| If you will be installing MetaFrame Secure Access Manager 2.0 servers on Windows Server 2003 then you will be happy to know that the previous workarounds for installing Microsoft Windows Server 2003 servers have been resolved with Service Pack 1 for MetaFrame Secure Access Manager. To install MetaFrame Secure Access Manager on a Windows Server 2003 server all you need to do is install MetaFrame Secure Access Manager, as documented above, and then install Service Pack 1 for MetaFrame Secure Access Manager. The installation of Service Pack 1 migrates your configurations and adjusts them to function correctly for 2003 compatibility. Since IIS 6.0 provides additional security; there where a few settings in the IIS Manager that needed to be modified in order to allow execution of ISAPI extensions. By default, ISAPI Extensions and Common Gateway Interfaces did not work unless they are enabled. Host.dll is an ISAPI extension that required to be enabled in order to process MetaFrame Secure Access Manager requests. Again, Service Pack 1 for MetaFrame Secure Access Manager addressed these issues. If however you would like to verify the changes made to support the additional security enhancements in IIS 6.0 you will want to following the steps below. 1. The first thing we will need to do is install and configure Install Internet Information Server 6.0 (IIS) a. Start Manage your Server Add or remove a role b. Select Application Server, and choose ASP.NET (You might be prompted for a Windows Server 2003 CDROM) 2. Install Microsoft .NET Framework 1.0 with Service Pack 2. For more information of how to install .NET Framework please refer to section 3.1.4 How to Install Microsoft .NET Framework found earlier in this document. 3. Register .Net Framework 1.0 and .NET Framework Service Pack 2. in the IIS Manager a. In IIS Manager, right-click Web Service Extensions Add a new web service extension b. Enter title as ASP.NET v1.0.3705 c. Add following file: c:\windows\microsoft.net\framework\v1.0.3705\aspnet_isapi.dll d. Select Set extension status to Allowed 4. Add a new Application Pool in IIS a. In IIS Manager, right-click Application Pools New Application Pool b. Enter title as MSAM_Pool c. Choose Use existing application pool as template DefaultAppPool d. Next, right-click MSAM_Pool Properties and click on Identity tab. e. Choose Configurable and enter the service account credentials you plan on using for your MetaFrame Secure Access Manager installation. 5. Install MetaFrame Secure Access Manager, as detailed earlier in this section; make sure to use the same service account that was entered in your MSAM_Pool Application Pool in IIS. 6. You need to register the Host.DLL needs to be registered in IIS. Important! This needs to be done on every MetaFrame Secure Access Manager server in the farm. a. In IIS Manager, right-click Web Service Extensions Add a new web service extension b. Enter title as host.dll c. Add following file: C:\ Program Files\Citrix\MetaFrame Secure Access Manager\Bin\host.dll d. Select Set extension status to Allowed
7. After creating an Access Center, the Application Pool needs to be set for its IIS virtual directory. By default, MetaFrame Secure Access Manager runs in-proc with a worker process from the Default pool. The user (Identity) under which this pool runs has limited access rights, thereby restricting access to critical resources on the web server. This prevents the Load Balancer from getting configuration information thereby getting an access denied COM error. To resolve this issue, we can create a new application pool and change its user (identity) to run under the MetaFrame Secure Access Manager service account. Follow the below steps to create a new application pool. Important! This needs to be done on every MetaFrame Secure Access Manager server in the farm. a. In IIS Manager, under Web Sites Default Web Site, right-click on the access center name you created and select Properties. b. Select Application Pool MSAM_Pool Note: If you disable the Web Service for a given server in Access Management Console, your Application Pool settings are reverted back to DefaultAppPool (only on that server), and will need to be reconfigured if you re-enable the Web Service for EVERY access center you create.
|