diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..01d0a08 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +pkg/ diff --git a/.pmtignore b/.pmtignore new file mode 100644 index 0000000..db243cb --- /dev/null +++ b/.pmtignore @@ -0,0 +1,6 @@ +pkg/ +tests/ +assets/ +_layouts/ +_config.yml +.fixtures.yml diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..b73e4fd --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,8 @@ +# Changelog - xd7director # + +## Version 1.0.0 +- Used custom fact to retrieve domain netbios name. +- Citrix Director service account creation and SPN configuration. +- Citrix Director installation and initial configuration +- IIS SSL binding configuration. +- Initial release. diff --git a/README.markdown b/README.markdown index 8bd46c6..74dd2a8 100644 --- a/README.markdown +++ b/README.markdown @@ -9,55 +9,61 @@ The following options are available for a production-grade installation : - Security : IIS SSL configuration to secure communications between Director and the client device. - Resiliency : Deployment of a Director pool in a load-balanced environment with SPN setup and Kerberos SSO capability. +## Requirements ## +The minimum Windows Management Framework (PowerShell) version required is 5.0 or higher, which ships with Windows 10 or Windows Server 2016, but can also be installed on Windows 7 SP1, Windows 8.1, Windows Server 2008 R2 SP1, Windows Server 2012 and Windows Server 2012 R2. -## Integration informations -Director runs with service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. -All the Director nodes in a Director Pool must have their Director IIS ApplicationPool be configured with the same service account and the same SPN. - -The SSL certificate provided needs to be a password protected p12/pfx certificate including the private key. IIS HTTPS binding has to be activated manuelly with the SSL certificate deployed by puppet because of a compatibility issue between xWebsite DSC ressource and Storefront SDK powershell scripts. - -The module can be installed on a Standard, Datacenter version of Windows 2012R2 or Windows 2016. **Core version is not supported by Citrix for delivery Controller installation**. - -## Usage -### xd7director -This class will install and configure IIS and Citrix Director. -- **director_svc_username** : (string format username) : Director service account (on which Director IIS ApplicationPool will run). Use **username** format. **DO NOT** use DOMAIN\username format. -- **director_svc_password** : Password of the Director service account. Should be encrypted with hiera-eyaml. -- **setup_svc_username** : (string) Privileged account used by Puppet for installing the software. -- **setup_svc_password** : (string) Password of the privileged account. Should be encrypted with hiera-eyaml. -- **sourcePath** : (string) Path of a folder containing the Xendesktop 7.x installer (unarchive the ISO image in this folder). -- **deliveryControllers** : (String) List of Citrix Delivery Controllers of the XenDesktop7 site 'srv-cxdc01.domain.net, srv-cxdc012.domain.net' -- **domainName** : (string) Active Directory domain name (full) -- **domainNetbiosName** : (string) : Active Directory domain NETBIOS name. -- **loadbalandedDirector** : true or false. Is Director deployed behind a load-balancer ? Default : false -- **loadbalancedDirectorFqdn** (string)(optionnal) FQDN of the Director pool associated to the virtual server IP configured on the loadbalancer -- **https** : (boolean) : true or false. Deploy SSL certificate on IIS and activate SSL access to Storefront ? Default : false -- **sslCertificateSourcePath** : (string) Location of the SSL certificate (p12 / PFX format with private key). Can be local folder, UNC path, HTTP URL) -- **sslCertificatePassword** : (string) Password protecting the p12/pfx SSL certificate file. -- **sslCertificateThumbprint** : (string) Thumbprint of the SSL certificate (available in the SSL certificate). -- **caCertificateSourcePath** : (string) Location of the SSL Certification Autority root certificate (PEM or CER format). Can be local folder, UNC path, HTTP URL) -- **caCertificateThumbprint** : (string) Thumbprint of the SSL Certification Autority root certificate (available in the SSL certificate). +This module requires a custom version of the puppetlabs-dsc module compiled with [XenDesktop7](https://github.com/VirtualEngine/XenDesktop7) Powershell DSC resource as a dependency. Ready to use virtualdesktopdevops/dsc v1.5.0 puppet module provided on [Puppet Forge](https://forge.puppet.com/virtualdesktopdevops/dsc). +## Change log ## + +A full list of changes in each version can be found in the [change log](CHANGELOG.md). + + +## Integration informations ## +Citrix Director runs with the identity of a service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. +All the Director nodes in a Director Pool must have their Director IIS ApplicationPool be configured to use the same service account and the same SPN. + +The module can be installed on a Standard, Datacenter version of Windows 2012R2 or Windows 2016. **Core version is not supported by Citrix for Director installation**. + +Puppet example code has been updated to future parser syntax (4.x). All the parameters refering to remote locations (file shares) have to be prefixed with \\\\ instead of the classical \\. This is because of Puppet >= 4.x parsing \\ as a single \ in single-quoted strings. Use parser = future in puppet 3.x /etc/puppet/puppet.conf to use this module in your existing Puppet 3.x deployment and prepare Puppet 4.x migration. + +## Usage ## +### xd7director parameters### + +- **`[String]` director_svc_username** _(Required)_: Director service account (on which Director IIS ApplicationPool will run). Use **username** format. **DO NOT** use DOMAIN\username format. +- **`[String]` director_svc_password** _(Required)_: Password of the Director service account. Should be encrypted with hiera-eyaml. +- **`[String]` setup_svc_username** _(Required)_: Privileged account used by Puppet for installing the software. +- **`[String]` setup_svc_password** _(Required)_: Password of the privileged account. Should be encrypted with hiera-eyaml. +- **`[String]` sourcepath** _(Required)_: Path of a folder containing the Xendesktop 7.x installer (unarchive the ISO image in this folder). +- **`[String]` deliverycontrollers** _(Required)_: List of Citrix Delivery Controllers of the XenDesktop7 site 'srv-cxdc01.domain.net, srv-cxdc012.domain.net' +- **`[Boolean]` loadbalandeddirector** _(Optional, default is false)_: Is Director deployed behind a load-balancer ? Default : false +- **`[String]` loadbalanceddirectorfqdn** _(Required, if loadbalandeddirector = true)_: FQDN of the Director pool associated to the virtual server IP configured on the loadbalancer +- **`[Boolean]` https** _(Optional, default is false)_: Deploy SSL certificate on IIS and activate SSL access to Storefront ? Default : false +- **`[String]` sslcertificatesourcepath** _(Required if https = true)_: Location of the SSL certificate (p12 / PFX format with private key). Can be local folder, UNC path, HTTP URL) +- **`[String]` sslcertificatepassword** _(Required if https = true)_: Password protecting the p12/pfx SSL certificate file. +- **`[String]` sslcertificatethumbprint** _(Required if https = true)_: Thumbprint of the SSL certificate (available in the SSL certificate). +- **`[String]` cacertificatesourcepath** _(Required if https = true)_: Location of the SSL Certification Autority root certificate (PEM or CER format). Can be local folder, UNC path, HTTP URL) +- **`[String]` cacertificatethumbprint** _(Required if https = true)_: Thumbprint of the SSL Certification Autority root certificate (available in the SSL certificate). + +### xd7director example code### ~~~puppet node 'director' { - class{'xd7director': - director_svc_username => 'svc-director', - director_svc_password => 'P@ssw0rd', - setup_svc_username => 'TESTLAB\svc-puppet', - setup_svc_password => 'P@ssw0rd', - sourcepath => '\\fileserver\xendesktop715', - deliverycontrollers => 'srv-cxdc01.testlab.com, srv-cxdc02.testlab.com', - domainName => 'TESTLAB.COM', - domainNetbiosName=> 'TESTLAB', - loadbalandedDirector => true, - loadbalancedDirectorFqdn => 'director.testlab.com', - https => true, - sslCertificateSourcePath => '\\fileserver\ssl\cxdirector.pfx', - sslCertificatePassword => 'P@ssw0rd', - sslCertificateThumbprint => '44cce73845feef4da4d369a37386c862eb3bd4e1', - caCertificateSourcePath => '\\fileserver\ssl\ca-root.pem', - caCertificateThumbprint => '48jise7dssdsd4da4d369a3738dsdsdeeb3sdiu3' - } + class{'xd7director': + director_svc_username => 'svc-director', + director_svc_password => 'P@ssw0rd', + setup_svc_username => 'TESTLAB\svc-puppet', + setup_svc_password => 'P@ssw0rd', + sourcepath => '\\\\fileserver\\xendesktop715', + deliverycontrollers => 'srv-cxdc01.testlab.com, srv-cxdc02.testlab.com', + loadbalandeddirector => true, + loadbalanceddirectorfqdn => 'director.testlab.com', + https => true, + sslcertificatesourcepath => '\\\\fileserver\\ssl\\cxdirector.pfx', + sslcertificatepassword => 'P@ssw0rd', + sslcertificatethumbprint => '44cce73845feef4da4d369a37386c862eb3bd4e1', + cacertificatesourcepath => '\\\\fileserver\\ssl\\ca-root.pem', + cacertificatethumbprint => '48jise7dssdsd4da4d369a3738dsdsdeeb3sdiu3' + } } ~~~ diff --git a/_config.yml b/_config.yml index c741881..30cede3 100644 --- a/_config.yml +++ b/_config.yml @@ -1 +1,13 @@ -theme: jekyll-theme-slate \ No newline at end of file +title: Citrix Xendesktop 7.x Director puppet module +description: Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp/XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface. +google_site_verification: R71XDERzPOp9lUudi8X6iKrpcoIgDG_1HzRMz_TMaDY +google_analytics: UA-12767493-6 +theme: jekyll-theme-slate +plugins: + - jekyll-seo-tag + - jekyll-sitemap + - jekyll-feed + - jekyll-redirect-from + - jekyll-mentions +jekyll-mentions: + base_url: http://www.virtualdesktopdevops.com \ No newline at end of file diff --git a/_layouts/default.html b/_layouts/default.html new file mode 100644 index 0000000..639fb46 --- /dev/null +++ b/_layouts/default.html @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + +{% seo %} + + + + + +
+
+ View on GitHub + +

{{ site.title | default: site.github.repository_name }}

+

{{ site.description | default: site.github.project_tagline }}

+ + {% if site.show_downloads %} +
+ Download this project as a .zip file + Download this project as a tar.gz file +
+ {% endif %} +
+
+ + +
+
+
+
+
+ {{ content }} +
+
+ + + + +
+
+
+
+
+ + + + + {% if site.google_analytics %} + + {% endif %} + + diff --git a/assets/css/style.scss b/assets/css/style.scss new file mode 100644 index 0000000..d9d36bc --- /dev/null +++ b/assets/css/style.scss @@ -0,0 +1,11 @@ +--- +--- + +@import "{{ site.theme }}"; + +.inner { + position: relative; + max-width: 1200px; + padding: 20px 10px; + margin: 0 auto; +} diff --git a/files/applicationHost.config b/files/applicationHost.config deleted file mode 100644 index d6b35d0..0000000 --- a/files/applicationHost.config +++ /dev/null @@ -1,987 +0,0 @@ - - - - - - - - -
-
-
-
-
-
-
-
- - - -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -
-
- -
-
-
-
-
-
- -
-
-
-
-
- -
-
-
- -
-
- -
-
- -
-
-
- -
- - -
-
-
-
- -
-
-
-
- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/files/directorAppPool.xml b/files/directorAppPool.xml deleted file mode 100644 index 92c447d..0000000 --- a/files/directorAppPool.xml +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/files/web.config b/files/web.config deleted file mode 100644 index 41fbde8..0000000 --- a/files/web.config +++ /dev/null @@ -1,416 +0,0 @@ - - - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/lib/facter/domainnetbiosname.rb b/lib/facter/domainnetbiosname.rb new file mode 100644 index 0000000..13625c3 --- /dev/null +++ b/lib/facter/domainnetbiosname.rb @@ -0,0 +1,15 @@ +#https://puppet.com/blog/starting-out-writing-custom-facts-windows +Facter.add('domainnetbiosname') do + confine :osfamily => :windows + setcode do + begin + require 'win32ole' + dnsforestname = Facter.value(:domain) + wmi = WIN32OLE.connect("winmgmts:\\\\.\\root\\cimv2") + win32ntdomain = wmi.ExecQuery("SELECT * FROM Win32_NTDomain WHERE DnsForestName='#{dnsforestname}'").each.first + win32ntdomain.DomainName + rescue + nil + end + end +end diff --git a/manifests/config.pp b/manifests/config.pp index 3aebaf5..89a3dfa 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -1,61 +1,62 @@ +#Class configuring IIS and Director class xd7director::config inherits xd7director { - + #Pairing Director to Delivery Controllers dsc_xwebconfigkeyvalue{ 'ServiceAutoDiscovery': dsc_configsection => 'AppSettings', - dsc_key => 'Service.AutoDiscoveryAddresses', - dsc_value => $deliveryControllers, - dsc_isattribute => false, - dsc_websitepath => 'IIS:\Sites\Default Web Site\Director' + dsc_key => 'Service.AutoDiscoveryAddresses', + dsc_value => $xd7director::deliverycontrollers, + dsc_isattribute => false, + dsc_websitepath => 'IIS:\Sites\Default Web Site\Director' } - + #Configue Director ApplicationPool service account - dsc_xwebapppool{'DirectorAppPool': - dsc_name => 'Director', - dsc_ensure => 'Present', - dsc_autostart => true, - dsc_enable32bitapponwin64 => false, - dsc_managedruntimeversion => 'v4.0', - dsc_managedpipelinemode => 'Integrated', - dsc_disallowoverlappingrotation => true, - dsc_disallowrotationonconfigchange => true, - dsc_restartschedule => ['00:00:00'], - dsc_identitytype => 'SpecificUser', - dsc_credential => {'user' => "${domainNetbiosName}\\${director_svc_username}", 'password' => $director_svc_password}, - dsc_state => 'Started', - } - + dsc_xwebapppool{'DirectorAppPool': + dsc_name => 'Director', + dsc_ensure => 'Present', + dsc_autostart => true, + dsc_enable32bitapponwin64 => false, + dsc_managedruntimeversion => 'v4.0', + dsc_managedpipelinemode => 'Integrated', + dsc_disallowoverlappingrotation => true, + dsc_disallowrotationonconfigchange => true, + dsc_restartschedule => ['00:00:00'], + dsc_identitytype => 'SpecificUser', + dsc_credential => { + 'user' => "${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", + 'password' => $xd7director::director_svc_password}, + dsc_state => 'Started', + } + #Changing authentication mode to use ApplicationPool dsc_script{ 'DirectorUseAppPoolCredentials': - dsc_getscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' + dsc_getscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' return @{ Result = $useAppPoolCredentials.Value }', - dsc_testscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' + dsc_testscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' return (\'true\' -eq $useAppPoolCredentials.Value)', - dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' -value \'true\'' + dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' -value \'true\'' } #Disable kernel mode authentication dsc_script{ 'DirectorDisableKernelMode': - dsc_getscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' + dsc_getscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' return @{ Result = $useKernelMode.Value }', dsc_testscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' return (\'false\' -eq $useKernelMode.Value)', - dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' -value \'false\'' - } - + dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' -value \'false\'' + } + #Redirect from default IIS page to Director - if $https { - file{'c:/inetpub/wwwroot/DirectorHomePage.html': + if $xd7director::https { + file{'c:/inetpub/wwwroot/index.html': ensure => file, - content => template('xd7director/director_https.erb') + content => template('xd7director/director_https.erb') } } else { - file{'c:/inetpub/wwwroot/DirectorHomePage.html': + file{'c:/inetpub/wwwroot/index.html': ensure => file, - content => template('xd7director/director_http.erb') + content => template('xd7director/director_http.erb') } - } - - -} \ No newline at end of file + } +} diff --git a/manifests/init.pp b/manifests/init.pp index 29bab7f..cca25a3 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -11,22 +11,20 @@ # Sample Usage: # class xd7director ( - $director_svc_username, - $director_svc_password, - $setup_svc_username, - $setup_svc_password, - $sourcePath = 'C:\\XD715', - $deliveryControllers = 'srv-cxdc01, srv-cxdc02', - $domainName, - $domainNetbiosName='TESTLAB', - $loadbalandedDirector = false, - $loadbalancedDirectorFqdn = '', - $https = false, - $sslCertificateSourcePath = '', - $sslCertificatePassword = '', - $sslCertificateThumbprint = '', - $caCertificateSourcePath = '', - $caCertificateThumbprint = '' + String $director_svc_username, + String $director_svc_password, + String $setup_svc_username, + String $setup_svc_password, + String $sourcepath, + String $deliverycontrollers, + Optional[Boolean] $loadbalandeddirector = false, + Optional[String] $loadbalanceddirectorfqdn = '', + Optional[Boolean] $https = false, + Optional[String] $sslcertificatesourcepath = '', + Optional[String] $sslcertificatepassword = '', + Optional[String] $sslcertificatethumbprint = '', + Optional[String] $cacertificatesourcepath = '', + Optional[String] $cacertificatethumbprint = '' ) { @@ -34,16 +32,15 @@ contain xd7director::serviceaccounts contain xd7director::config contain xd7director::sslconfig - - #Install Sirector & IIS before configuring the service account (IIS_IUSRS group needed in serviceaccounts.pp) - Class['::xd7director::install'] -> - Class['::xd7director::serviceaccounts'] -> - Class['::xd7director::config'] -> - Class['::xd7director::sslconfig'] - + + #Install Director & IIS before configuring the service account (IIS_IUSRS group needed in serviceaccounts.pp) + Class['::xd7director::install'] +->Class['::xd7director::serviceaccounts'] +->Class['::xd7director::config'] +->Class['::xd7director::sslconfig'] + reboot { 'dsc_reboot': when => pending, timeout => 15, } } - diff --git a/manifests/install.pp b/manifests/install.pp index c601e2b..fe6185a 100644 --- a/manifests/install.pp +++ b/manifests/install.pp @@ -1,10 +1,11 @@ +#Class installing Citrix Director class xd7director::install inherits xd7director { - - #Install Citrix Director - dsc_xd7feature { 'XD7Director': - dsc_role => 'Director', - dsc_sourcepath => $sourcePath, - dsc_ensure => 'present' - } -} \ No newline at end of file + #Install Citrix Director + dsc_xd7feature { 'XD7Director': + dsc_role => 'Director', + dsc_sourcepath => $xd7director::sourcepath, + dsc_ensure => 'present' + } + +} diff --git a/manifests/serviceaccounts.pp b/manifests/serviceaccounts.pp index 93d69fa..3f46c64 100644 --- a/manifests/serviceaccounts.pp +++ b/manifests/serviceaccounts.pp @@ -1,62 +1,63 @@ +#Class configuring Citrix Director service account and associated SPN in Active Directory class xd7director::serviceaccounts inherits xd7director { #Needed for ActiveDirectory remote management using Powershell - dsc_windowsfeature{ 'RSAT-AD-Powershell': - dsc_ensure => 'Present', - dsc_name => 'RSAT-AD-Powershell' - } - - #Director service account creation (Active Directory) - dsc_xaduser{'SvcDirectorAccount': - dsc_domainname => $domainName, - dsc_domainadministratorcredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - dsc_username => $director_svc_username, - dsc_password => {'user' => $director_svc_username, 'password' => $director_svc_password}, - dsc_ensure => 'Present', - require => Dsc_windowsfeature['RSAT-AD-Powershell'] - } - - #Configure SPN on Director service account - #In A load-balanced deployment, the SPN is linked to the FQDN of the Director virtual server configured on the load-balancer - if $loadbalandedDirector { - dsc_xadserviceprincipalname{'DirectorLoadBalancedSPN': - dsc_account => $director_svc_username, - dsc_serviceprincipalname => "http/${loadbalancedDirectorFqdn}", - dsc_ensure => present, - dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - require => Dsc_xaduser['SvcDirectorAccount'] - } - } - #In a standalone deployment, the SPN is linked to the computer FQDN - else { - dsc_xadserviceprincipalname{'DirectorStandaloneSPN': - dsc_account => $director_svc_username, - dsc_serviceprincipalname => "http/${fqdn}", - dsc_ensure => present, - dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - require => Dsc_xaduser['SvcDirectorAccount'] + dsc_windowsfeature{ 'RSAT-AD-Powershell': + dsc_ensure => 'Present', + dsc_name => 'RSAT-AD-Powershell' + } + + #Director service account creation (Active Directory) + dsc_xaduser{'SvcDirectorAccount': + dsc_domainname => $facts['domain'], + dsc_domainadministratorcredential => {'user' => $xd7director::setup_svc_username, 'password' => $xd7director::setup_svc_password}, + dsc_username => $xd7director::director_svc_username, + dsc_password => {'user' => $xd7director::director_svc_username, 'password' => $xd7director::director_svc_password}, + dsc_ensure => 'Present', + require => Dsc_windowsfeature['RSAT-AD-Powershell'] + } + + #Configure SPN on Director service account + #In A load-balanced deployment, the SPN is linked to the FQDN of the Director virtual server configured on the load-balancer + if $xd7director::loadbalandeddirector { + dsc_xadserviceprincipalname{'DirectorLoadBalancedSPN': + dsc_account => $xd7director::director_svc_username, + dsc_serviceprincipalname => "http/${xd7director::loadbalanceddirectorfqdn}", + dsc_ensure => present, + dsc_psdscrunascredential => {'user' => $xd7director::setup_svc_username, 'password' => $xd7director::setup_svc_password}, + require => Dsc_xaduser['SvcDirectorAccount'] + } + } + #In a standalone deployment, the SPN is linked to the computer FQDN + else { + dsc_xadserviceprincipalname{'DirectorStandaloneSPN': + dsc_account => $xd7director::director_svc_username, + dsc_serviceprincipalname => "http/${facts['fqdn']}", + dsc_ensure => present, + dsc_psdscrunascredential => {'user' => $xd7director::setup_svc_username, 'password' => $xd7director::setup_svc_password}, + require => Dsc_xaduser['SvcDirectorAccount'] } - } - - #Add service accounts to local admins IIS_IUSRS group (local machine) - dsc_xgroup{'SvcDirectorIISGroup': - dsc_groupname => 'IIS_IUSRS', - dsc_ensure => 'Present', - dsc_memberstoinclude => "$domainNetbiosName\\$director_svc_username", - #dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - require => Dsc_xaduser['SvcDirectorAccount'] - } - - #Grant "Log on as a batch job" and "Impersonate a client after authentication" to Director service account - dsc_userrightsassignment{'AssignLogOnAsBatchToDirector': - dsc_policy => 'Log_on_as_a_batch_job', - dsc_identity => ["$domainNetbiosName\\$director_svc_username", 'Administrators', 'Backup Operators', 'Performance Log Users'], - require => Dsc_xaduser['SvcDirectorAccount'] } - - dsc_userrightsassignment{'AssignImpersonateAfterAuthenticationToDirector': - dsc_policy => 'Impersonate_a_client_after_authentication', - dsc_identity => ["$domainNetbiosName\\$director_svc_username", 'Administrators', 'Local Service', 'Network Service', 'Service'], - require => Dsc_xaduser['SvcDirectorAccount'] + + #Add service accounts to local admins IIS_IUSRS group (local machine) + dsc_xgroup{'SvcDirectorIISGroup': + dsc_groupname => 'IIS_IUSRS', + dsc_ensure => 'Present', + dsc_memberstoinclude => "${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", + #dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, + require => Dsc_xaduser['SvcDirectorAccount'] + } + + #Grant "Log on as a batch job" and "Impersonate a client after authentication" to Director service account + dsc_userrightsassignment{'AssignLogOnAsBatchToDirector': + dsc_policy => 'Log_on_as_a_batch_job', + dsc_identity => ["${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", 'Administrators', 'Backup Operators', 'Performance Log Users'], + require => Dsc_xaduser['SvcDirectorAccount'] + } + + dsc_userrightsassignment{'AssignImpersonateAfterAuthenticationToDirector': + dsc_policy => 'Impersonate_a_client_after_authentication', + dsc_identity => ["${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", 'Administrators', 'Local Service', 'Network Service', 'Service'], + require => Dsc_xaduser['SvcDirectorAccount'] } - -} \ No newline at end of file + +} diff --git a/manifests/sslconfig.pp b/manifests/sslconfig.pp index fb479f6..867b547 100644 --- a/manifests/sslconfig.pp +++ b/manifests/sslconfig.pp @@ -1,55 +1,59 @@ +#Class configuring SSL secured access to Citrix Director class xd7director::sslconfig inherits xd7director { - if $https { - if ($caCertificateSourcePath != '') { - #Import and install CA certificate in LocalMachine Root store - dsc_file{ 'CACert': - dsc_sourcepath => $caCertificateSourcePath, - dsc_destinationpath => 'c:\SSL\ca.pem', - dsc_type => 'File' - } - - dsc_xcertificateimport{ 'ImportCACert': - dsc_thumbprint => $caCertificateThumbprint, - dsc_path => 'c:\SSL\ca.pem', - dsc_location => 'LocalMachine', - dsc_store => 'Root', - require => Dsc_file['CACert'] - } + if $xd7director::https { + if ($xd7director::cacertificatesourcepath != '') { + #Import and install CA certificate in LocalMachine Root store + dsc_file{ 'CACert': + dsc_sourcepath => $xd7director::cacertificatesourcepath, + dsc_destinationpath => 'c:\SSL\ca.pem', + dsc_type => 'File' + } + + dsc_xcertificateimport{ 'ImportCACert': + dsc_thumbprint => $xd7director::cacertificatethumbprint, + dsc_path => 'c:\SSL\ca.pem', + dsc_location => 'LocalMachine', + dsc_store => 'Root', + require => Dsc_file['CACert'] + } } - + #Import and install server certificate dsc_file{ 'SSLCert': - dsc_sourcepath => $sslCertificateSourcePath, + dsc_sourcepath => $xd7director::sslcertificatesourcepath, dsc_destinationpath => 'c:\SSL\cert.pfx', - dsc_type => 'File' + dsc_type => 'File' } - + dsc_xpfximport{ 'ImportSSLCert': - dsc_thumbprint => $sslCertificateThumbprint, - dsc_path => 'c:\SSL\cert.pfx', - dsc_location => 'LocalMachine', - dsc_store => 'WebHosting', - dsc_credential => {'user' => 'cert', 'password' => $sslCertificatePassword }, - require => Dsc_file['SSLCert'] + dsc_thumbprint => $xd7director::sslcertificatethumbprint, + dsc_path => 'c:\SSL\cert.pfx', + dsc_location => 'LocalMachine', + dsc_store => 'WebHosting', + dsc_credential => {'user' => 'cert', 'password' => $xd7director::sslcertificatepassword }, + require => Dsc_file['SSLCert'] } - - dsc_xwebsite{ 'DefaultWebSiteSSL': - dsc_name => 'Default Web Site', + + dsc_xwebsite{ 'DefaultWebSiteSSL': + dsc_name => 'Default Web Site', dsc_bindinginfo => [ - { protocol => 'HTTPS', port => '443', certificatethumbprint => $sslCertificateThumbprint, certificatestorename => 'WebHosting' } + { protocol => 'https', + port => '443', + certificatethumbprint => $xd7director::sslcertificatethumbprint, + certificatestorename => 'WebHosting' } ], - require => Dsc_xpfximport['ImportSSLCert'] + require => Dsc_xpfximport['ImportSSLCert'] } - + } else { - dsc_xwebsite{ 'DefaultWebSite': - dsc_name => 'Default Web Site', - #dsc_physicalpath => '%SystemDrive%\inetpub\wwwroot', - dsc_bindinginfo => [ - { protocol => 'HTTP', port => '80'} - ], - } - } + dsc_xwebsite{ 'DefaultWebSite': + dsc_name => 'Default Web Site', + dsc_bindinginfo => [ + { protocol => 'http', + port => '80'} + ], + } + } } diff --git a/metadata.json b/metadata.json index 9586e48..3180562 100644 --- a/metadata.json +++ b/metadata.json @@ -1,13 +1,13 @@ { - "author": "citrixdeployment", + "author": "virtualdesktopdevops", "dependencies": [ - { - "name": "puppetlabs/dsc", - "version_requirement": ">= 1.4.0" + { + "name": "virtualdesktopdevops/dsc", + "version_requirement": ">= 1.5.0" } ], "license": "Apache-2.0", - "name": "citrixdeployment-xd7director", + "name": "virtualdesktopdevops-xd7director", "operatingsystem_support": [ { "operatingsystem": "windows", @@ -17,15 +17,16 @@ ] } ], - "project_page": "https://www.citrixdeployment.com", + "project_page": "https://www.virtualdesktopdevops.com", "requirements": [ { "name": "puppet", - "version_requirement": ">= 3.8.0 < 6.0.0" + "version_requirement": ">= 4.0.0 < 6.0.0" } ], - "source": "https://www.citrixdeployment.com", - "summary": "Xendesktop 7.x Director installation & linking to an existing XenApp/XenDesktop deployment", + "source": "https://www.virtualdesktopdevops.com", + "issues_url": "https://github.com/virtualdesktopdevops/xd7director/issues", + "summary": "Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp / XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface.", "tags": [ "powershell", "dsc", @@ -34,4 +35,4 @@ "director" ], "version": "1.0.0" -} \ No newline at end of file +}