Forum Replies Created
-
Posts
-
That was the message in the Job section of WMS Public Cloud after the job went to failed.
I did pull a log file but not sure where to look
The log exported as DHC8c47be19df04-2021-04-14-14.47.39.tar
Unpacking the log file with 7zip i get a lot of other files i just haven’t had time to dig through, any help would be appreciated
Here’s the Ethernet policy
Here’s the WLAN Policy
On Ethernet it works fine, on WiFi its 3-4 reboots before it can establish its connection. I get the same experience on my 5070 and 5470 and they’re using the same global policy for external devices.
In 8.6 using Disable Wireless if ENET UP has never been an issue so i’m carrying that policy over. Could it be the wireless wait time?
I would have thought the same but this is my thin client I have at home and I have no Apple device connected to it. Dell keyboard and mouse, Logitech C920 camera and a Plantronics headset is all that is connected.
The device that was in-office where we did a network capture also had no Apple product connected to it. This is very odd.
Correct, I am speaking about Citrix.
For our externally facing thin clients logging in to Citrix using Azure MFA SAML there appears to be a 15 minute timeout and i’m trying to figure out if that is controlled on the Azure Federated Services side, or something on the Citrix side, but I don’t think its the thin client side. The reason I don’t think its the thin client side is in the Citrix Broker Settings the Timeout listed there is 300 in seconds which is 5 minutes and my timeout is taking 15 minutes
[2021-04-16 07:36:34.874] N/WebUIProc/WebUIModule (1/1) [Citrix] login to broker “https://xxxxxxx.xxxxxxxxx.com/Citrix/NSWEBFAS”
[2021-04-16 07:36:34.874] N/WebUIProc/WebUIModule (1/1) [StoreFront] roaming “https://xxxxxxxx.xxxxxxxxxx.com/Citrix/NSWEBFAS”…
[2021-04-16 07:36:35.272] N/WebUIProc/WebUIModule (1/1) [StoreFront] gateway authorize “/vpn/index.html”…
[2021-04-16 07:51:36.017] N/WebUIProc/WebUIModule (1/1) [StoreFront] gateway authorize failed “/vpn/index.html”. error => Error: The login was cancelled, because wait user credentials timeout.
[2021-04-16 07:51:36.018] N/WebUIProc/WebUIModule (1/1) [StoreFront] roaming failed “https://xxxxxxxx.xxxxxxxx.com/Citrix/NSWEBFAS”. error => Error: The login was cancelled, because wait user credentials timeout.
[2021-04-16 07:51:36.021] N/WebUIProc/WebUIModule (1/1) [Citrix] login to broker “https://xxxxxxxx.xxxxxxxxxx.com/Citrix/NSWEBFAS” failed. error => Error: The login was cancelled, because wait user credentials timeout.Are your logs similar regardless of what auth method you’re using?
What your describing sounds like Azure MFA SAML where the “browser lite” pops up from the federated services page on top of the ThinOS login box?
Eventually the federated services page expires and disappears and as you’ve said, you can hit Esc or Enter to get it to pop up again. Is that accurate?
What is the format of your broker URL?
I’m having no trouble using https://myCitrix.com/Citrix/StoreName
if you leave the url without /Citrix/StoreName what happens?
Usually you have to select the store from a pop-up
Is the authentication type Default, LDAP, MFA?
Try your format like this, take off the mscep.dll. Add http to the front, you also need the CA Cert Hash and Enrollment Password those should be located on your URL page of “CertSrv/mscep_admin/” whatever that is. Give that a try
My certificates get created with the name scep_cert_SN.crt If you read the rest of this thread there is an enhancement ticket submitted for this, for some reason we are locked to .crt and can’t do .pfx.
See if that gets the certificate for you.
Can you post how your policy looks? You can block out server names, etc?
You have to do cert enrollment on an open network (802.1x not being enforced) and not enforcing EAP-TLS on the network side. I have a top level policy that does the enrollment with no network configurations in the policy, once the certificate is installed I move the thin client to a sub policy that then has the network configuration setup with EAP-TLS machine authentication for both wired and wireless.
If your policy right now is an “all-in-one” trying to enroll and enforce before you have the cert it may not work.
I’ve done a lot of work with SCEP and happy to assist, but I’ll need more info about how your policy is setup.
Page 19 of the WTOS 9.1.2101 release notes (publicly available 4/14/2021)
VNC password restriction
The VNC password length is restricted to eight characters. When you enter more or less than eight characters, red tips are displayed to notify you to follow the rule and enter the correct password.SMH
Thanks CG.
I did a new policy as in the past when going from DHC 1.0 to 1.1 and just used the .bundle file, but it seems to not like that.
Failed – (Name: DHC1.5ImgUpgradeAddon.bundle Description: Failed to Download DHC1.5ImgUpgradeAddon.bundle ( FetchError: request to https://xxxxxxxxx.corp.xxxxxxxx.net:443/wms-repo/image/app/hybridClient?fileName=DHC1.5ImgUpgradeAddon.bundle failed, reason: getaddrinfo ENOTFOUND xxxxxxx.corp.xxxxxxxx.net ) Status: Failed)
The upgrade worked in the past I’ll have to login as an admin and see what is going on, i can’t bring up any tools while auto-signon as guest
Thanks CG, appreciate it.
Is there any way my profile can be flagged to not need admin approval?
If I run into an issue I try to be as detailed as possible and provide a lot of screenshots, it seems there is a limit to that before I get flagged as needing approval. I would never do anything malicious on the board which is why I assume that admin approval is in place. If not I’ll just make these posts going forward to let you know 🙂
I would compare BIOS setting of the D10 to the 3040 and see what might be different between the two.
I was able to use the new “Reset Policy” button in WMS 3.2 and save the policy with VNC turned OFF. Then went back in and turned ON VNC, added the IP addresses to VNCD server field and it does not like any password I try with the exception of Wyse#123.
Then I tried variations of Wyse#123 and modified from there
- Gyse#123
- Fyse#123
- Bing#789
- Bing@345
- Wyse*123
All work at EXACTLY 8 characters, as soon as you go to character 9, the box goes red again stating you don’t meet the requirements. So the message in the console is accurate “Password must be 8 characters” I took that to mean “Password must be ‘at least’ 8 characters since my previous working password was 10 characters.
I don’t know why they would put a limit cap on the password as 8 characters
Also not to hijack my own post but I created a lengthy DHC 1.5 post awaiting admin approval if you could plz, thanks friend 🙂
When I was first setting up the policy in WMS Public Cloud 3.0 I was able to create the existing password and add my IP address into the VNCD field. Currently there is only one IP listed in the VNCD field. If I try to remove the IP and save the policy I get the same password prompt stating the password does not meet validation criteria. I can never save and publish the change I have to cancel any change being made to that field.
I”m worried that if I try to turn off VNC and save it and then turn VNC back on and set a new password it won’t take it and I’ll break my current VNC access
In WMS under Peripheral Management and Keyboard settings what is the keyboard repeat rate and repeat delay?
I do not experience this delay on my 3040’s or 5070’s and I also have a personal Ubuntu desktop running 20.04 and Citrix Workspace App for Linux to do comparisons of what could be a ThinOS issue vs a Citrix Linux issue; have not seen it there either.
What is the VDA version on the Desktop/VM? We run 1912 LTSR CU1 and have not experienced this. Did something change in your VDA space?
