Author Topic: AGEE - Not a privileged user - issues migrating from Secure Gateway  (Read 1955 times)

Offline esmythe

  • Contributor
  • *
  • Posts: 2
  • Karma: 0
Hi,

My goal is to replace Secure Gateway with Netscaler AGEE. I can appreciate the power of Netscaler, but I'm bit surprised I cannot find the documentation to deploy my relatively simple needs.

I've setup a new XenApp 6 farm for purposes and a new XenApp 6 WI.  I used the Citrix AGEE ICA Proxy document to get me most of the way on the AG setup. One thing it didn't have is LDAP policy, but that is now working.

The ICA Proxy document had me create a Session policy that is a request had an http header of CitrixReceiver, to use a Receiver profile, which directed to WI landing page.  I realized that this wasn't triggering when browsing to NS public IP by browser.

I added an additional policy with an expression of ns_true to do the same thing.  Now, after authenticating through NS/AG, I'm taken to a url that should be the WI home page, but the screen simply says "Not a privileged user" with a white background.

Some other curious questions I have:  Are all users visiting the NS/AG url going to need to download the Secure Gateway plugin?  A separate plugin was not needed for Secure Gateway.  When I downloaded the Secure Gateway plugin and installed it, it appeared to be basically a SSL-VPN client and when going 'Home' it directed me to a SSL-VPN web portal.  I do not want SSL-VPN for ANY user (save admins).  How can I disable this?  (Note that I witnessed this function before I put the ns_true policy in place.)

Thanks for any guidance or links to documentation appropriate to this.

 -e

Offline evildani

  • Administrator
  • Hero Member
  • *****
  • Posts: 378
  • Karma: 22

AGEE can be a SSL-VPN or a ICA proxy through the same VIP. But both are different configurations and are mutually exclusive. AGE will know what profile will be applied to the user based on either the LDAP user/group or the session policy. Once he knows what to do with you he will act accordingly applying the profiles based on the policies and how the were evaluated.
Either you set up a VPN or you do ICA proxy.
If you create a AGEE VIP via the normal wizard you set up a VPN.
If you fallow the Proxy Guide you set up a ICA Proxy.

How is your WI configured? How do you handle auth in the WI?

The real question is what are you trying to do?

« Last Edit: August 03, 2010, 08:28:16 AM by evildani »

Offline esmythe

  • Contributor
  • *
  • Posts: 2
  • Karma: 0
Thanks... I got it straight.  My confusion lay in the fact that I wasn't identifying VPN with 'clientless access'.  Found CTX120164 and put me on the right path.

Love the platform, look forward to implementing other features of it.

 -e