Citrix Cloud

Citrix Cloud Connector Technical Details

The Citrix Cloud Connector is a component with a collection of Windows services installed on Windows Server 2012 R2, Windows Server 2016 or Windows Server 2019.

System requirements

The machines hosting the Cloud Connector must meet the following requirements. Citrix strongly recommends installing at least two Cloud Connectors in each resource location to ensure high availability.

Operating systems

The following operating systems are supported:

  • Windows Server 2019
  • Windows Server 2016
  • Windows Server 2012 R2

The Cloud Connector is not supported for use with Windows Server Core.

.NET requirements

Microsoft .NET Framework 4.7.2 or later is required.

Server requirements

If you’re using Cloud Connectors with the Virtual Apps and Desktops service, refer to Scale and size considerations for Cloud Connectors for machine configuration guidance.

The following requirements apply to all machines where the Cloud Connector is installed:

  • Use dedicated machines for hosting the Cloud Connector. Do not install any other components on these machines.
  • The machines are not configured as Active Directory domain controllers. Installing the Cloud Connector on a domain controller is not supported.
  • Server clock is set to the correct UTC time.
  • Internet Explorer Enhanced Security Configuration (IE ESC) is turned off. If this setting is turned on, the Cloud Connector might not be able to establish connectivity with Citrix Cloud.
  • Citrix strongly recommends enabling Windows Update on all machines hosting the Cloud Connector. When configuring Windows Update, automatically download and install updates, but do not allow automatic restarts. The Citrix Cloud platform handles machine restarts, allowing them for only one Cloud Connector at a time when needed. Alternatively, you can control when the machine is restarted after an update using Group Policy. For more information, see https://docs.microsoft.com/en-us/windows/deployment/update/waas-restart.

Certificate validation requirements

Cloud Connector binaries and endpoints that the Cloud Connector contacts are protected by X.509 certificates issued by widely respected enterprise certificate authorities (CAs). Certificate verification in Public Key Infrastructure (PKI) includes the Certificate Revocation List (CRL). When a client receives a certificate, the client checks whether it trusts the CA that issued the certificates and whether the certificate is on a CRL. If the certificate is on a CRL, the certificate is revoked and should not be trusted, even though it appears valid.

The CRL servers use HTTP on port 80 instead of HTTPS on port 443. Cloud Connector components, themselves, do not communicate over external port 80. The need for external port 80 is a byproduct of the certificate verification process that the operating system performs.

The X.509 certificates are verified during the Cloud Connector installation. So, all Cloud Connector machines must be configured to trust these certificates to ensure the Cloud Connector software can be installed successfully.

Citrix Cloud endpoints are protected by certificates issued by DigiCert or by one of the Root Certificate Authorities used by Azure. For more information on the Root CAs used by Azure, see https://docs.microsoft.com/en-us/azure/security/fundamentals/tls-certificate-changes

To validate the certificates, each Cloud Connector machine must meet the following requirements:

  • HTTP port 80 is open to the following addresses. This port is used during Cloud Connector installation and during the periodic CRL checks. For more information about how to test for CRL and OCSP connectivity, see https://www.digicert.com/kb/util/utility-test-ocsp-and-crl-access-from-a-server.htm on the DigiCert web site.
    • http://crl3.digicert.com
    • http://crl4.digicert.com
    • http://ocsp.digicert.com
    • http://www.d-trust.net
    • http://root-c3-ca2-2009.ocsp.d-trust.net
    • http://crl.microsoft.com
    • http://oneocsp.microsoft.com
    • http://ocsp.msocsp.com
  • Communication with the following addresses is enabled:
    • https://*.digicert.com
  • The following certificates are installed:
    • https://dl.cacerts.digicert.com/DigiCertAssuredIDRootCA.crt
    • https://dl.cacerts.digicert.com/DigiCertSHA2AssuredIDCodeSigningCA.crt
    • https://cacerts.digicert.com/DigiCertGlobalRootG2.crt
    • https://cacerts.digicert.com/DigiCertGlobalRootCA.crt
    • https://cacerts.digicert.com/BaltimoreCyberTrustRoot.crt
    • https://www.d-trust.net/cgi-bin/D-TRUST_Root_Class_3_CA_2_2009.crt
    • https://www.microsoft.com/pkiops/certs/Microsoft%20RSA%20Root%20Certificate%20Authority%202017.crt
    • https://www.microsoft.com/pkiops/certs/Microsoft%20EV%20ECC%20Root%20Certificate%20Authority%202017.crt

For complete instructions for downloading and installing the certificates, see CTX223828.

Active Directory requirements

  • Joined to an Active Directory domain that contains the resources and users that you will use to create offerings for your users. For multi-domain environments, see Deployment scenarios for Cloud Connectors in Active Directory in this article.
  • Each Active Directory forest you plan to use with Citrix Cloud should be reachable by two Cloud Connectors at all times.
  • The Cloud Connector must be able to reach both the parent (root) and domain controllers in the Active Directory infrastructure (to complete the Active Directory workflows) where the Cloud Connector is installed. For more information, see the following Microsoft support articles:

Network requirements

Supported Active Directory functional levels

The Citrix Cloud Connector supports the following forest and domain functional levels in Active Directory.

Forest Functional Level Domain Functional Level Supported Domain Controllers
Windows Server 2008 R2 Windows Server 2008 R2 Windows Server 2008 R2, Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
Windows Server 2008 R2 Windows Server 2012 Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
Windows Server 2008 R2 Windows Server 2012 R2 Windows Server 2012 R2, Windows Server 2016
Windows Server 2008 R2 Windows Server 2016 Windows Server 2016
Windows Server 2012 Windows Server 2012 Windows Server 2012, Windows Server 2012 R2, Windows Server 2016
Windows Server 2012 Windows Server 2012 R2 Windows Server 2012 R2, Windows Server 2016
Windows Server 2012 Windows Server 2016 Windows Server 2016
Windows Server 2012 R2 Windows Server 2012 R2 Windows Server 2012 R2, Windows Server 2016
Windows Server 2012 R2 Windows Server 2016 Windows Server 2016
Windows Server 2016 Windows Server 2016 Windows Server 2016

Federal Information Processing Standard (FIPS) support

The Cloud Connector currently supports the FIPS-validated cryptographic algorithms that are used on FIPS-enabled machines. Only the latest version of the Cloud Connector software available in Citrix Cloud includes this support. If you have existing Cloud Connector machines in your environment (installed before November 2018) and you want to enable FIPS mode on these machines, perform the following actions:

  1. Uninstall the Cloud Connector software on each machine in your resource location.
  2. Enable FIPS mode on each machine.
  3. Install the latest version of the Cloud Connector on each FIPS-enabled machine.

Important:

  • Do not attempt to upgrade existing Cloud Connector installations to the latest version. Always uninstall the old Cloud Connector first and then install the newer one.
  • Do not enable FIPS mode on a machine hosting an older Cloud Connector version. Cloud Connectors older than Version 5.102 do not support FIPS mode. Enabling FIPS mode on a machine with an older Cloud Connector installed prevents Citrix Cloud from performing regular maintenance updates for the Cloud Connector.

For instructions to download the latest version of the Cloud Connector, see Where to obtain the Cloud Connector.

Cloud Connector installed services

This section describes the services that are installed with the Cloud Connector and their system privileges.

During installation, the Citrix Cloud Connector executable installs and sets the necessary service configuration to the default settings required to function. If the default configuration is manually altered, the Cloud Connector might not perform as expected. In this case, the configuration resets to the default state when the next Cloud Connector update occurs, assuming the services that handle the update process can still function.

Citrix Cloud Agent System facilitates all elevated calls necessary for the other Cloud Connector services to function and does not communicate on the network directly. When a service on the Cloud Connector needs to perform an action requiring Local System permissions, it does so through a predefined set of operations that the Citrix Cloud Agent System can perform.

Service Name Description Runs As
Citrix Cloud Agent System Handles the system calls necessary for the on-premises agents. Includes installation, reboots, and registry access. Can only be called by Citrix Cloud Services Agent WatchDog. Local System
Citrix Cloud Services Agent WatchDog Monitors and upgrades the on-premises agents (evergreen). Network Service
Citrix Cloud Services Agent Logger Provides a support logging framework for the Citrix Cloud Connector services. Network Service
Citrix Cloud Services AD Provider Enables Citrix Cloud to facilitate management of resources associated with the Active Directory domain accounts in which it is installed. Network Service
Citrix Cloud Services Agent Discovery Enables Citrix Cloud to facilitate management of XenApp and XenDesktop legacy on-premises Citrix products. Network Service
Citrix Cloud Services Credential Provider Handles storage and retrieval of encrypted data. Network Service
Citrix Cloud Services WebRelay Provider Enables HTTP Requests received from WebRelay Cloud service to be forwarded to On-Premises Web Servers. Network Service
Citrix CDF Capture Service Captures CDF traces from all configured products and components. Network Service
Citrix Config Synchronizer Service Copies brokering configuration locally for high availability mode. Network Service
Citrix High Availability Service Provides continuity of service during outage of central site. Network Service
Citrix ITSM Adapter Provider Automates provisioning and management of virtual apps and desktops. Network Service
Citrix NetScaler Cloud Gateway Provides Internet connectivity to on-premises desktops and applications without the need to open in-bound firewall rules or deploying components in the DMZ. Network Service
Citrix Remote Broker Provider Enables communication to a remote Broker service from local VDAs and StoreFront servers. Network Service
Citrix Remote HCL Server Proxies communications between the Delivery Controller and the Hypervisor(s). Network Service
Citrix Session Manager Proxy Manages anonymous pre-launched sessions, and uploads session count information to the cloud based Session Manager service. Network Service
Citrix WEM Cloud Authentication Service Provides authentication service for Citrix WEM agents to connect to cloud infrastructure servers. Network Service
Citrix WEM Cloud Messaging Service Provides service for Citrix WEM cloud service to receive messages from cloud infrastructure servers. Network Service

Deployment scenarios for Cloud Connectors in Active Directory

If you have a single domain in a single forest, installing Cloud Connectors in that domain is all you need to establish a resource location. If you have multiple domains in your environment, you must consider where to install the Cloud Connectors so your users can access the resources you make available.

Note:

The below resource locations form a blueprint that may need to be repeated in other physical locations depending on where your resources are hosted.

Single domain in a single forest with a single set of Cloud Connectors

In this scenario, a single domain contains all the resource and user objects (forest1.local). One set of Cloud Connectors is deployed within a single resource location and joined to the forest1.local domain.

  • Trust relationship: None - single domain
  • Domains listed in Identity and Access Management: forest1.local
  • User logons to Citrix Workspace: Supported for all users
  • User logons to an on-premises StoreFront: Supported for all users

Parent and child domains in a single forest with a single set of Cloud Connectors

In this scenario, a parent domain (forest1.local) and its child domain (user.forest1.local) reside within a single forest. The parent domain acts as the resource domain and the child domain is the user domain. One set of Cloud Connectors is deployed within a single resource location and joined to the forest1.local domain.

  • Trust relationship: Parent/child domain trust
  • Domains listed in Identity and Access Management: forest1.local, user.forest1.local
  • User logons to Citrix Workspace: Supported for all users
  • User logons to an on-premises StoreFront: Supported for all users

Note:

You might need to restart the Cloud Connectors to ensure Citrix Cloud registers the child domain.

Users and resources in separate forests (with trust) with a single set of Cloud Connectors

In this scenario, one forest (forest1.local) contains your resource domain and one forest (forest2.local) contains your user domain. A trust exists between these forests that allows users to log on to resources. One set of Cloud Connectors is deployed in a single resource location and joined to the forest1.local domain.

  • Trust relationship: Forest trust
  • Domains listed in Identity and Access Management: forest1.local
  • User logons to Citrix Workspace: Supported for forest1.local users only
  • User logons to an on-premises StoreFront: Supported for all users

Note:

The trust relationship between the two forests needs to permit the user in the user forest to be able to log on to machines in the resource forest.

Because Cloud Connectors can’t traverse forest-level trusts, the forest2.local domain is not displayed on the Identity and Access Management page in the Citrix Cloud console. This carries the following limitations:

  • Resources can only be published to users and groups located in forest1.local in Citrix Cloud. However, forest2.local users may be nested into forest1.local security groups to mitigate this issue.
  • Citrix Workspace cannot authenticate users from the forest2.local domain.

To work around these limitations, deploy the Cloud Connectors as described in Users and resources in separate forests (with trust) with a set of Cloud Connectors in each forest.

Users and resources in separate forests (with trust) with a set of Cloud Connectors in each forest

In this scenario, one forest (forest1.local) contains your resource domain and one forest (forest2.local) contains your user domain. A trust exists between these forests that allows users to log on to resources. One set of Cloud Connectors is deployed within the forest1.local domain and a second set is deployed within the forest2.local domain.

  • Trust relationship: Forest trust
  • Domains listed in Identity and Access Management: forest1.local, forest2.local
  • User logons to Citrix Workspace: Supported for all users
  • User logons to an on-premises StoreFront: Supported for all users

View the health of the Cloud Connector

The Resource Locations page in Citrix Cloud displays the health status of all the Cloud Connectors in your resource locations.

Event messages

Event messages are available in the Windows Event viewer on the Cloud Connector machine. The Windows event logs that the Cloud Connector generates are in the following documents:

Event logs

By default, event logs are located in the C:\ProgramData\Citrix\WorkspaceCloud\Logs directory of the machine hosting the Cloud Connector.

Troubleshooting

The first step in diagnosing any issues with the Cloud Connector is to check the event messages and event logs. If you don’t see the Cloud Connector listed in your resource location or is “not in contact,” the event logs will provide some initial information.

Cloud Connector connectivity

If the Cloud Connector is “disconnected,” the Cloud Connector Connectivity Check Utility can help you verify the Cloud Connector can reach Citrix Cloud and its related services.

The Cloud Connector Connectivity Check Utility runs on the machine hosting the Cloud Connector. If you use a proxy server in your environment, the utility can help you verify connectivity through your proxy server by tunneling all connectivity checks. If needed, the utility can also add any missing Citrix trusted sites to the Trusted Sites zone in Internet Explorer.

For more information about downloading and using this utility, see CTX260337 in the Citrix Support Knowledge Center.

Installation

If the Cloud Connector is in an “error” state, there might be a problem hosting the Cloud Connector. Install the Cloud Connector on a new machine. If the issue persists, contact Citrix Support. To troubleshoot common issues with installing or using the Cloud Connector, see CTX221535.

Citrix Cloud Connector Technical Details