performing some testing, you may not want users to receive invitation emails, so you can create unique "wildcard" email addresses to filter emails and prevent spamming actual users.

(15)

Provisioning groups

To start provisioning groups, you can either browse for Active Directory group names or manually enter the Active Directory group SID.

Create a new assignment

2. Select the Provisioning tab. Then click Create assignment. You can assign as many groups as you'd like.

3. In the window, you can click Browse next to the "Active Directory group name" field to search for and select a group from the Active Directory. Or, you can manually enter the Active Directory group SID.

4. Once you've selected a group, click Select. The Active Directory group SID should automatically populate on-screen.

5. Choose which Citrix product(s) to provision to the group: • GoToMeeting

• GoToTraining with GoToMeeting • GoToWebinar with GoToMeeting

6. Click OK. Your new assignment will appear in the "Active Directory groups with assigned products" table.

7. Lastly, click Apply changes. You'll need to restart the service from the Operations tab for the changes to apply.

(16)

Edit an assignment

1. In the Provisioning tab, select the group you want to modify and click Edit assignment. 2. You can modify the group name, group SID or Citrix product.

3. When you're done, click OK.

4. Then click Apply changes. You'll need to restart the service from the Operations tab for the changes to apply.

Delete an assignment

1. In the Provisioning tab, select the group you want to delete and click Delete assignment. The group will immediately disappear from the "Active Directory groups with assigned products" table. 2. Click Apply changes. You'll need to restart the service from the Operations tab for the

changes to apply.

3. When you're finished, you'll need to deactivate edit mode. Edit mode is initially active after the very first start of the service, so that you can provision users automatically.

(17)

Manage Users in the Active Directory

Changes you make in the Active Directory will automatically get updated in the Active Directory

Connector Administration. The time it takes for updates to appear depends on the specified polling time (the default is set to 15 seconds). Currently, "Security" and "Distribution" group types are supported with either "Global" or "Universal" scope. At this time, there isn't support for nested AD groups or multiple AD domains.

Assign GoToMeeting, GoToWebinar & GoToTraining

1. Open the Active Directory and navigate to your users.

2. Right-click a user and select Properties from the drop-down menu.

3. Select the Member Of tab and choose a group to assign that user with GoToMeeting, GoToWebinar and/or GoToTraining.

4. Click Add or Remove and then click OK. The changes will soon appear in the Active Directory Connector Administration.

(18)

Suspend, Delete & Assign Products to Users

You can suspend, delete and assign products to provisioned users. By default, you'll need to active edit mode before you can make any changes. After 15 minutes of inactivity, it will automatically switch back to deactivate edit mode, and any unsaved changes will be lost. If you deactivate edit mode before applying changes, unsaved changes will also be lost.

Administrators cannot be suspended or deleted (the administrator is the person who's been added on the Citrix collaboration account via the Connections tab).

Suspend a user

2. Select the Users tab. Click the Activate edit mode button and wait until you see "Edit mode: Active" in the bottom-right corner.

3. Choose a user from the "Unmatched Citrix users" table. You can also choose multiple users at once by pressing Ctrl + click, Shift + click or Ctrl + A.

4. Right-click the selected user(s) and select Suspend user from the drop-down menu. The user's provisioning status will change to "Pending: Suspend user".

5. Click Apply changes. You'll see a "Provisioning successful" message once the suspension is complete. In the Unmatched Citrix users table, the user's account status will change to "suspended". When you're finished editing, click Deactivate edit mode.

(19)

Delete a user

1. On the Users tab, click the Activate edit mode button and wait until you see "Edit mode: Active" in the bottom-right corner.

3. Right-click the selected user(s) and select Delete user from the drop-down menu. 4. When prompted to delete the user, click Yes.

5. Click Apply changes. When you're finished editing, click Deactivate edit mode.

(20)

Assign products

1. On the Users tab, click the Activate edit mode button and wait until you see "Edit mode: Active" in the bottom-right corner. select a user from the "Unmatched Citrix users" table.

3. Right-click the selected user(s) and select Assign products from the drop-down menu. If you've selected multiple users who have a combination of different products, all those products will

appear selected by default.

4. Choose a product or products and click Save. The user's "Provisioning status" will change to "Pending: Assign products".

5. Click Apply changes. You'll see a "Provisioning successful" message once the suspension is complete. In the "Unmatched Citrix users" table, the user's account status will change to "active". When you're finished editing, click Deactivate edit mode.

(21)

Manage Provisioned Users

The preferred way of provisioning users is to first create users and groups in the Active Directory, install the Active Directory Connector Administration and then add those users to groups.

There are 2 use cases for provisioning users:

• You've already created existing user accounts and you need to match those users • You've just completed a clean installation and created the administrator role from your

GoToMeeting, GoToWebinar and/or GoToTraining corporate account without having set up any organizers

Match existing users

1. To provision multiple Active Directory users, navigate to the Users tab. Click the Activate edit mode button and wait until you see "Edit mode: Active" in the bottom-right corner.

2. Review the users listed in the "Unmatched Active Directory users" table.

• To provision all the unmatched users listed in the table, click Provision all unmatched users. • To provision specific unmatched users listed in the table, you can choose individual users at once

by pressing Ctrl + click, Shift + click to select specific users. Then right-click the selected users and click Provision user.

The "Unmatched Citrix users" table and the "Matched users" table will display those users' provision status as pending. If users aren't automatically matched, click Automatic matching to check that users' email addresses match.

3. Click Apply changes. If you'd like to reverse the matching, click Revoke selected user matchings.

(22)

Manage unmatched Citrix users

You can suspend, delete and assign products to users from the Active Directory Connector.

1. In the Active Directory Connector Administration, navigate to the Users tab. Click the Activate edit mode button and wait until you see "Edit mode: Active" in the bottom-right corner.

2. Select the unmatched user's name from the "Unmatched Active Directory users" table so that it becomes highlighted. Then select the corresponding unmatched user's name from the "Unmatched Citrix users" table.

3. Click Match selected.

4. In the "Matched users" table, the user you attempted to match will appear and the "Provisioning status" field will show the user's state (pending match).

5. Click Apply changes. If the match is complete, you will see a "Provisioning successful" alert in the bottom-right corner, and the "Provisioning status" field will be cleared.

(23)

Application Logging

The Active Directory Connector's application logging lets you review errors or retrieve summaries in the Windows Event Viewer. From the Operations tab, you can also set the Active Directory polling time (in seconds) to set the time it takes to receive updates. The default polling time is set to 15 seconds – the maximum value is 30,000 seconds and the minimum value is 0.

Set up logging in the Active Directory Connector

2. Select the Operation tab. In the More configuration section, you can change the Windows event logger, file logger and the log file location.

(24)

Locate & filter ADC log files in the Windows Event Viewer

1. Click the Windows Start button > All Programs > Administrative Tools > Event Viewer. 2. In the left navigation, select Applications and Services Logs to expand the folder. 3. Then select Citrix AD Connector to see only Active Directory Connector logs.

(25)

Configure Email Notifications

You can set up email notifications for error messages and status messages for Active Directory Connector events.

Set up email notifications for error messages

1. In the Windows Event Viewer, identify the message for which you'd like to receive email notifications.

2. Right-click the message and select the "Attach Task To This Event" option from the drop-down menu.

3. On the Create a Basic Task wizard, name your task and click Next. On the next step, click Next again.

(26)

(27)

5. Then fill out the "From", "To", Subject", "Text", "Attachment" and "SMTP server" fields and click Next.

6. When you're done, click Finish to save your task.

7. To customize the scheduled job in the Windows Task Scheduler, click the Windows Start button > All Programs > Administrative Tools > Task Scheduler.

8. Expand the Task Scheduler Library folder in the left navigation and select Event Viewer Tasks. 9. Choose the scheduled job and select the "Run with highest privileges" option from the General tab.

10. Configure the trigger by selecting the Triggers tab and then clicking Properties in the right sidebar. You must add a delay of 2 minutes. Otherwise, new events that arrive will trigger another action before the actual action is completed.

(28)

11. Click OK to save your changes.

12. In the Actions tab of the scheduled job, review the actions that will occur when your task starts and edit, add or delete as needed.

(29)

13. Gather all the error events from the past 2 minute and save it in c:\temp\error_status.txt. The "send email task" will retrieve it and attach it to the email. Complete the following commands:

Task

Command

Stop task

schtasks /Change /TN "Event Viewer Tasks\ADCSLog_Error" /DISABLE

Get error

del %temp%\error_status.txt wevtutil qe ADCSLog

/q:"*[System[Provider[@Name='AD Conn'] and (Level=2) and TimeCreated[timediff(@SystemTime) <= 120000]]]" /f:text /rd:true > C:\temp\error_status.txt

(30)

Enable task

schtasks /Change /TN "Event Viewer Tasks\ADCSLog_Error" /ENABLE

For more information about troubleshooting error messages, see Examples of Error Statuses.

Set up email notifications for daily status messages

1. Open the Task Scheduler, expand the Task Scheduler Library folder in the left navigation and select Event Viewer Tasks.

(31)

2. In the right sidebar, click Create Basic Task. Use the Create Basic Task Wizard to complete the following steps:

• Name the task

• Assign when you want the task to trigger/start • Set an action (i.e., send an e-mail)

• Define the email template 3. When you're done, click Finish.

4. After creating the scheduled task, you can customize the scheduled job in the Task Scheduler by first choosing the task you just created.

5. In the General tab, make sure the option to "Run with highest privileges" is enabled. 6. In the Actions tab, create a new action by selecting New > Start a program > OK.

(32)

7. Then run the following command:

Task

Command

Filter event log and write file

del %temp%\daily_status.txt wevtutil qe ADCSLog /q:"*[System[Provider[@Name='AD Conn'] and

TimeCreated[timediff(@SystemTime) <= 86400000]]]" /f:text /rd:true > C:\temp\daily_status.txt

To see examples of daily email status outputs, which will be attached to emails, see Example of Daily Status Message.

(33)

Examples of Error Statuses

The following events represent examples of error messages and what they mean if they're reported in the Active Directory Connector.

Event[0]:

Log Name: ADCSLog Source: AD Conn Date: 2013-02-28T16:11:59.000 Event ID: 0 Task: N/A Level: Error Opcode: Info Keyword: Classic User: N/A

User Name: N/A

Computer: de-pc-dev-018.ad.corp.expertcity.com

Description:

2013-02-28 16:11:59,502 [WorkOrderThread] ERROR - Writing OSD data: Organizer ADConnEG2T@trash-mail.com was not created

Event[1]:

Log Name: ADCSLog Source: AD Conn Date: 2013-02-28T16:11:59.000 Event ID: 0 Task: N/A Level: Error Opcode: Info Keyword: Classic User: N/A

(34)

User Name: N/A

Description:

2013-02-28 16:11:59,499 [WorkOrderThread] ERROR - Writing OSD data: Server response exeption: {

"StatusCode": "409",

"StatusCodeAsString": "Conflict",

"Response": "The remote server returned an error: (409) Conflict." }

Event[2]:

Log Name: ADCSLog

Source: AD Conn Date: 2013-02-28T16:11:58.000 Event ID: 0 Task: N/A Level: Error Opcode: Info Keyword: Classic User: N/A

User Name: N/A

Computer: de-pc-dev-018.ad.corp.expertcity.com Description:

(35)

Event ID: 0 Task: N/A Level: Error Opcode: Info Keyword: Classic User: N/A

User Name: N/A

Description:

"Response": "The remote server returned an error: (409) Conflict."

}

Event[4]:

Log Name: ADCSLog

User Name: N/A

(36)

2013-02-28 16:11:56,966 [WorkOrderThread] ERROR - Writing OSD data: Organizer ADConn2.User2@trash-mail.com was not created

Event[5]:

Log Name: ADCSLog

User Name: N/A

Computer: de-pc-dev-018.ad.corp.expertcity.com Description:

"Response": "The remote server returned an error: (409) Conflict."

(37)

Example of Daily Status Message

The following represents an example of a daily status output that will be attached to the email notification you receive for daily status messages.

2013-03-20 09:35:19,448 | Organizer enes-0000xuffix@jedix.com was created with G2T

2013-03-20 09:35:18,077 | Status changed to suspended for user with organizerkey enes-0005xuffix@jedix.com

2013-03-20 09:35:15,152 | Organizer enes-0010xuffix@jedix.com was created with G2W

2013-03-20 09:35:03,941 | Organizer enes-0019xuffix@jedix.com was created with G2M

(38)

2013-03-20 09:34:47,801 | Status changed to suspended for user with organizerkey enes-0038xuffix@jedix.com

--- 26 user created successfully

GoToMeeting, GoToWebinar & GoToTraining. Active Directory Connector Administration Guide Hollister Avenue Goleta CA 93117