Use ShareFile with Citrix Endpoint Management

Citrix Endpoint Management has two options for integrating with ShareFile. They are Citrix Files and storage zone connectors.

Citrix Files

You can configure Citrix Endpoint Management to provide access to your ShareFile account. That configuration:

Gives mobile users access to the full ShareFile feature set, such as file sharing, file sync, and storage zone connectors.
Can provide Citrix Files with single sign-on authentication of mobile productivity app users and comprehensive access control policies.
Provides ShareFile configuration, service level monitoring, and license usage monitoring through the Citrix Endpoint Management console.

For more information about configuring Citrix Endpoint Management for Enterprise accounts, see SAML for single sign-on with Citrix Files.

Storage zone connectors

You can configure Citrix Endpoint Management to provide access only to storage zone connectors that you create through the Citrix Endpoint Management console. That configuration:

Provides secure mobile access to existing on-premises storage repositories, such as SharePoint sites and network file shares.
Doesn’t require that you set up a ShareFile subdomain or host Citrix Files data.
Provides users with mobile access to data through the Citrix mobile productivity apps for Citrix Files for iOS and Android. Users can edit Microsoft Office documents. Users can also preview and annotate Adobe PDF files from mobile devices.
Complies with security restrictions against leaking user information outside of the corporate network.
Provides simple setup of storage zone connectors through the Citrix Endpoint Management console. If you later decide to use the full Citrix Files functionality with Citrix Endpoint Management, you can change the configuration in the Citrix Endpoint Management console.

For an Citrix Endpoint Management integration with storage zone connectors only:

ShareFile uses your single sign-on configuration to NetScaler Gateway to authenticate with the storage zones controller.
Citrix Endpoint Management doesn’t authenticate through SAML because the Citrix Files control plane isn’t used.

The following diagram shows the high-level architecture for Citrix Endpoint Management use with storage zone connectors.

Storage zones controller

Requirements

Minimum component versions:
- ShareFile for iOS (MDX) 5.3
- ShareFile for Android (MDX) 5.3
- Storage zones controller 5.11.20 This article has instructions for how to configure storage zones controller 5.0
The requirements for storage zones for Citrix Files Data and for Restricted storage zones don’t apply to an Citrix Endpoint Management integration with storage zone connectors only.

Citrix Endpoint Management doesn’t support Documentum connectors.
- To run PowerShell scripts:
  - Run the scripts in the 32-bit (x86) version of PowerShell.
  Installation tasks
  
  Complete the following tasks, in the order presented, to install and set up storage zones controller. These steps are specific to Citrix Endpoint Management integration with storage zone connectors only. Some of these articles are in the storage zones controller documentation.
  1. Configure NetScaler for storage zones controller You can use NetScaler Gateway as a DMZ proxy for the storage zones controller.
  2. Install an SSL certificate A storage zones controller that hosts standard zones requires an SSL certificate. A storage zones controller that hosts restricted zones and uses an internal address doesn’t require an SSL certificate.
  3. Prepare your server IIS and ASP.NET setup is required for storage zone connectors.
  4. Install storage zones controller
  5. Prepare storage zones controller for use with storage zone connectors-only
  6. Specify a proxy server for storage zones The storage zones controller console enables you to specify a proxy server for the storage zones controller. You can also specify a proxy server using other methods.
  7. Configure the domain controller to trust the storage zones controller for delegation Configure the domain controller to support NTLM or Kerberos authentication on network shares or SharePoint sites.
  8. Join a secondary storage zones controller to a storage zone To configure a storage zone for high availability, connect at least two storage zones controllers to it.
  Install storage zones controller
  1. Download and install the storage zones controller software:
    1. From the Citrix Files download page at https://www.citrix.com/downloads/sharefile.html, log on and download the latest storage zones controller installer.
    2. Installing the storage zones controller changes the default website on the server to the installation path of the controller. Enable Anonymous Authentication on the default website.
    - In the Destination Folder page, if Internet Information Services (IIS) is installed in the default location, leave the defaults. If not, browse to the IIS installation location.
    - When installation is complete, clear the checkbox for Launch Storage Zones Controller Configuration Page and then click Finish.
    Important: If you plan to clone the storage zones controller, capture the disk image before you continue with configuring the storage zones controller.
    
    Prepare storage zones controller for use with storage zone connectors-only
    
    For an integration only with storage zone connectors, you don’t use the storage zones controller administrative console. That interface requires a Citrix Files administrator account, which isn’t necessary for this solution. As a result, you run a PowerShell script to prepare the storage zones controller for use without the Citrix Files control plane. The script does the following:
    - Registers the current storage zones controller as a primary storage zones controller. You can later join a secondary storage zones controller to the primary controller.
    - Creates a zone and sets the passphrase for it.
  2. From your storage zones controller server, download the PsExec tool: Navigate to Microsoft Windows Sysinternals and then click Download PsTools. Extract the tool to the root of the C drive.
  3. Run the PsExec tool: Open the Command Prompt as the Administrator User and then type the following:
```
``` cd c:\pstools PsExec.exe -i -u "NT AUTHORITY\NetworkService" C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe ``` 
```
4. When prompted, click Agree to run the Sysinternals tool. A PowerShell widow opens.
5. In the PowerShell window, type the following:
```
``` Import-Module "C:\inetpub\wwwroot\Citrix\StorageCenter\Tools\SfConfig\SfConfig.dll" New-Zone -Passphrase passphrase -ExternalAddress https://szcfqdn.com ``` 
```
  Where: Passphrase: Is the passphrase that you want to assign to the site. Make a note of it. You cannot recover the passphrase from the controller. If you lose the passphrase, you cannot reinstall storage zones, join more storage zones controllers to the storage zone, or recover the storage zone if the server fails. ExternalAddress: Is the external fully qualified domain name of the storage zones controller server. Your primary storage zones controller is now ready. Before you log in to Citrix Endpoint Management to create storage zone connectors: Complete the following configuration, if applicable: Specify a proxy server for storage zonesConfigure the domain controller to trust the storage zones controller for delegationJoin a secondary storage zones controller to a storage zone To create storage zone connectors, see Define storage zones controller connections in Citrix Endpoint Management.
  Join a secondary storage zones controller to a storage zone
  
  To configure a storage zone for high availability, connect at least two storage zones controllers to it. To join a secondary storage zones controller to a zone, install a storage zones controller on a second server. Then join that controller to the zone of the primary controller.
  1. Open a PowerShell window on the storage zones controller server that you want to join to the primary server.
  2. In the PowerShell window, type the following: Join-Zone -Passphrase \ -PrimaryController \ For example: Join-Zone -Passphrase secret123 -PrimaryController 10.10.110.210
  Define storage zones controller connections in Citrix Endpoint Management
  
  Before you add storage zone connectors, you configure the connection information for each storage zones controller enabled for storage zone connectors. You can define storage zones controllers as described in this section, or when you add a connector.
  
  On your first visit to the Configure > ShareFile page, the page summarizes the differences between using Citrix Endpoint Management for Enterprise accounts and storage zone connectors.
  
  Click Configure Connectors to continue with the configuration steps in this article.
  1. In Configure > ShareFile, click Manage Storage Zones.
  2. In Manage Storage Zones, add the connection information.
    - Name: A descriptive name for the storage zone, used to identify the storage zone in Citrix Endpoint Management. Don’t include a space or special characters in the name.
    - FQDN and Port: The fully qualified domain name and port number for a storage zones controller that is reachable from the Citrix Endpoint Management server.
    - Secure Connection: If you use SSL for connections to the storage zones controller, use the default setting, On. If you don’t use SSL for connections, change this setting to Off.
    - Administrator user name and Administrator password: An administrator service account user name (in the form domain\admin) and password. Else, a user account with read and write permissions on the storage zones controllers.
  3. Click Save.
  4. To test the connection, verify that the Citrix Endpoint Management server can reach the fully qualified domain name of the storage zones controller on port 443.
  5. To define another storage zones controller connection, click the Add button in Manage Storage Zones. To edit or delete the information for a storage zones controller connection, select the connection name in Manage Storage Zones. Then, click Edit or Delete.
  Add a storage zone connector in Citrix Endpoint Management
  1. Go to Configure > ShareFile and then click Add.
  2. On the Connector Info page, configure these settings:
    - Connector Name: A name that identifies the storage zone connector in Citrix Endpoint Management.
    - Description: Optional notes about this Connector.
    - Type: Choose either SharePoint or Network.
    - Storage zone: Choose the storage zone associated with the connector. If the storage zone isn’t listed, click Manage Storage Zones to define the storage zones controller.
    - Location: For SharePoint, specify the URL of the SharePoint root-level site, site collection, or document library, in the form https://sharepoint.company.com . For a network share, specify the fully qualified domain name of the Uniform Naming Convention (UNC) path, in the form \\server\share.
  3. On the Delivery Group Assignment page, optionally assign the Connector to delivery groups. Else, you can associate connectors to delivery groups using Configure > Delivery Groups.
  1. On the Summary page, you can review the options you configured. To adjust the configuration, click Back.
  2. Click Save to save the connector.
  3. Test the connector:
    1. When you wrap the Citrix Files clients, set the Network access policy to Tunneled - Web SSO. In this mode of tunneling, the MDX framework terminates SSL/HTTP traffic from an MDX app. MDX then starts new connections to internal connections for the user. This policy setting enables the MDX framework to detect and respond to authentication challenges issued by web servers.
    2. Add the Citrix Files clients to Citrix Endpoint Management. For details, see To add Citrix Files clients to Citrix Endpoint Management.
    3. From a supported device, verify single sign-on to Citrix Files and connectors.
    In the following samples, SharefileDev is the name of a connector.
    
    Filter the storage zone connectors list
    
    You can filter the list of storage zone connectors by connector type, assigned delivery groups, and storage zone.
    1. Go to Configure > ShareFile and then click Show filter.
    2. Expand the filter headings to make selections. To save a filter, click Save This View, type the filter name, and click Save.
    3. To rename or delete a filter, click the arrow icon beside the filter name.
    Switch to Enterprise account
    
    After integrating storage zone connectors with Citrix Endpoint Management, you can later switch to the full Enterprise feature set. Citrix Endpoint Management keeps your existing storage zone connector integration settings.
    
    Go to Configure > ShareFile, click the Storage Zone Connectors drop-down menu, and then click Configure ShareFile.
    
    For information about configuring Enterprise accounts, see SAML for single sign-on with Citrix Files.
    
    The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.
    
    DIESER DIENST KANN ÜBERSETZUNGEN ENTHALTEN, DIE VON GOOGLE BEREITGESTELLT WERDEN. GOOGLE LEHNT JEDE AUSDRÜCKLICHE ODER STILLSCHWEIGENDE GEWÄHRLEISTUNG IN BEZUG AUF DIE ÜBERSETZUNGEN AB, EINSCHLIESSLICH JEGLICHER GEWÄHRLEISTUNG DER GENAUIGKEIT, ZUVERLÄSSIGKEIT UND JEGLICHER STILLSCHWEIGENDEN GEWÄHRLEISTUNG DER MARKTGÄNGIGKEIT, DER EIGNUNG FÜR EINEN BESTIMMTEN ZWECK UND DER NICHTVERLETZUNG VON RECHTEN DRITTER.
    
    CE SERVICE PEUT CONTENIR DES TRADUCTIONS FOURNIES PAR GOOGLE. GOOGLE EXCLUT TOUTE GARANTIE RELATIVE AUX TRADUCTIONS, EXPRESSE OU IMPLICITE, Y COMPRIS TOUTE GARANTIE D'EXACTITUDE, DE FIABILITÉ ET TOUTE GARANTIE IMPLICITE DE QUALITÉ MARCHANDE, D'ADÉQUATION À UN USAGE PARTICULIER ET D'ABSENCE DE CONTREFAÇON.
    
    ESTE SERVICIO PUEDE CONTENER TRADUCCIONES CON TECNOLOGÍA DE GOOGLE. GOOGLE RENUNCIA A TODAS LAS GARANTÍAS RELACIONADAS CON LAS TRADUCCIONES, TANTO IMPLÍCITAS COMO EXPLÍCITAS, INCLUIDAS LAS GARANTÍAS DE EXACTITUD, FIABILIDAD Y OTRAS GARANTÍAS IMPLÍCITAS DE COMERCIABILIDAD, IDONEIDAD PARA UN FIN EN PARTICULAR Y AUSENCIA DE INFRACCIÓN DE DERECHOS.
    本服务可能包含由 Google 提供技术支持的翻译。Google 对这些翻译内容不做任何明示或暗示的保证，包括对准确性、可靠性的任何保证以及对适销性、特定用途的适用性和非侵权性的任何暗示保证。
    このサービスには、Google が提供する翻訳が含まれている可能性があります。Google は翻訳について、明示的か黙示的かを問わず、精度と信頼性に関するあらゆる保証、および商品性、特定目的への適合性、第三者の権利を侵害しないことに関するあらゆる黙示的保証を含め、一切保証しません。
    
    ESTE SERVIÇO PODE CONTER TRADUÇÕES FORNECIDAS PELO GOOGLE. O GOOGLE SE EXIME DE TODAS AS GARANTIAS RELACIONADAS COM AS TRADUÇÕES, EXPRESSAS OU IMPLÍCITAS, INCLUINDO QUALQUER GARANTIA DE PRECISÃO, CONFIABILIDADE E QUALQUER GARANTIA IMPLÍCITA DE COMERCIALIZAÇÃO, ADEQUAÇÃO A UM PROPÓSITO ESPECÍFICO E NÃO INFRAÇÃO.