Citrix Password Manager Administrator s Guide. Citrix Password Manager 4.6 Citrix Presentation Server 4.5 with Feature Pack 1, Platinum Edition

Transcription

1 Citrix Password Manager Administrator s Guide Citrix Password Manager 4.6 Citrix Presentation Server 4.5 with Feature Pack 1, Platinum Edition

2 Copyright and Trademark Notice Use of the product documented in this guide is subject to your prior acceptance of the End User License Agreement. A printable copy of the End User License Agreement is included on your product CD-ROM. Information in this document is subject to change without notice. Companies, names, and data used in examples herein are fictitious unless otherwise noted. No part of this document may be reproduced or transmitted in any form or by any means, electronic or mechanical, for any purpose, without the express written permission of Citrix Systems, Inc. Citrix Password Manager replaces specific end users encryption keys each time their primary authentication method changes, such as a domain password change or issuance of a new smart card. Password Manager can be configured to perform this operation automatically by using the optional Key Management Module. Password Manager can also be configured to use the Microsoft Data Protection API (DPAPI). When using the optional Key Management Module and/or DPAPI, be advised that an administrator may be able to access user business or personal credentials stored in Password Manager if the administrator logs on as this end user. For additional security, end users can be asked to verify the user s identity with unique user-provided information. This provides an additional layer of protection for the user s secondary credentials. Regional government user computing regulations may require that you notify your end users about the possible security and privacy implications of deploying the Key Management Module and DPAPI security configurations. Review your company policies and determine what kind of notification, if any, is required for your end users Citrix Systems, Inc. All rights reserved. v-go code Passlogix, Inc. All rights reserved. Citrix, ICA (Independent Computing Architecture), and Program Neighborhood are registered trademarks, and Citrix Presentation Server, Citrix Password Manager, and SpeedScreen are trademarks of Citrix Systems, Inc. in the United States and other countries. RSA Encryption RSA Security Inc., All Rights Reserved. This product includes software developed by The Apache Software Foundation ( This product includes software developed by Salamander Software Ltd Salamander Software Ltd. Parts 2003 Citrix Systems, Inc. All rights reserved. Licensing: Portions of this documentation that relate to Globetrotter, Macrovision, and FLEXlm are copyright Macrovision Corporation and/or Macrovision Europe Ltd. All rights reserved. Trademark Acknowledgements Adobe, Acrobat, and PostScript are trademarks or registered trademarks of Adobe Systems Incorporated in the U.S. and/or other countries. Java, Sun, and SunOS are trademarks or registered trademarks of Sun Microsystems, Inc. in the U.S. and other countries. Solaris is a registered trademark of Sun Microsystems, Inc. Sun Microsystems, Inc. has not tested or approved this product. Portions of this software are based in part on the work of the Independent JPEG Group. Portions of this software contain imaging code owned and copyrighted by Pegasus Imaging Corporation, Tampa, FL. All rights reserved. Macromedia and Flash are trademarks or registered trademarks of Macromedia, Inc. in the United States and/or other countries. Microsoft, MS-DOS, Windows, Windows Vista, Windows Media, Windows Server, Windows NT, Win32, Outlook, ActiveX, Active Directory, and DirectShow are either registered trademarks or trademarks of Microsoft Corporation in the United States and/or other countries. Netscape and Netscape Navigator are registered trademarks of Netscape Communications Corp. in the U.S. and other countries. Novell Directory Services, NDS, and NetWare are registered trademarks of Novell, Inc. in the United States and other countries. Novell Client is a trademark of Novell, Inc. RealOne is a trademark of RealNetworks, Inc. Licensing: Globetrotter, Macrovision, and FLEXlm are trademarks and/or registered trademarks of Macrovision Corporation. All other trademarks and registered trademarks are the property of their respective owners. Document Code: September 4, 2007 (BC/NWA)

3 Contents 3 Contents 1 Welcome Password Manager Components The Central Store Password Manager Console Password Manager Agent Software The Password Manager Service Password Manager Product Line Password Manager Advanced Edition Password Manager Enterprise Edition Password Manager Advanced versus Enterprise Editions New Features in Citrix Password Manager About this Document Audience and Assumptions Providing Feedback about this Document Document Conventions Getting More Information and Help Product Documentation Getting Service and Support Subscription Advantage Education and Training Using Password Policies to Enforce Password Requirements Overview of Password Policies Password Sharing Groups Domain Password Sharing Groups Password Policies Enforcement

4 4 Citrix Password Manager Administrator s Guide Creating Password Policies: the Password Policy Wizard Set Basic Password Rules Set Alphabetic Character Rules Set Numeric Character Rules Set Special Character Rules Set Exclusion Rules (Excluding Specific Characters) Set Password History and Expiration Test Password Policy Establish Logon Preferences Customize Password Change Wizard Helping to Increase Password Strength and Security In Your Environment Using and Managing Application Definitions Overview of Application Templates Managing Application Definitions Using Templates How the Password Manager Agent Identifies Applications and User Credential Management Events Identifying the Parts of the Application s User Interface Application Definition Wizard Overview Identify Application Manage Forms Name Custom Fields Specify Icon Configure Advanced Detection Configure Password Expiration Confirm Settings Form Definition Wizard Overview Windows Type Application Definitions Gathering the Information Required for Windows Application Definitions Form Definition Process Using Advanced Matching to Identify Windows Forms Class Information Control Matching SAP Session Information Window Identifier Identification Extensions Using the Action Editor to Define the Action Sequence for Forms Action Sequence Definition Process Action Descriptions

5 Contents 5 Considerations for Windows Type Definitions Web Type Application Definitions Gathering the Information Required for Web Application Definitions Form Definition Process Name Form Identify Form Configure Other Settings Confirm Settings Web Form Wizard Redirect to Windows Application Configuration Advanced Settings Dialog Box for Web Applications Host/Mainframe Type Application Definitions Gathering the Information Required for Host Application Definitions Form Definition Process Advanced Settings for Host Applications Considerations for Host Type Definitions Terminal Emulation Support Mfrmlist.ini Field Definitions Creating User Configurations What Is a User Configuration? Default User Configuration Properties Before You Begin Specifying Domain Controllers for User Configurations Creating a User Configuration: the User Configuration Wizard Name User Configuration Select Product Edition Specify your Synchronization Server Choose Applications Configure Agent Interaction Configure Licensing Select Data Protection Methods Select Secondary Data Protection Enable Self-Service Features Locate Service Modules Completing the User Configuration Wizard Synchronizing Credentials by Using Account Association To Manually Synchronize Application Definitions among Domains Configuring Account Association in the Agent Software

6 6 Citrix Password Manager Administrator s Guide Resetting and Deleting User Data Reset User Data Delete User Data From Central Store Prompting Users to Reregister Answers to Security Questions Assigning Priority to User Configurations Assigning a User Configuration to Different Users Upgrading Existing User Configurations User Authentication and Identity Verification Overview of Password Manager Authentication When Must Users Confirm Their Identities? Overview of Identity Verification Methods Previous Password Security Questions Bypassing Identity Verification If Users Switch among Multiple Primary Authentication Methods Managing Question-Based Authentication Confirming User Identity Using Question-Based Authentication Considerations Question-Based Authentication Workflow Designing Security Questions: Security Versus Usability Considerations for Security Questions Managing Your Questions Setting a Default Language Creating New Security Questions Adding or Editing Text for Existing Questions (Including Translated Text) Creating Security Question Groups Creating and Implementing Your Questionnaire Selecting Questions for Key Recovery Enabling Security Answer Masking Backward Compatibility with Password Manager Versions 4.0 and Allowing Users to Reregister Answers to Their Security Questions Allowing Users to Manage Their Primary Credentials with Account Self-Service Overview of Self-Service Considerations Using Automatic Key Management with Self-Service

7 Contents 7 Summary of Self-Service Implementation Tasks When Users Forget Their Security Questions User Experience Using Provisioning to Automate Credential Entry Summary of Provisioning Tasks Generating a Credential Provisioning Template Editing the Provisioning Template The <cpm-provision> Tag Example Output The <user> Tag The <add> Command The <modify> Command The <delete> Command The <remove> Command The <reset> Command The <list-credentials> Command Provisioning Credentials Tuning Credential Provisioning Processing The Credential Provisioning SDK Hot Desktop: A Shared Desktop Environment for Users Summary of Hot Desktop Tasks Hot Desktop Start Up and Shut Down Process Flow Hot Desktop Startup and Shutdown Events Troubleshooting Hot Desktop User Startup Creating a Hot Desktop Shared Account Guidelines for the Hot Desktop Shared Account Organizing Hot Desktop Users Restricting User Rights Hot Desktop, Smart Cards, and Key Recovery Requirements for Applications Used with Hot Desktop Controlling How Applications Behave for Hot Desktop Users Before You Begin The Session.xml File Launching Applications Using Session.xml Session.xml Tags

8 8 Citrix Password Manager Administrator s Guide User Configuration Settings for Hot Desktop Locating Hot Desktop Settings in a User Configuration Specifying Hot Desktop Session Time-Out Options Enabling the Hot Desktop Session Indicator Specifying a Custom Bitmap Graphic as a Session Indicator Using the Hot Desktop Screen Saver Installing Hot Desktop Disabling Terminal Services for a Hot Desktop Administrative or Silent Install Uninstalling Hot Desktop Restoring Terminal Services after Uninstalling Hot Desktop Enabling Multiple Sessions after Uninstalling Hot Desktop Interacting with Citrix Presentation Server Clients Program Neighborhood Agent Citrix Web Interface Viewing Hot Desktop User Profiles Shutting Down a Hot Desktop Workstation Working without AutoAdminLogon Support Changing the Hot Desktop Shared Account Password Hot Desktop Information on the Web Operations Logging Password Manager Events Mfrmlist.ini File Password Manager Agent Does not Submit Credentials Web-Based Applications Terminal Emulator-Based Applications Supporting Terminal Emulators Configuring HLLAPI Support for Tested Emulators Password Manager Agent Does not Start Software Upgrades and the GINA Chain Creating a New Signing Certificate Signing, Unsigning, Resigning, and Verifying Data Signing Data (-s) Resigning Data (-r) Unsigning Data (-u) Verifying Data (-v) Displaying Help (-h) Enabling and Disabling the Data Integrity Service on Password Manager Agent Software

9 Contents 9 Removing Deleted Objects from Your Central Store Moving Data to a Different Central Store Migrating Data to a New Central Store Backing Up Important Files Backing Up Password Manager Service Files Password Manager Settings List Password Manager 4.6 Settings Reference User Configurations Synchronization Server Basic Agent Interaction Agent User Interface Client Side Interaction Synchronization Account Association Application Support Hot Desktop Licensing Data Protection Methods Secondary Data Protection Self Service Features Key Management Module Provisioning Module Application Definitions Edit Application Forms Application Icon Advanced Detection Password Expiration Password Policies Basic Password Rules Alphabetic Character Rules Numeric Character Rules Special Character Rules Exclusion Rules Password History and Expiration Test Password Policy Logon Preferences Password Change Wizard

10 10 Citrix Password Manager Administrator s Guide 13 Application Definition Extensions Agent Software Operation Identification Extensions Defining Identification Extensions Action Extensions Implementer Requirements Enabling Logging Virtual Key Codes for Host and Windows Applications Codes for VTabKeyN (Windows) Codes for VirtualKeyCode (Windows) and VKEY (Windows) Virtual Key Codes for HLLAPI-Compliant Terminal Emulators

11 1 Welcome Citrix Password Manager provides password security and single sign-on access to Windows, Web, and host-based applications running in the Citrix environment as well as local applications running on the desktop. Users authenticate once and Password Manager does the rest, automatically logging on to password-protected information systems, enforcing password policies, monitoring all passwordrelated events, and even automating user tasks, including password changes. This chapter describes the following: Password Manager Components on page 11 Password Manager Product Line on page 15 About this Document on page 18 Getting More Information and Help on page 20 Password Manager Components The following sections briefly describe Password Manager s components you need to install to start using Password Manager. For detailed information, see Planning Your Password Manager Environment in the Citrix Passwordd Manager Installation Guide. The main components of Password Manager are: The Central Store Password Manager Console Password Manager Agent Software The Password Manager Service (optional)

12 12 Citrix Password Manager Administrator s Guide The Central Store The central store is a centralized repository used by Password Manager to store and manage user and administrative data. User data includes user credentials, security question answers, and other user-focused data. Administrative data includes password policies, application definitions, security questions, and other wider-ranging data. When a user signs on, Password Manager compares that user s credentials to those stored in the central store. As the user opens passwordprotected applications or Web pages, the appropriate credentials are drawn from the central store. Password Manager Console The Password Manager Console is the command center of Password Manager. From the console, you manage the users Password Manager experience. Here, you configure how Password Manager will work, which features will be deployed, which security measures will be used, and other important passwordrelated settings. The console has four main items, or nodes, in the left pane. By selecting a node, tasks specific to that node appear. These nodes are: User Configurations These configurations allow you to tailor particular settings for your users based on their geographic locations or business roles. The settings of the other three nodes are used to create user configurations. Application Definitions These definitions provide the information necessary for the Agent software to supply user credentials to applications, and to detect error conditions if they occur. You can use the application definition templates supplied with Password Manager to speed this process, or create your own customized definitions for applications that cannot use these templates. Additional templates are located at: Password Policies Password policies control password length and the type and variety of characters used in both user-defined and automatically-generated passwords. Password policies also allow you to identify characters to exclude from use in passwords and whether or not previous passwords can be reused. Creating password policies consistent with your company s security policies ensures that password security is appropriately managed by Password Manager.

13 1 Welcome 13 Identity Verification The security questions you create provide an added layer of security to your agent software by protecting against user impersonation, unauthorized password changes, and unauthorized account unlocking. Users who enroll and answer your security questions can then verify their identity by providing the same answers when challenged. Once verified, the users can perform self-service tasks to their account, such as resetting their primary password or unlocking their user account. The security questions can also be used for key recovery. Password Manager Agent Software The Password Manager Agent is the software users need on their client devices to act as an intermediary between users and their applications. When a user tries to access an application that requires authentication, the agent software intercepts the application s request for authentication, finds the correct credentials, and submits them to the application. In addition, the Password Manager Agent can provide users with a wide array of features. Which features the users actually receive is determined by the administrative settings you make in their user configurations. See Password Manager Settings List on page 199 for the specific settings available to you. Password Manager Agent features include: Notification area icon The Password Manager Agent s notification area icon provides access to the Logon Manager and other Password Manager functionality, such as security question registration, pausing, and online Help. Logon Manager The Logon Manager provides a user interface where credentials can be created, viewed, edited, and deleted. Users can also conduct security question registration and access online Help from the Logon Manager. The File menu provides the user with much of the available access: The New Logon command allows users to add new Windows-, Web-, or host-based application credentials to Password Manager. The Properties command gives the user access to properties associated with the credentials for the specified application. From there, the user can change the password, user ID, and other logon information. The Delete command, when invoked, removes users credentials for the selected application from Logon Manager.

14 14 Citrix Password Manager Administrator s Guide The Copy command provides a duplicate set of the selected credentials that the user can then edit to create multiple sets of credentials for single applications. Other commands you can give users access to include: The Reveal Passwords command, from the View menu, allows the user to display the passwords of the applications listed in Logon Manager Note: Password policy settings for revealing passwords override this command. If you do not want users to reveal the password for an application, be sure to set the password policy to prevent this. The Security Question Registration command, from the Tools menu, gives the user the option to restart the Security Question Registration wizard and provide new answers to the security questions. The Account Association command, from the Tools menu, allows the user to create an association between accounts on different domains. By using this feature, the user s credentials are synchronized, with password changes carried across domains. Automated new logon setup Users can set up new logon credentials quickly using the New Logon wizard. The Password Manager Agent detects when an application or Web site requests logon information. If the user s credentials are not already stored in Password Manager, the New Logon wizard automatically appears, offering to store them. User mobility The Password Manager Agent supports remote and mobile users. By obtaining a license before disconnecting, remote users can access their credentials when they are disconnected from the corporate network. Mobile users can move from one computer to another and multiple users can securely share one workstation. The Password Manager Service The Password Manager Service runs on a Web server that provides the foundation for optional features included in this release. Install the Password Manager Service if you plan to implement at least one of the following modules: Self-Service, which allows users to reset their Windows passwords and unlock their Windows accounts

15 1 Welcome 15 Data Integrity, which protects data from being compromised while in transit from the central store to the agent Key Management, which provides users with the capability to recover their secondary credentials when their primary password changes, either with automatic key recovery or after answering security questions with questionbased authentication. Provisioning, which allows you to use the console to add, remove, or update Password Manager user data and credential information Credential Synchronization, which synchronizes user credentials among domains using a Web service If you are not implementing the modules mentioned above, do not install the Password Manager Service. For more information about the Password Manager Service, see Installing and Configuring the Password Manager Service in the Citrix Password Manager Installation Guide. Password Manager Product Line Password Manager is now available in two editions: Password Manager Advanced Edition Password Manager Enterprise Edition In addition, Citrix Presentation Server 4.5 with Feature Pack 1, Platinum Edition, includes a feature comparable to Password Manager Enterprise Edition called Single Sign-on Powered by Password Manager. Password Manager Advanced Edition The Advanced Edition of Password Manager increases your organization s security with: Strong password policy options Automated password generation Automatically started Password Change Wizard option Password encryption while in memory, storage, and transmission Password expiration options for applications lacking that capability The Advanced Edition also interacts well with other programs, easing the user s logon information storage process as well as your maintenance of that process and information.

16 16 Citrix Password Manager Administrator s Guide Password Manager Enterprise Edition The Enterprise Edition of Password Manager is designed for the most demanding and complex enterprise environments. The Enterprise Edition: Provides additional security, user self-service, and on-site user mobility features and performance. Reduces calls to the help desk through user self-service features that enable users to change their own Windows password and unlock their account. Allows on-site mobile workers to quickly access information with Hot Desktop, which facilitates fast user switching at shared workstations. Includes enterprise security features such as integration with smart cards, Kerberos, and Federated Environment Support (ADFS and SAML). Password Manager Advanced versus Enterprise Editions User Features Advanced Edition Enterprise Edition Single sign-on to Windows applications X X Single sign-on to Web applications X X Single sign-on to host-based terminal emulator applications X X Citrix Access Client X X Localized user interface X X Support for SAPGUI, Internet Explorer 7 (32-bit, 64-bit) X X Self-service password reset Self-service account unlock Self-service feature integration with Web Interface Hot Desktop fast user switching Hot Desktop/SmoothRoaming integration Account association X X X X X X Security Features Advanced Edition Enterprise Edition Automated password change X X Transparent password change X X

17 1 Welcome 17 Security Features Advanced Edition Enterprise Edition Encrypted passwords in memory, storage, during transmission X X Password policy enforcement automatic password changes X X Password policy enforcement manual password changes X X Password expiration X X Password token and biometric support X X Smart card support X Cryptographic data integrity assurance X X Kerberos and Federated Environment Support (ADFS, SAML) X Administrator Features Advanced Edition Enterprise Edition Batch credential provisioning X X Integration with user provisioning products X X Windows NT file share support X X Microsoft Active Directory support X X Novell NetWare network share support X X LDAP directory support X X Administration by Active Directory groups X X Citrix Streaming Server support X X Citrix Access Management Console X X Platinum-integrated licensing X X Windows Server bit compatibility X X Named user licensing X X Concurrent user licensing [Citrix Password Manager for Presentation Server only] X New Features in Citrix Password Manager 4.6 Citrix Password Manager 4.6 includes the following:

18 18 Citrix Password Manager Administrator s Guide Windows Vista Support for Password Manager Agent Password Manager Agent now offers its full range of features in the Windows Vista environment. For the full list of environments supported by Password Manager, see Password Manager Console and Agent Requirements and Password Manager Service Requirements in the Citrix Password Manager Installation Guide. Improved Credential Provisioning Application credentials can now be provisioned to users any time their Password Manager Agent is running. Previously, provisioning could be carried out only during the agent software startup process. Multiple Domain Service Support Password Manager now enables you to share the Password Manager Service among users in different domains. You can install the Password Manager Console on computers in different domains and then create one or more user configurations in each domain. Masked Security Answers for Question-Based Authentication Password Manager now provides you the option to mask user answers to question-based authentication security questions. If enabled, users answers are protected during answer registration and when provided for identity verification. Account Self-Service Available When the Computer is Locked The Account Self-Service button, which has been available on the Windows logon dialog box, is now also available on the Unlock Computer dialog box. This feature enables users to reset their network password or unlock their Windows domain accounts. Note: Account Self-Service is available with the Enterprise Edition only. About this Document The overall objectives of this guide are to provide you with: An understanding of the features and functionality of Password Manager Instructions and tips to help you create and maintain the optimum password management environment for your users

19 1 Welcome 19 Audience and Assumptions This document is intended for use by system and security administrators who are implementing Password Manager. It is assumed that you, the reader, have a basic understanding of Windows Server administration. You must have a working knowledge of Novell NetWare if this is the platform you are using to install or maintain Password Manager. Providing Feedback about this Document To provide feedback about the documentation, go to and click Support > Knowledge Center > Product Documentation. To access the feedback form, click the Submit Documentation Feedback link. Document Conventions Citrix product documentation uses the following typographic conventions for menus, commands, keyboard keys, and items in the program interface: Convention Boldface Italics %SystemRoot% Monospace Meaning Commands, names of interface items such as text boxes, option buttons, and user input. Placeholders for information or parameters that you provide. For example, filename in a procedure means you type the actual name of a file. Italics are also used for new terms and the titles of books. The Windows system directory, which can be WTSRV, WINNT, WINDOWS, or any other name you specify when you install Windows. Text displayed in a text file. { braces } A series of items, one of which is required in command statements. For example, { yes no } means you must type yes or no. Do not type the braces themselves. [ brackets ] Optional items in command statements. For example, [/ping] means that you can type /ping with the command. Do not type the brackets themselves. (vertical bar) A separator between items in braces or brackets in command statements. For example, { /hold /release / delete } means you type /hold or /release or /delete. (ellipsis) You can repeat the previous item or items in command statements. For example, /route:devicename[, ] means you can type additional devicenames separated by commas.

20 20 Citrix Password Manager Administrator s Guide Getting More Information and Help This section discusses the documentation for this release. It also describes how to get more information about Password Manager. The following topics are explored: Product Documentation Getting Service and Support Subscription Advantage Education and Training Product Documentation Password Manager contains a robust library of documentation. Much of this documentation can be found on the Citrix Web site ( Direct links to the documentation are in the Password_Manager_Read_Me_First.html file in the Documentation folder on the product CD. Pre-Installation Update Bulletin The Pre-Installation Update Bulletin contains installation-related information developed after the Readme file was completed. The bulletin is available at Password_Manager_Read_Me_First Also known as Welcome to Citrix Password Manager, the Password_Manager_Read_Me_First.html document is located in the Documentation folder of the product CD. The document contains direct links to the library of Password Manager documentation on the Citrix Web site. Readme file The Readme file provides information about Password Manager functionality, known issues, changes, and other important information developed after the Citrix Password Manager Administrator s Guide was completed. Be sure to read this before installing Password Manager. It is located on the Citrix Web site and can be accessed directly through Password_Manager_Read_Me_First.html. Getting Started with Citrix Licensing Guide The licensing process for Password Manager changed since the release of Password Manager 4.1. See Getting Started with the Citrix Licensing Guide, available from the Citrix Web site and accessible through Password_Manager_Read_Me_First.html, for instructions to license Password Manager.

21 1 Welcome 21 Note: Guides are provided as Adobe Portable Document Format (PDF) files. To view, search, and print PDF documents, you need to have Adobe Acrobat Reader with Search, or Adobe Reader 6.0 or later. You can download these products for free from Adobe Systems Web site at Citrix Password Manager Installation Guide The Citrix Password Manager Installation Guide provides procedures for the installation and upgrade of Password Manager. It is located on the Citrix Web site and can be accessed directly through Password_Manager_Read_Me_First.html. Citrix Password Manager Administrator s Guide The Administrator s Guide, the document you are currently reading, provides conceptual information and instructions for system administrators who maintain, configure, and test the components of Password Manager. It is located on the Citrix Web site and can be accessed directly through Password_Manager_Read_Me_First.html. Installation Checklist This document provides a quick, concise prompt for administrators experienced at installing Password Manager. It approaches the installation process from a broad perspective and is not meant as a substitute for this Installation Guide. It is located on the Citrix Web site and can be accessed directly through Read_Me_First.html. Online Help for Administrators and Users Administrators now have a robust set of Help topics based on the Installation Guide and Administrator s Guide. Administrators can now view information about common tasks, workflow, and settings on the screen. Users can get information about common tasks, including adding logon information for applications, using the Logon Manager, and setting Password Manager automatic features. Users can access Help through Help menus or Help buttons. Citrix Password Manager Evaluator s Guide This guide delivers a practical overview of Password Manager features and functionality by providing an overview of how to set up and run a small-scale deployment of the product.

22 22 Citrix Password Manager Administrator s Guide Getting Service and Support Citrix provides technical support primarily through the Citrix Solutions Advisors Program. Contact your supplier for first-line support or check for your nearest Solutions Advisor at In addition to the Citrix Solutions Advisors Program, Citrix offers a variety of self-service, Web-based technical support tools from its Knowledge Center at Knowledge Center features include: A knowledge base containing thousands of technical solutions to support your Citrix environment. A Web-based product documentation library. Interactive support forums for every Citrix product. Access to the latest hotfixes and service packs. Security bulletins. Web-based problem reporting and tracking (for users with valid support contracts). Citrix Live Remote Assistance. Using Citrix s remote assistance product, GoToAssist, a member of our support team can view your desktop and share control of your mouse and keyboard to get you on your way to a solution. Another source of support, Citrix Preferred Support Services, provides a range of options that allows you to customize the level and type of support for your organization s Citrix products. Subscription Advantage Subscription Advantage gives you an easy way to stay current with the latest server-based software functionality and information. During your subscription period, you get automatic delivery of: Feature releases Software upgrades Enhancements Maintenance releases Priority access to important Citrix technology information.

23 1 Welcome 23 You can find more information about subscribing on the Citrix Web site at (click Subscription Advantage). You can also contact your Citrix sales representative or a member of the Citrix Solutions Advisors Program for more information. Education and Training Citrix offers a variety of instructor-led training and Web-based training solutions. Instructor-led courses are offered through Citrix Authorized Learning Centers (CALCs). CALCs provide high-quality classroom learning using professional courseware developed by Citrix. Many of these courses lead to certification. Web-based training courses are available through CALCs, resellers, and from the Citrix Web site. Information about programs and courseware for Citrix training and certification is available from

24 24 Citrix Password Manager Administrator s Guide

25 2 Using Password Policies to Enforce Password Requirements Citrix Password Manager enables you to define rules to control the characteristics of the passwords stored by your users and required by single sign-on (SSO) enabled applications. These rules comprise password policies that you can apply to all users or to specific groups of applications as determined by your organization s needs. This section describes how to create password policies within your Password Manager environment. See also What about Password Policies for Application Access? in the Citrix Password Manager Installation Guide. Overview of Password Policies on page 25 Creating Password Policies: the Password Policy Wizard on page 27 Helping to Increase Password Strength and Security In Your Environment on page 34 Note: Citrix Presentation Server provides policy rules that allow you to configure and control which users can access Password Manager when they connect to servers and published applications in the server farm. See the Presentation Server Administrator s Guide for more information. Overview of Password Policies Password Manager includes two standard password policies named Default and Domain, which cannot be deleted. These policies can be used as is, copied, or modified to suit your enterprise policies and regulations. When a user adds credentials to Logon Manager for an application not defined by an administrator, Password Manager uses the Default policy to manage that application. If you want an application group to be treated as a domain password sharing group, you must apply the Domain policy to that application group.

26 26 Citrix Password Manager Administrator s Guide Note: Because Password Manager applies the Default password policy to useradded applications, ensure that you configure the Default policy to be as broad as needed to accept passwords for those applications for which you allow passwords to be stored. You can create as many policies as you need in your enterprise. For example, you can apply one policy for your domain sharing group, and create individual policies to apply to individual groups of applications to define the requirements further. A password policy allows you to: Automate password changes for applications Implement security schemes that include complex passwords and application-specific passwords not visible to the users Define password expiration for applications, even if the application does not have a password expiration feature Note: When users change their passwords, Password Manager can check the old password against the new password. This option helps prevent users from reusing passwords for the same application twice in a row. See Set Password History and Expiration on page 31. Also see Password Policies Enforcement on page 27. Password Sharing Groups Users might have a single password that is used for multiple applications (in a suite of products, for example). This scheme is known as password sharing, where the same authentication authority is used for the applications. While the other credentials for those applications (such as user name and custom fields) might be different, the user s password is the same. In this case, create an application group that is a password sharing group to ensure that the agent software manages the password for all applications in the group as a single entity. When the password is changed in one of the applications, the agent software ensures that the password change is reflected in the stored credentials for all applications in the group.