Configure GACS with NetScaler and StoreFront

Citrix Global App Configuration Service (GACS) lets you manage Citrix Workspace app settings centrally from Citrix Cloud, instead of through Group Policies, registry keys or local configuration files on every device. Getting it to work through an on-premises NetScaler Gateway and StoreFront needs a few prerequisites first: ICA file downloads disabled, the Content Security Policy (CSP) updated on both components, and NetScaler able to retrieve a token from Citrix Cloud.

This guide covers the configuration steps for StoreFront, NetScaler and Citrix Cloud.

What is GACS?

Citrix Global App Configuration Service (GACS) is a cloud-based management service. Administrators use it to centrally configure, distribute and manage Citrix Workspace app settings across all supported devices and operating systems.

With GACS you can manage Citrix Workspace app settings centrally from Citrix Cloud, instead of configuring them on each device through Group Policies, registry keys or configuration files.

Main benefits:

One central place to manage Workspace app settings across platforms
Configuration reaches unmanaged and BYOD devices without GPO or MDM
Less dependency on GPOs, registry changes and local configuration files
Faster rollout of configuration changes

Requirements for GACS

Disable ICA file downloads

By default, web-based Citrix launches may download an ICA file to the user’s device before the session starts. Disabling ICA file downloads improves security by preventing ICA files from being stored on disk, reducing the risk of unauthorized access, file sharing or malicious interception. Instead, session launch information is transferred directly in memory using Citrix Workspace app and Workspace Web Extensions.

Citrix recommends disabling ICA file downloads wherever possible and using native Workspace app or in-memory launch methods instead. See Improving ICA File Security on Citrix TechZone. Client Detection must be working correctly for this to succeed, since it is a prerequisite for in-memory launch.

Content Security Policy (CSP)

Content Security Policy (CSP) is an HTTP security header that defines which external sources a web application is allowed to load content from, such as scripts, images, stylesheets and embedded services. By restricting trusted sources, CSP helps protect applications against attacks such as cross-site scripting (XSS) and the execution of unauthorized content.

For GACS to function correctly, the default CSP configuration on both NetScaler and StoreFront must be updated to allow communication with Citrix Cloud services. On NetScaler, the built-in CSP header on the AAA virtual server is replaced with a custom CSP header delivered through a rewrite policy. On StoreFront, the CSP is embedded in the site’s HTTP metadata and must be modified to permit connections to *.cloud.com. Without these changes, Workspace app clients may be unable to retrieve GACS configuration data from Citrix Cloud.

Configuration

Step 1: StoreFront

Disable ICA file downloads.
Modify receiver.html, located under C:\inetpub\wwwroot\Citrix\<WebStoreName>:

<meta http-equiv="content-security-policy" content="default-src 'none'; manifest-src 'self' blob:; script-src 'self' ; object-src 'none'; frame-src 'self' receiver: citrixapp: citrixenterprisebrowser: citrixweb: ; connect-src 'self' https://*.cloud.com receiver:; img-src 'self' data: blob:; font-src 'self'; style-src 'self' 'unsafe-inline';"/>

Note: this was verified against StoreFront version 2507; newer versions may not need this change.

Step 2: NetScaler

Make sure the StoreFront Base URL is resolvable from the NetScaler appliance. NetScaler uses this URL to obtain an access token from StoreFront, which is then exchanged for a token used to communicate with GACS at https://gacs-config.cloud.com/acc/token. If the StoreFront Base URL is not resolvable, create a DNS record on the NetScaler for it.
When AAA and ICA Gateway functionality are split across separate virtual servers instead of a single consolidated Gateway vserver, configure the Secure Ticket Authority (STA) servers on both the AAA Gateway and the ICA Gateway virtual servers; this is required for correct client detection.
Create a rewrite action and policy that inserts the required CSP header into client responses, and bind it to both the RESPONSE and AAA_RESPONSE bind points so it covers authentication and application traffic. Then disable the built-in default CSP header on the AAA parameters.

Applying this changes the CSP for every user who hits this Gateway immediately: apply it in a maintenance window and keep a way to revert the rewrite policy binding if the new header breaks Workspace app or Gateway logon.

add rewrite action rw_act_insert_csp_header insert_http_header Content-Security-Policy "\"default-src 'self'; script-src https://www.google.com/recaptcha/api.js https://www.gstatic.com/recaptcha/releases/ https://*.example.com 'self' 'unsafe-inline' 'unsafe-eval'; connect-src 'self' https://*.cloud.com https://*.example.com receiver:; img-src http://localhost:* https://*.example.com 'self' data: http: https:; style-src 'self' 'unsafe-inline'; font-src 'self' data:; frame-src https://www.google.com/recaptcha/ com.citrix.agmacepa://* receiver://* citrixng://* com.citrix.nsgclient://* nsgcepa://* application://* 'self'; child-src 'self' com.citrix.agmacepa://* receiver://* citrixng://* com.citrix.nsgclient://* nsgcepa://* application://*; form-action 'self' https://*.example.com https://*.microsoftonline.com; object-src 'none'; report-uri /nscsp_violation/report_uri\""

add rewrite policy rw_pol_insert_csp_header true rw_act_insert_csp_header

bind vpn vserver <gateway_vserver_name> -policy rw_pol_insert_csp_header -priority 80 -gotoPriorityExpression NEXT -type RESPONSE
bind vpn vserver <gateway_vserver_name> -policy rw_pol_insert_csp_header -priority 80 -gotoPriorityExpression NEXT -type AAA_RESPONSE

set aaa parameter -defaultCSPHeader DISABLED

Replace the script-src, connect-src, img-src and form-action sources above with your own domains; the https://*.example.com entries are placeholders, not literal values to copy as-is. <gateway_vserver_name> is the name of your AAA/ICA Gateway vserver.

Step 3: Citrix Cloud

In Citrix Cloud, go to “Client app management”. From there you can claim your NetScaler Gateway URLs and configure your Citrix Workspace app settings.

Quick checklist

ICA file downloads disabled and Client Detection working
StoreFront CSP allows https://*.cloud.com
StoreFront Base URL resolvable from NetScaler
STA configured on both AAA and ICA Gateway virtual servers (split deployments)
Custom CSP rewrite policy bound to RESPONSE and AAA_RESPONSE
Default CSP header disabled in the AAA parameters
NetScaler Gateway URLs claimed in Citrix Cloud

Conclusion

GACS makes Citrix Workspace app management simpler, more consistent and easier to scale. For it to work with NetScaler Gateway and StoreFront, a few details need to be right: secure in-memory launches, a correct CSP on both components, DNS resolution for token retrieval, and a properly claimed Gateway URL in Citrix Cloud.

Get these prerequisites right, and you can manage Workspace app settings centrally from one place.

Need help with GACS or NetScaler Gateway?

Is your Workspace app not picking up GACS settings? Does a CSP change break your Gateway logon? Or do you want the configuration right the first time? Blubyte’s NetScaler experts can review your Gateway, StoreFront and CSP setup and help you roll out GACS securely and without disruption.

Book a quick call with one of our NetScaler experts and get your Citrix Workspace configuration under central control.

Sources:

Tagged: Citrix Global App Configuration Service, Citrix GACS configuration, Citrix Workspace app settings, NetScaler Gateway GACS, StoreFront GACS configuration, Citrix Cloud client app management, NetScaler Content Security Policy, Citrix ICA file security, Citrix Workspace app client detection, Citrix GACS token retrieval