Citrix have released Citrix Single Sign-on 5.0. I have been waiting for this release because it have been a while since Citrix have released a new Single Sign-on version (former known as Citrix Password Manager), and many ppl thought it was dead, but its still strong and alive…. =O)
Citrix Single Sign-on (formerly Citrix Password Manager) provides password security and single sign-on access to Windows, Web, and terminal emulator applications running in the Citrix environment as well as applications running on the desktop. Users authenticate once and Single Sign-on does the rest, automatically logging on to password-protected information systems, enforcing password policies, monitoring all password-related events, and even automating user tasks, including password changes.
What’s New
Single Sign-on 5.0 integrates the Single Sign-on Plug-in into Citrix Receiver, simplifies the user experience, enables the Single Sign-on Plug-in to be deployed using Merchandising Server, and includes Simplified Chinese as a supported Single Sign-on Plug-in language.
- Users access the Single Sign-on Plug-in through the Citrix Receiver icon. Instead of seeing one or more Single Sign-on Plug-in icons in the Windows notification area, users see only the Citrix Receiver icon. The Citrix Receiver icon appears only once in the Windows notification area no matter how many Single Sign-on sessions the user has active. Users manage logon information, pause and resume Single Sign-on, determine whether Single Sign-on is paused, and submit passwords manually using menu options accessed through the Citrix Receiver icon.Note: If older versions of the plug-in are installed, additional icons might appear in the Windows notification area. See Installing the Single Sign-on Plug-in for more information.
- The Single Sign-on Plug-in is required on user devices for full functionality. Unless the Single Sign-on Plug-in is installed on the user device, users might not be able to manage logon information, pause and resume Single Sign-on, determine whether Single Sign-on is paused, or submit passwords manually. See Single Sign-on Plug-in Software Deployment Scenarios for more information.
- Users exit the Single Sign-on Plug-in by exiting Citrix Receiver. Users exit Single Sign-on by choosing the Exit option from the Citrix Receiver icon menu. This closes the Citrix Receiver user interface and all plug-ins accessed through it.
- Users manage logon information using the Manage Passwords window. The Logon Manager has been renamed the Manage Passwords window and redesigned to simplify the user experience:
- Users access the Manage Passwords window from a menu option accessed through the Citrix Receiver icon. One Manage Passwords window appears, containing logon information for applications from all the user’s sessions.
- You configure the Manage Passwords window to display columns for one or more of these attributes of stored credentials: name, description, group, time and date last used, time and date last modified. Users can sort on each of these attributes.
- The Manage Passwords window has no drop-down menus. The functionality formerly accessed using the options on these menus in the Logon Manager is accessed differently or has been removed:
| Menu |
Option |
What happens to this functionality in Single Sign-on 5.0? |
| File |
New LogonorNew Logon > Add One Logon |
Users store credentials manually using the Submit option available through the Citrix Receiver icon menu. |
| New Logon > Add Multiple Logons |
Users create multiple sets of credentials for the same application by creating the first set of credentials, copying it, and editing the copy. |
| Copy |
Replaced by the Copy button in the Manage Passwords window. |
| Delete |
Replaced by the Remove button in the Manage Passwords window. |
| Properties |
Replaced by the Edit button in the Manage Passwords window. |
| Exit |
Users exit the Manage Passwords window using the Windows close button. |
| View |
Icon, List, and Detail |
This functionality has been removed to simplify the user experience. |
| Arrange Icons By |
This functionality is not available, but users can sort the columns in the Manage Passwords window by clicking on the column heading. |
| Refresh |
Replaced by the Refresh link in the Manage Passwords window. |
| Reveal Passwords |
Users view one password at a time using the Reveal Password button in the Manage Passwords window. Users cannot reveal more than on password at a time. |
| Tools |
Account Association |
Users cannot enable Account Association using the Single Sign-on Plug-in. To give user the ability to enable account association, give them access to the AccAssoc.exe utility as a published application. |
| Security Question Registration |
Users cannot reregister answers to their security questions using the Single Sign-on Plug-in, unless you prompt them to reregister. To give user the ability to reregister answers to their security questions without being prompted, give them access to the QBAEnroll.exe utility as a published application. |
| Options > Confirm Exit |
Confirmation on exit is controlled through the Citrix Receiver. The Single Sign-on Plug-in does not ask for exit confirmation. |
| Help |
Logon Manager Help |
Replaced by the Help link in the Manage Passwords window. |
| About |
Replaced by the About link in the Manage Passwords window. |
- The Manage Passwords window has no context menu. The functionality formerly accessed using this menu in the Logon Manager is accessed differently:
| Option |
What happens to this functionality in Single Sign-on 5.0? |
| Copy |
Replaced by the Copy button in the Manage Passwords window. |
| Delete |
Replaced by the Remove button in the Manage Passwords window. |
| Properties |
Replaced by the Edit button in the Manage Passwords window. |
- Users cannot be prompted to store credentials the first time they use Single Sign-on. The initial credential setup option has been eliminated.
- The Single Sign-on Plug-in can be deployed and managed using Merchandising Server. If Citrix Receiver Updater is installed on user devices, you can deploy and manage the Single-Sign-on Plug-in with Merchandising Server.
- The Single Sign-on Plug-in can be deployed in Simplified Chinese.
Single Sign-on 5.0 Components
The main components of Single Sign-on are:
- The central store
- The Single Sign-on component of the Citrix AppCenter
- The Single Sign-on Plug-in
- The Single Sign-on Service (optional)
The Central Store
The central store is a centralized repository used by Single Sign-on to store and manage user and administrative data. User data includes user credentials, security question answers, and other user-focused data. Administrative data includes password policies, application definitions, security questions, and other wider-ranging data. When a user signs on, Single Sign-on compares that user’s credentials to those stored in the central store. As the user opens password-protected applications or Web pages, the appropriate credentials are drawn from the central store.
The Single Sign-on Component of the Citrix AppCenter
The Single Sign-on component of the Citrix AppCenter is the command center of Single Sign-on. Here, you configure how Single Sign-on works, which features are deployed, which security measures are used, and other important password-related settings.
The component has four main items, or nodes, in the left pane. By selecting a node, tasks specific to that node appear. These nodes are:
- User Configurations allow you to tailor particular settings for your users based on their geographic locations or business roles.
- Application Definitions provide the required information for the Single Sign-on Plug-in to supply user credentials to applications and to detect error conditions if they occur. Use the application definition templates supplied with Single Sign-on to speed this process or create your own customized definitions for applications that cannot use these templates. Additional templates are located at http://www.citrix.com/passwordmanager/gettingstarted.
- Password Policies control password length and the type and variety of characters used in both user-defined and automatically-generated passwords. Password policies also allow you to identify characters to exclude from use in passwords and whether or not previous passwords can be reused. Creating password policies consistent with your company’s security policies ensures that Single Sign-on can manage password security appropriately.
- Identity Verification enables you to create security questions that provide an added layer of security to the Single Sign-on Plug-in. Security questions protect against user impersonation, unauthorized password changes, and unauthorized account unlocking. Users who enroll and answer your security questions can then verify their identity by providing the same answers when challenged. Once verified, users can perform self-service tasks to their account, such as resetting their primary password or unlocking their user account. Security questions can also be used for key recovery.
The Single Sign-on Plug-in
The Single Sign-on Plug-in submits the appropriate credentials to the applications running on the user’s client device, enforces password policies, provides self-service functionality, and enables users to manage their credentials with the Manage Passwords window (formerly known as Logon Manager). In addition, the plug-in provides users with a wide array of features as determined by the administrative settings you make in the user configurations.
The Single Sign-on Service
The Single Sign-on Service runs on a Web server that provides the foundation for optional features included in this release. Install the Single Sign-on Service if you plan to implement at least one of the following modules:
- Self-Service, which allows users to reset their Windows passwords and unlock their Windows accounts
- Data Integrity, which protects data from being compromised while in transit from the central store to the Single Sign-on Plug-in
- Key Management, which provides users with the capability to recover their secondary credentials when their primary password changes, either with automatic key recovery or after answering security questions with question-based authentication
- Provisioning, which allows you to use the Single Sign-on component of the Citrix AppCenter to add, remove, or update Single Sign-on user data and credential information
- Credential Synchronization, which synchronizes user credentials among domains using a Web service
If you are not implementing the modules mentioned above, do not install the Single Sign-on Service.
Sources
Download Citrix Single Sign-on 5.0
Download Citrix Single Sign-on 5.0 Plug-in
Download Single Sign-on 5.0 Plug-in Prerequisites
