From 1166320e1bcab3838f54f21935aefc13fdd3500d Mon Sep 17 00:00:00 2001 From: matt6697 <32440697+matt6697@users.noreply.github.com> Date: Thu, 14 Dec 2017 18:32:24 +0100 Subject: [PATCH 1/5] Wrong redirection from default IIS page to director, unneeded dev files removal --- files/applicationHost.config | 987 ----------------------------------- files/directorAppPool.xml | 41 -- files/web.config | 416 --------------- manifests/config.pp | 4 +- 4 files changed, 2 insertions(+), 1446 deletions(-) delete mode 100644 files/applicationHost.config delete mode 100644 files/directorAppPool.xml delete mode 100644 files/web.config diff --git a/files/applicationHost.config b/files/applicationHost.config deleted file mode 100644 index d6b35d0..0000000 --- a/files/applicationHost.config +++ /dev/null @@ -1,987 +0,0 @@ - - - - - - - - -
-
-
-
-
-
-
-
- - - -
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
- -
-
- -
-
-
-
-
-
- -
-
-
-
-
- -
-
-
- -
-
- -
-
- -
-
-
- -
- - -
-
-
-
- -
-
-
-
- -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/files/directorAppPool.xml b/files/directorAppPool.xml deleted file mode 100644 index 92c447d..0000000 --- a/files/directorAppPool.xml +++ /dev/null @@ -1,41 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/files/web.config b/files/web.config deleted file mode 100644 index 41fbde8..0000000 --- a/files/web.config +++ /dev/null @@ -1,416 +0,0 @@ - - - - - -
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/manifests/config.pp b/manifests/config.pp index 3aebaf5..aeb56d6 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -45,13 +45,13 @@ #Redirect from default IIS page to Director if $https { - file{'c:/inetpub/wwwroot/DirectorHomePage.html': + file{'c:/inetpub/wwwroot/index.html': ensure => file, content => template('xd7director/director_https.erb') } } else { - file{'c:/inetpub/wwwroot/DirectorHomePage.html': + file{'c:/inetpub/wwwroot/index.html': ensure => file, content => template('xd7director/director_http.erb') } From 25106b1271fefc83dc62a06bbf068f1c45a56c7c Mon Sep 17 00:00:00 2001 From: matt6697 <32440697+matt6697@users.noreply.github.com> Date: Thu, 1 Feb 2018 18:49:28 +0100 Subject: [PATCH 2/5] Changelog, custom fact, init.pp cleaning, removed unrelevant readme parts Changelog + replaced $domainName and $domainNetbiosName by custom facts Removed unrelevant readme parts Examplle migrated to Puppet 4.x --- CHANGELOG.md | 5 +++++ README.markdown | 14 ++++++-------- lib/facter/domainnetbiosname.rb | 15 +++++++++++++++ manifests/config.pp | 22 +++++++++++----------- manifests/init.pp | 13 +++++-------- manifests/serviceaccounts.pp | 28 ++++++++++++++-------------- 6 files changed, 56 insertions(+), 41 deletions(-) create mode 100644 CHANGELOG.md create mode 100644 lib/facter/domainnetbiosname.rb diff --git a/CHANGELOG.md b/CHANGELOG.md new file mode 100644 index 0000000..69cb5d0 --- /dev/null +++ b/CHANGELOG.md @@ -0,0 +1,5 @@ +# Changelog - xd7director # + +## Unreleased +- **BREAKING CHANGE** : Removed $domainName class parameter. Used facts instead. +- **BREAKING CHANGE** : Removed $domainNetbiosName class parameter. Used custom fact instead. diff --git a/README.markdown b/README.markdown index 8bd46c6..fe8994b 100644 --- a/README.markdown +++ b/README.markdown @@ -15,21 +15,19 @@ The following options are available for a production-grade installation : Director runs with service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. All the Director nodes in a Director Pool must have their Director IIS ApplicationPool be configured with the same service account and the same SPN. -The SSL certificate provided needs to be a password protected p12/pfx certificate including the private key. IIS HTTPS binding has to be activated manuelly with the SSL certificate deployed by puppet because of a compatibility issue between xWebsite DSC ressource and Storefront SDK powershell scripts. +The module can be installed on a Standard, Datacenter version of Windows 2012R2 or Windows 2016. **Core version is not supported by Citrix for Director installation**. -The module can be installed on a Standard, Datacenter version of Windows 2012R2 or Windows 2016. **Core version is not supported by Citrix for delivery Controller installation**. +Migrated puppet example code in README.md to future parser syntax (4.x). Impact on parameters refering to remote locations (file shares) which have to be prefixed with \\\\ instead of the classical \\. This is because of Puppet >= 4.x parsing \\ as a single \ in single-quoted strings. Use parser = future in puppet 3.x /etc/puppet/puppet.conf to use this new configuration in your Puppet 3.x and prepare Puppet 4.x migration. ## Usage ### xd7director -This class will install and configure IIS and Citrix Director. +This class will install and configure IIS and Citrix Director. - **director_svc_username** : (string format username) : Director service account (on which Director IIS ApplicationPool will run). Use **username** format. **DO NOT** use DOMAIN\username format. - **director_svc_password** : Password of the Director service account. Should be encrypted with hiera-eyaml. - **setup_svc_username** : (string) Privileged account used by Puppet for installing the software. - **setup_svc_password** : (string) Password of the privileged account. Should be encrypted with hiera-eyaml. - **sourcePath** : (string) Path of a folder containing the Xendesktop 7.x installer (unarchive the ISO image in this folder). - **deliveryControllers** : (String) List of Citrix Delivery Controllers of the XenDesktop7 site 'srv-cxdc01.domain.net, srv-cxdc012.domain.net' -- **domainName** : (string) Active Directory domain name (full) -- **domainNetbiosName** : (string) : Active Directory domain NETBIOS name. - **loadbalandedDirector** : true or false. Is Director deployed behind a load-balancer ? Default : false - **loadbalancedDirectorFqdn** (string)(optionnal) FQDN of the Director pool associated to the virtual server IP configured on the loadbalancer - **https** : (boolean) : true or false. Deploy SSL certificate on IIS and activate SSL access to Storefront ? Default : false @@ -46,17 +44,17 @@ node 'director' { director_svc_password => 'P@ssw0rd', setup_svc_username => 'TESTLAB\svc-puppet', setup_svc_password => 'P@ssw0rd', - sourcepath => '\\fileserver\xendesktop715', + sourcepath => '\\\\fileserver\\xendesktop715', deliverycontrollers => 'srv-cxdc01.testlab.com, srv-cxdc02.testlab.com', domainName => 'TESTLAB.COM', domainNetbiosName=> 'TESTLAB', loadbalandedDirector => true, loadbalancedDirectorFqdn => 'director.testlab.com', https => true, - sslCertificateSourcePath => '\\fileserver\ssl\cxdirector.pfx', + sslCertificateSourcePath => '\\\\fileserver\\ssl\\cxdirector.pfx', sslCertificatePassword => 'P@ssw0rd', sslCertificateThumbprint => '44cce73845feef4da4d369a37386c862eb3bd4e1', - caCertificateSourcePath => '\\fileserver\ssl\ca-root.pem', + caCertificateSourcePath => '\\\\fileserver\\ssl\\ca-root.pem', caCertificateThumbprint => '48jise7dssdsd4da4d369a3738dsdsdeeb3sdiu3' } } diff --git a/lib/facter/domainnetbiosname.rb b/lib/facter/domainnetbiosname.rb new file mode 100644 index 0000000..13625c3 --- /dev/null +++ b/lib/facter/domainnetbiosname.rb @@ -0,0 +1,15 @@ +#https://puppet.com/blog/starting-out-writing-custom-facts-windows +Facter.add('domainnetbiosname') do + confine :osfamily => :windows + setcode do + begin + require 'win32ole' + dnsforestname = Facter.value(:domain) + wmi = WIN32OLE.connect("winmgmts:\\\\.\\root\\cimv2") + win32ntdomain = wmi.ExecQuery("SELECT * FROM Win32_NTDomain WHERE DnsForestName='#{dnsforestname}'").each.first + win32ntdomain.DomainName + rescue + nil + end + end +end diff --git a/manifests/config.pp b/manifests/config.pp index aeb56d6..7d9f504 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -1,5 +1,5 @@ class xd7director::config inherits xd7director { - + #Pairing Director to Delivery Controllers dsc_xwebconfigkeyvalue{ 'ServiceAutoDiscovery': dsc_configsection => 'AppSettings', @@ -8,7 +8,7 @@ dsc_isattribute => false, dsc_websitepath => 'IIS:\Sites\Default Web Site\Director' } - + #Configue Director ApplicationPool service account dsc_xwebapppool{'DirectorAppPool': dsc_name => 'Director', @@ -21,10 +21,10 @@ dsc_disallowrotationonconfigchange => true, dsc_restartschedule => ['00:00:00'], dsc_identitytype => 'SpecificUser', - dsc_credential => {'user' => "${domainNetbiosName}\\${director_svc_username}", 'password' => $director_svc_password}, + dsc_credential => {'user' => "${domainnetbiosname}\\${director_svc_username}", 'password' => $director_svc_password}, dsc_state => 'Started', } - + #Changing authentication mode to use ApplicationPool dsc_script{ 'DirectorUseAppPoolCredentials': dsc_getscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' @@ -41,21 +41,21 @@ dsc_testscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' return (\'false\' -eq $useKernelMode.Value)', dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' -value \'false\'' - } - + } + #Redirect from default IIS page to Director if $https { file{'c:/inetpub/wwwroot/index.html': ensure => file, - content => template('xd7director/director_https.erb') + content => template('xd7director/director_https.erb') } } else { file{'c:/inetpub/wwwroot/index.html': ensure => file, - content => template('xd7director/director_http.erb') + content => template('xd7director/director_http.erb') } - } - + } + -} \ No newline at end of file +} diff --git a/manifests/init.pp b/manifests/init.pp index 29bab7f..3611943 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -15,10 +15,8 @@ $director_svc_password, $setup_svc_username, $setup_svc_password, - $sourcePath = 'C:\\XD715', - $deliveryControllers = 'srv-cxdc01, srv-cxdc02', - $domainName, - $domainNetbiosName='TESTLAB', + $sourcePath, + $deliveryControllers, $loadbalandedDirector = false, $loadbalancedDirectorFqdn = '', $https = false, @@ -34,16 +32,15 @@ contain xd7director::serviceaccounts contain xd7director::config contain xd7director::sslconfig - - #Install Sirector & IIS before configuring the service account (IIS_IUSRS group needed in serviceaccounts.pp) + + #Install Director & IIS before configuring the service account (IIS_IUSRS group needed in serviceaccounts.pp) Class['::xd7director::install'] -> Class['::xd7director::serviceaccounts'] -> Class['::xd7director::config'] -> Class['::xd7director::sslconfig'] - + reboot { 'dsc_reboot': when => pending, timeout => 15, } } - diff --git a/manifests/serviceaccounts.pp b/manifests/serviceaccounts.pp index 93d69fa..e90b742 100644 --- a/manifests/serviceaccounts.pp +++ b/manifests/serviceaccounts.pp @@ -4,19 +4,19 @@ dsc_ensure => 'Present', dsc_name => 'RSAT-AD-Powershell' } - + #Director service account creation (Active Directory) dsc_xaduser{'SvcDirectorAccount': - dsc_domainname => $domainName, + dsc_domainname => $domain, dsc_domainadministratorcredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, dsc_username => $director_svc_username, dsc_password => {'user' => $director_svc_username, 'password' => $director_svc_password}, dsc_ensure => 'Present', require => Dsc_windowsfeature['RSAT-AD-Powershell'] } - + #Configure SPN on Director service account - #In A load-balanced deployment, the SPN is linked to the FQDN of the Director virtual server configured on the load-balancer + #In A load-balanced deployment, the SPN is linked to the FQDN of the Director virtual server configured on the load-balancer if $loadbalandedDirector { dsc_xadserviceprincipalname{'DirectorLoadBalancedSPN': dsc_account => $director_svc_username, @@ -36,27 +36,27 @@ require => Dsc_xaduser['SvcDirectorAccount'] } } - + #Add service accounts to local admins IIS_IUSRS group (local machine) dsc_xgroup{'SvcDirectorIISGroup': dsc_groupname => 'IIS_IUSRS', dsc_ensure => 'Present', - dsc_memberstoinclude => "$domainNetbiosName\\$director_svc_username", + dsc_memberstoinclude => "${domainnetbiosname}\\$director_svc_username", #dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, require => Dsc_xaduser['SvcDirectorAccount'] } - + #Grant "Log on as a batch job" and "Impersonate a client after authentication" to Director service account - dsc_userrightsassignment{'AssignLogOnAsBatchToDirector': + dsc_userrightsassignment{'AssignLogOnAsBatchToDirector': dsc_policy => 'Log_on_as_a_batch_job', - dsc_identity => ["$domainNetbiosName\\$director_svc_username", 'Administrators', 'Backup Operators', 'Performance Log Users'], + dsc_identity => ["${domainnetbiosname}\\$director_svc_username", 'Administrators', 'Backup Operators', 'Performance Log Users'], require => Dsc_xaduser['SvcDirectorAccount'] } - - dsc_userrightsassignment{'AssignImpersonateAfterAuthenticationToDirector': + + dsc_userrightsassignment{'AssignImpersonateAfterAuthenticationToDirector': dsc_policy => 'Impersonate_a_client_after_authentication', - dsc_identity => ["$domainNetbiosName\\$director_svc_username", 'Administrators', 'Local Service', 'Network Service', 'Service'], + dsc_identity => ["${domainnetbiosname}\\$director_svc_username", 'Administrators', 'Local Service', 'Network Service', 'Service'], require => Dsc_xaduser['SvcDirectorAccount'] } - -} \ No newline at end of file + +} From 9d763f9c00787af54264fb7ab747ceb81c3137bc Mon Sep 17 00:00:00 2001 From: matt6697 <32440697+matt6697@users.noreply.github.com> Date: Fri, 20 Apr 2018 08:33:44 +0200 Subject: [PATCH 3/5] Compliance with puppet style guidelines, all variables to lower case, added module parameters explicit types , github.io layout , updated metadata --- .gitignore | 1 + .pmtignore | 6 +++ README.markdown | 79 +++++++++++++++------------- _config.yml | 13 +++++ _layouts/default.html | 88 ++++++++++++++++++++++++++++++++ assets/css/style.scss | 11 ++++ manifests/config.pp | 53 +++++++++---------- manifests/init.pp | 36 ++++++------- manifests/install.pp | 17 ++++--- manifests/serviceaccounts.pp | 99 ++++++++++++++++++------------------ manifests/sslconfig.pp | 84 +++++++++++++++--------------- metadata.json | 20 ++++---- 12 files changed, 320 insertions(+), 187 deletions(-) create mode 100644 .gitignore create mode 100644 .pmtignore create mode 100644 _config.yml create mode 100644 _layouts/default.html create mode 100644 assets/css/style.scss diff --git a/.gitignore b/.gitignore new file mode 100644 index 0000000..01d0a08 --- /dev/null +++ b/.gitignore @@ -0,0 +1 @@ +pkg/ diff --git a/.pmtignore b/.pmtignore new file mode 100644 index 0000000..db243cb --- /dev/null +++ b/.pmtignore @@ -0,0 +1,6 @@ +pkg/ +tests/ +assets/ +_layouts/ +_config.yml +.fixtures.yml diff --git a/README.markdown b/README.markdown index fe8994b..763a053 100644 --- a/README.markdown +++ b/README.markdown @@ -9,53 +9,60 @@ The following options are available for a production-grade installation : - Security : IIS SSL configuration to secure communications between Director and the client device. - Resiliency : Deployment of a Director pool in a load-balanced environment with SPN setup and Kerberos SSO capability. +## Requirements ## +The minimum Windows Management Framework (PowerShell) version required is 5.0 or higher, which ships with Windows 10 or Windows Server 2016, but can also be installed on Windows 7 SP1, Windows 8.1, Windows Server 2008 R2 SP1, Windows Server 2012 and Windows Server 2012 R2. -## Integration informations -Director runs with service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. +This module requires a custom version of the puppetlabs-dsc module compiled with [XenDesktop7](https://github.com/VirtualEngine/XenDesktop7) Powershell DSC resource as a dependency. Ready to use virtualdesktopdevops/dsc v1.5.0 puppet module provided on [Puppet Forge](https://forge.puppet.com/virtualdesktopdevops/dsc). + +## Change log ## + +A full list of changes in each version can be found in the [change log](CHANGELOG.md). + + +## Integration informations ## +Citrix Director runs with service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. All the Director nodes in a Director Pool must have their Director IIS ApplicationPool be configured with the same service account and the same SPN. The module can be installed on a Standard, Datacenter version of Windows 2012R2 or Windows 2016. **Core version is not supported by Citrix for Director installation**. Migrated puppet example code in README.md to future parser syntax (4.x). Impact on parameters refering to remote locations (file shares) which have to be prefixed with \\\\ instead of the classical \\. This is because of Puppet >= 4.x parsing \\ as a single \ in single-quoted strings. Use parser = future in puppet 3.x /etc/puppet/puppet.conf to use this new configuration in your Puppet 3.x and prepare Puppet 4.x migration. -## Usage -### xd7director +## Usage ## +### xd7director ### This class will install and configure IIS and Citrix Director. -- **director_svc_username** : (string format username) : Director service account (on which Director IIS ApplicationPool will run). Use **username** format. **DO NOT** use DOMAIN\username format. -- **director_svc_password** : Password of the Director service account. Should be encrypted with hiera-eyaml. -- **setup_svc_username** : (string) Privileged account used by Puppet for installing the software. -- **setup_svc_password** : (string) Password of the privileged account. Should be encrypted with hiera-eyaml. -- **sourcePath** : (string) Path of a folder containing the Xendesktop 7.x installer (unarchive the ISO image in this folder). -- **deliveryControllers** : (String) List of Citrix Delivery Controllers of the XenDesktop7 site 'srv-cxdc01.domain.net, srv-cxdc012.domain.net' -- **loadbalandedDirector** : true or false. Is Director deployed behind a load-balancer ? Default : false -- **loadbalancedDirectorFqdn** (string)(optionnal) FQDN of the Director pool associated to the virtual server IP configured on the loadbalancer -- **https** : (boolean) : true or false. Deploy SSL certificate on IIS and activate SSL access to Storefront ? Default : false -- **sslCertificateSourcePath** : (string) Location of the SSL certificate (p12 / PFX format with private key). Can be local folder, UNC path, HTTP URL) -- **sslCertificatePassword** : (string) Password protecting the p12/pfx SSL certificate file. -- **sslCertificateThumbprint** : (string) Thumbprint of the SSL certificate (available in the SSL certificate). -- **caCertificateSourcePath** : (string) Location of the SSL Certification Autority root certificate (PEM or CER format). Can be local folder, UNC path, HTTP URL) -- **caCertificateThumbprint** : (string) Thumbprint of the SSL Certification Autority root certificate (available in the SSL certificate). +- **`[String]` director_svc_username** _(Required)_: Director service account (on which Director IIS ApplicationPool will run). Use **username** format. **DO NOT** use DOMAIN\username format. +- **`[String]` director_svc_password** _(Required)_: Password of the Director service account. Should be encrypted with hiera-eyaml. +- **`[String]` setup_svc_username** _(Required)_: Privileged account used by Puppet for installing the software. +- **`[String]` setup_svc_password** _(Required)_: Password of the privileged account. Should be encrypted with hiera-eyaml. +- **`[String]` sourcepath** _(Required)_: Path of a folder containing the Xendesktop 7.x installer (unarchive the ISO image in this folder). +- **`[String]` deliverycontrollers** _(Required)_: List of Citrix Delivery Controllers of the XenDesktop7 site 'srv-cxdc01.domain.net, srv-cxdc012.domain.net' +- **`[Boolean]` loadbalandeddirector** _(Optional, default is false)_: Is Director deployed behind a load-balancer ? Default : false +- **`[String]` loadbalanceddirectorfqdn** _(Required, if loadbalandeddirector = true)_: FQDN of the Director pool associated to the virtual server IP configured on the loadbalancer +- **`[Boolean]` https** _(Optional, default is false)_: Deploy SSL certificate on IIS and activate SSL access to Storefront ? Default : false +- **`[String]` sslcertificatesourcepath** _(Required if https = true)_: Location of the SSL certificate (p12 / PFX format with private key). Can be local folder, UNC path, HTTP URL) +- **`[String]` sslcertificatepassword** _(Required if https = true)_: Password protecting the p12/pfx SSL certificate file. +- **`[String]` sslcertificatethumbprint** _(Required if https = true)_: Thumbprint of the SSL certificate (available in the SSL certificate). +- **`[String]` cacertificatesourcepath** _(Required if https = true)_: Location of the SSL Certification Autority root certificate (PEM or CER format). Can be local folder, UNC path, HTTP URL) +- **`[String]` cacertificatethumbprint** _(Required if https = true)_: Thumbprint of the SSL Certification Autority root certificate (available in the SSL certificate). ~~~puppet node 'director' { - class{'xd7director': - director_svc_username => 'svc-director', - director_svc_password => 'P@ssw0rd', - setup_svc_username => 'TESTLAB\svc-puppet', - setup_svc_password => 'P@ssw0rd', - sourcepath => '\\\\fileserver\\xendesktop715', - deliverycontrollers => 'srv-cxdc01.testlab.com, srv-cxdc02.testlab.com', - domainName => 'TESTLAB.COM', - domainNetbiosName=> 'TESTLAB', - loadbalandedDirector => true, - loadbalancedDirectorFqdn => 'director.testlab.com', - https => true, - sslCertificateSourcePath => '\\\\fileserver\\ssl\\cxdirector.pfx', - sslCertificatePassword => 'P@ssw0rd', - sslCertificateThumbprint => '44cce73845feef4da4d369a37386c862eb3bd4e1', - caCertificateSourcePath => '\\\\fileserver\\ssl\\ca-root.pem', - caCertificateThumbprint => '48jise7dssdsd4da4d369a3738dsdsdeeb3sdiu3' - } + class{'xd7director': + director_svc_username => 'svc-director', + director_svc_password => 'P@ssw0rd', + setup_svc_username => 'TESTLAB\svc-puppet', + setup_svc_password => 'P@ssw0rd', + sourcepath => '\\\\fileserver\\xendesktop715', + deliverycontrollers => 'srv-cxdc01.testlab.com, srv-cxdc02.testlab.com', + loadbalandeddirector => true, + loadbalanceddirectorfqdn => 'director.testlab.com', + https => true, + sslcertificatesourcepath => '\\\\fileserver\\ssl\\cxdirector.pfx', + sslcertificatepassword => 'P@ssw0rd', + sslcertificatethumbprint => '44cce73845feef4da4d369a37386c862eb3bd4e1', + cacertificatesourcepath => '\\\\fileserver\\ssl\\ca-root.pem', + cacertificatethumbprint => '48jise7dssdsd4da4d369a3738dsdsdeeb3sdiu3' + } } ~~~ diff --git a/_config.yml b/_config.yml new file mode 100644 index 0000000..5db27a1 --- /dev/null +++ b/_config.yml @@ -0,0 +1,13 @@ +title: Citrix Xendesktop 7.x Director puppet module +description: Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp/XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface. +google_site_verification: R71XDERzPOp9lUudi8X6iKrpcoIgDG_1HzRMz_TMaDY +google_analytics: UA-12767493-6 +theme: jekyll-theme-slate +plugins: + - jekyll-seo-tag + - jekyll-sitemap + - jekyll-feed + - jekyll-redirect-from + - jekyll-mentions +jekyll-mentions: + base_url: http://www.virtualdesktopdevops.com diff --git a/_layouts/default.html b/_layouts/default.html new file mode 100644 index 0000000..639fb46 --- /dev/null +++ b/_layouts/default.html @@ -0,0 +1,88 @@ + + + + + + + + + + + + + + + + + + + + +{% seo %} + + + + + +
+
+ View on GitHub + +

{{ site.title | default: site.github.repository_name }}

+

{{ site.description | default: site.github.project_tagline }}

+ + {% if site.show_downloads %} +
+ Download this project as a .zip file + Download this project as a tar.gz file +
+ {% endif %} +
+
+ + +
+
+
+
+
+ {{ content }} +
+
+ + + + +
+
+
+
+
+ + + + + {% if site.google_analytics %} + + {% endif %} + + diff --git a/assets/css/style.scss b/assets/css/style.scss new file mode 100644 index 0000000..d9d36bc --- /dev/null +++ b/assets/css/style.scss @@ -0,0 +1,11 @@ +--- +--- + +@import "{{ site.theme }}"; + +.inner { + position: relative; + max-width: 1200px; + padding: 20px 10px; + margin: 0 auto; +} diff --git a/manifests/config.pp b/manifests/config.pp index 7d9f504..89a3dfa 100644 --- a/manifests/config.pp +++ b/manifests/config.pp @@ -1,50 +1,53 @@ +#Class configuring IIS and Director class xd7director::config inherits xd7director { #Pairing Director to Delivery Controllers dsc_xwebconfigkeyvalue{ 'ServiceAutoDiscovery': dsc_configsection => 'AppSettings', - dsc_key => 'Service.AutoDiscoveryAddresses', - dsc_value => $deliveryControllers, - dsc_isattribute => false, - dsc_websitepath => 'IIS:\Sites\Default Web Site\Director' + dsc_key => 'Service.AutoDiscoveryAddresses', + dsc_value => $xd7director::deliverycontrollers, + dsc_isattribute => false, + dsc_websitepath => 'IIS:\Sites\Default Web Site\Director' } #Configue Director ApplicationPool service account - dsc_xwebapppool{'DirectorAppPool': - dsc_name => 'Director', - dsc_ensure => 'Present', - dsc_autostart => true, - dsc_enable32bitapponwin64 => false, - dsc_managedruntimeversion => 'v4.0', - dsc_managedpipelinemode => 'Integrated', - dsc_disallowoverlappingrotation => true, - dsc_disallowrotationonconfigchange => true, - dsc_restartschedule => ['00:00:00'], - dsc_identitytype => 'SpecificUser', - dsc_credential => {'user' => "${domainnetbiosname}\\${director_svc_username}", 'password' => $director_svc_password}, - dsc_state => 'Started', - } + dsc_xwebapppool{'DirectorAppPool': + dsc_name => 'Director', + dsc_ensure => 'Present', + dsc_autostart => true, + dsc_enable32bitapponwin64 => false, + dsc_managedruntimeversion => 'v4.0', + dsc_managedpipelinemode => 'Integrated', + dsc_disallowoverlappingrotation => true, + dsc_disallowrotationonconfigchange => true, + dsc_restartschedule => ['00:00:00'], + dsc_identitytype => 'SpecificUser', + dsc_credential => { + 'user' => "${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", + 'password' => $xd7director::director_svc_password}, + dsc_state => 'Started', + } #Changing authentication mode to use ApplicationPool dsc_script{ 'DirectorUseAppPoolCredentials': - dsc_getscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' + dsc_getscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' return @{ Result = $useAppPoolCredentials.Value }', - dsc_testscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' + dsc_testscript => '$useAppPoolCredentials = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' return (\'true\' -eq $useAppPoolCredentials.Value)', - dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' -value \'true\'' + dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useAppPoolCredentials\' -value \'true\'' } #Disable kernel mode authentication dsc_script{ 'DirectorDisableKernelMode': - dsc_getscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' + dsc_getscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' return @{ Result = $useKernelMode.Value }', dsc_testscript => '$useKernelMode = Get-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' return (\'false\' -eq $useKernelMode.Value)', - dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' -value \'false\'' + dsc_setscript => 'Set-WebConfigurationProperty -pspath \'MACHINE/WEBROOT/APPHOST\' -location \'Default Web Site/Director\' -filter \'system.webServer/security/authentication/windowsAuthentication\' -name \'useKernelMode\' -value \'false\'' } #Redirect from default IIS page to Director - if $https { + if $xd7director::https { file{'c:/inetpub/wwwroot/index.html': ensure => file, content => template('xd7director/director_https.erb') @@ -56,6 +59,4 @@ content => template('xd7director/director_http.erb') } } - - } diff --git a/manifests/init.pp b/manifests/init.pp index 3611943..cca25a3 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -11,20 +11,20 @@ # Sample Usage: # class xd7director ( - $director_svc_username, - $director_svc_password, - $setup_svc_username, - $setup_svc_password, - $sourcePath, - $deliveryControllers, - $loadbalandedDirector = false, - $loadbalancedDirectorFqdn = '', - $https = false, - $sslCertificateSourcePath = '', - $sslCertificatePassword = '', - $sslCertificateThumbprint = '', - $caCertificateSourcePath = '', - $caCertificateThumbprint = '' + String $director_svc_username, + String $director_svc_password, + String $setup_svc_username, + String $setup_svc_password, + String $sourcepath, + String $deliverycontrollers, + Optional[Boolean] $loadbalandeddirector = false, + Optional[String] $loadbalanceddirectorfqdn = '', + Optional[Boolean] $https = false, + Optional[String] $sslcertificatesourcepath = '', + Optional[String] $sslcertificatepassword = '', + Optional[String] $sslcertificatethumbprint = '', + Optional[String] $cacertificatesourcepath = '', + Optional[String] $cacertificatethumbprint = '' ) { @@ -34,10 +34,10 @@ contain xd7director::sslconfig #Install Director & IIS before configuring the service account (IIS_IUSRS group needed in serviceaccounts.pp) - Class['::xd7director::install'] -> - Class['::xd7director::serviceaccounts'] -> - Class['::xd7director::config'] -> - Class['::xd7director::sslconfig'] + Class['::xd7director::install'] +->Class['::xd7director::serviceaccounts'] +->Class['::xd7director::config'] +->Class['::xd7director::sslconfig'] reboot { 'dsc_reboot': when => pending, diff --git a/manifests/install.pp b/manifests/install.pp index c601e2b..fe6185a 100644 --- a/manifests/install.pp +++ b/manifests/install.pp @@ -1,10 +1,11 @@ +#Class installing Citrix Director class xd7director::install inherits xd7director { - - #Install Citrix Director - dsc_xd7feature { 'XD7Director': - dsc_role => 'Director', - dsc_sourcepath => $sourcePath, - dsc_ensure => 'present' - } -} \ No newline at end of file + #Install Citrix Director + dsc_xd7feature { 'XD7Director': + dsc_role => 'Director', + dsc_sourcepath => $xd7director::sourcepath, + dsc_ensure => 'present' + } + +} diff --git a/manifests/serviceaccounts.pp b/manifests/serviceaccounts.pp index e90b742..3f46c64 100644 --- a/manifests/serviceaccounts.pp +++ b/manifests/serviceaccounts.pp @@ -1,62 +1,63 @@ +#Class configuring Citrix Director service account and associated SPN in Active Directory class xd7director::serviceaccounts inherits xd7director { #Needed for ActiveDirectory remote management using Powershell - dsc_windowsfeature{ 'RSAT-AD-Powershell': - dsc_ensure => 'Present', - dsc_name => 'RSAT-AD-Powershell' - } + dsc_windowsfeature{ 'RSAT-AD-Powershell': + dsc_ensure => 'Present', + dsc_name => 'RSAT-AD-Powershell' + } - #Director service account creation (Active Directory) - dsc_xaduser{'SvcDirectorAccount': - dsc_domainname => $domain, - dsc_domainadministratorcredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - dsc_username => $director_svc_username, - dsc_password => {'user' => $director_svc_username, 'password' => $director_svc_password}, - dsc_ensure => 'Present', - require => Dsc_windowsfeature['RSAT-AD-Powershell'] - } + #Director service account creation (Active Directory) + dsc_xaduser{'SvcDirectorAccount': + dsc_domainname => $facts['domain'], + dsc_domainadministratorcredential => {'user' => $xd7director::setup_svc_username, 'password' => $xd7director::setup_svc_password}, + dsc_username => $xd7director::director_svc_username, + dsc_password => {'user' => $xd7director::director_svc_username, 'password' => $xd7director::director_svc_password}, + dsc_ensure => 'Present', + require => Dsc_windowsfeature['RSAT-AD-Powershell'] + } - #Configure SPN on Director service account - #In A load-balanced deployment, the SPN is linked to the FQDN of the Director virtual server configured on the load-balancer - if $loadbalandedDirector { - dsc_xadserviceprincipalname{'DirectorLoadBalancedSPN': - dsc_account => $director_svc_username, - dsc_serviceprincipalname => "http/${loadbalancedDirectorFqdn}", - dsc_ensure => present, - dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - require => Dsc_xaduser['SvcDirectorAccount'] - } - } - #In a standalone deployment, the SPN is linked to the computer FQDN - else { - dsc_xadserviceprincipalname{'DirectorStandaloneSPN': - dsc_account => $director_svc_username, - dsc_serviceprincipalname => "http/${fqdn}", - dsc_ensure => present, - dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - require => Dsc_xaduser['SvcDirectorAccount'] + #Configure SPN on Director service account + #In A load-balanced deployment, the SPN is linked to the FQDN of the Director virtual server configured on the load-balancer + if $xd7director::loadbalandeddirector { + dsc_xadserviceprincipalname{'DirectorLoadBalancedSPN': + dsc_account => $xd7director::director_svc_username, + dsc_serviceprincipalname => "http/${xd7director::loadbalanceddirectorfqdn}", + dsc_ensure => present, + dsc_psdscrunascredential => {'user' => $xd7director::setup_svc_username, 'password' => $xd7director::setup_svc_password}, + require => Dsc_xaduser['SvcDirectorAccount'] + } + } + #In a standalone deployment, the SPN is linked to the computer FQDN + else { + dsc_xadserviceprincipalname{'DirectorStandaloneSPN': + dsc_account => $xd7director::director_svc_username, + dsc_serviceprincipalname => "http/${facts['fqdn']}", + dsc_ensure => present, + dsc_psdscrunascredential => {'user' => $xd7director::setup_svc_username, 'password' => $xd7director::setup_svc_password}, + require => Dsc_xaduser['SvcDirectorAccount'] } - } + } - #Add service accounts to local admins IIS_IUSRS group (local machine) - dsc_xgroup{'SvcDirectorIISGroup': - dsc_groupname => 'IIS_IUSRS', - dsc_ensure => 'Present', - dsc_memberstoinclude => "${domainnetbiosname}\\$director_svc_username", - #dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, - require => Dsc_xaduser['SvcDirectorAccount'] - } + #Add service accounts to local admins IIS_IUSRS group (local machine) + dsc_xgroup{'SvcDirectorIISGroup': + dsc_groupname => 'IIS_IUSRS', + dsc_ensure => 'Present', + dsc_memberstoinclude => "${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", + #dsc_psdscrunascredential => {'user' => $setup_svc_username, 'password' => $setup_svc_password}, + require => Dsc_xaduser['SvcDirectorAccount'] + } - #Grant "Log on as a batch job" and "Impersonate a client after authentication" to Director service account - dsc_userrightsassignment{'AssignLogOnAsBatchToDirector': - dsc_policy => 'Log_on_as_a_batch_job', - dsc_identity => ["${domainnetbiosname}\\$director_svc_username", 'Administrators', 'Backup Operators', 'Performance Log Users'], - require => Dsc_xaduser['SvcDirectorAccount'] + #Grant "Log on as a batch job" and "Impersonate a client after authentication" to Director service account + dsc_userrightsassignment{'AssignLogOnAsBatchToDirector': + dsc_policy => 'Log_on_as_a_batch_job', + dsc_identity => ["${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", 'Administrators', 'Backup Operators', 'Performance Log Users'], + require => Dsc_xaduser['SvcDirectorAccount'] } dsc_userrightsassignment{'AssignImpersonateAfterAuthenticationToDirector': - dsc_policy => 'Impersonate_a_client_after_authentication', - dsc_identity => ["${domainnetbiosname}\\$director_svc_username", 'Administrators', 'Local Service', 'Network Service', 'Service'], - require => Dsc_xaduser['SvcDirectorAccount'] + dsc_policy => 'Impersonate_a_client_after_authentication', + dsc_identity => ["${facts['domainnetbiosname']}\\${xd7director::director_svc_username}", 'Administrators', 'Local Service', 'Network Service', 'Service'], + require => Dsc_xaduser['SvcDirectorAccount'] } } diff --git a/manifests/sslconfig.pp b/manifests/sslconfig.pp index fb479f6..867b547 100644 --- a/manifests/sslconfig.pp +++ b/manifests/sslconfig.pp @@ -1,55 +1,59 @@ +#Class configuring SSL secured access to Citrix Director class xd7director::sslconfig inherits xd7director { - if $https { - if ($caCertificateSourcePath != '') { - #Import and install CA certificate in LocalMachine Root store - dsc_file{ 'CACert': - dsc_sourcepath => $caCertificateSourcePath, - dsc_destinationpath => 'c:\SSL\ca.pem', - dsc_type => 'File' - } - - dsc_xcertificateimport{ 'ImportCACert': - dsc_thumbprint => $caCertificateThumbprint, - dsc_path => 'c:\SSL\ca.pem', - dsc_location => 'LocalMachine', - dsc_store => 'Root', - require => Dsc_file['CACert'] - } + if $xd7director::https { + if ($xd7director::cacertificatesourcepath != '') { + #Import and install CA certificate in LocalMachine Root store + dsc_file{ 'CACert': + dsc_sourcepath => $xd7director::cacertificatesourcepath, + dsc_destinationpath => 'c:\SSL\ca.pem', + dsc_type => 'File' + } + + dsc_xcertificateimport{ 'ImportCACert': + dsc_thumbprint => $xd7director::cacertificatethumbprint, + dsc_path => 'c:\SSL\ca.pem', + dsc_location => 'LocalMachine', + dsc_store => 'Root', + require => Dsc_file['CACert'] + } } - + #Import and install server certificate dsc_file{ 'SSLCert': - dsc_sourcepath => $sslCertificateSourcePath, + dsc_sourcepath => $xd7director::sslcertificatesourcepath, dsc_destinationpath => 'c:\SSL\cert.pfx', - dsc_type => 'File' + dsc_type => 'File' } - + dsc_xpfximport{ 'ImportSSLCert': - dsc_thumbprint => $sslCertificateThumbprint, - dsc_path => 'c:\SSL\cert.pfx', - dsc_location => 'LocalMachine', - dsc_store => 'WebHosting', - dsc_credential => {'user' => 'cert', 'password' => $sslCertificatePassword }, - require => Dsc_file['SSLCert'] + dsc_thumbprint => $xd7director::sslcertificatethumbprint, + dsc_path => 'c:\SSL\cert.pfx', + dsc_location => 'LocalMachine', + dsc_store => 'WebHosting', + dsc_credential => {'user' => 'cert', 'password' => $xd7director::sslcertificatepassword }, + require => Dsc_file['SSLCert'] } - - dsc_xwebsite{ 'DefaultWebSiteSSL': - dsc_name => 'Default Web Site', + + dsc_xwebsite{ 'DefaultWebSiteSSL': + dsc_name => 'Default Web Site', dsc_bindinginfo => [ - { protocol => 'HTTPS', port => '443', certificatethumbprint => $sslCertificateThumbprint, certificatestorename => 'WebHosting' } + { protocol => 'https', + port => '443', + certificatethumbprint => $xd7director::sslcertificatethumbprint, + certificatestorename => 'WebHosting' } ], - require => Dsc_xpfximport['ImportSSLCert'] + require => Dsc_xpfximport['ImportSSLCert'] } - + } else { - dsc_xwebsite{ 'DefaultWebSite': - dsc_name => 'Default Web Site', - #dsc_physicalpath => '%SystemDrive%\inetpub\wwwroot', - dsc_bindinginfo => [ - { protocol => 'HTTP', port => '80'} - ], - } - } + dsc_xwebsite{ 'DefaultWebSite': + dsc_name => 'Default Web Site', + dsc_bindinginfo => [ + { protocol => 'http', + port => '80'} + ], + } + } } diff --git a/metadata.json b/metadata.json index 9586e48..84745e0 100644 --- a/metadata.json +++ b/metadata.json @@ -1,13 +1,13 @@ { - "author": "citrixdeployment", + "author": "virtualdesktopdevops", "dependencies": [ - { - "name": "puppetlabs/dsc", - "version_requirement": ">= 1.4.0" + { + "name": "virtualdesktopdevops/dsc", + "version_requirement": ">= 1.5.0" } ], "license": "Apache-2.0", - "name": "citrixdeployment-xd7director", + "name": "virtualdesktopdevops-xd7director", "operatingsystem_support": [ { "operatingsystem": "windows", @@ -17,15 +17,15 @@ ] } ], - "project_page": "https://www.citrixdeployment.com", + "project_page": "https://www.virtualdesktopdevops.com", "requirements": [ { "name": "puppet", - "version_requirement": ">= 3.8.0 < 6.0.0" + "version_requirement": ">= 4.0.0 < 6.0.0" } ], - "source": "https://www.citrixdeployment.com", - "summary": "Xendesktop 7.x Director installation & linking to an existing XenApp/XenDesktop deployment", + "source": "https://www.virtualdesktopdevops.com", + "summary": "Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp/XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface.", "tags": [ "powershell", "dsc", @@ -34,4 +34,4 @@ "director" ], "version": "1.0.0" -} \ No newline at end of file +} From 9323ef8c7d095276a8f56700a84903776f62c7f9 Mon Sep 17 00:00:00 2001 From: matt6697 <32440697+matt6697@users.noreply.github.com> Date: Mon, 23 Apr 2018 18:46:45 +0200 Subject: [PATCH 4/5] Minor changes in readme and metadata. Version 1.0.0 changelog --- CHANGELOG.md | 9 ++++++--- README.markdown | 11 ++++++----- metadata.json | 2 +- 3 files changed, 13 insertions(+), 9 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 69cb5d0..b73e4fd 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,5 +1,8 @@ # Changelog - xd7director # -## Unreleased -- **BREAKING CHANGE** : Removed $domainName class parameter. Used facts instead. -- **BREAKING CHANGE** : Removed $domainNetbiosName class parameter. Used custom fact instead. +## Version 1.0.0 +- Used custom fact to retrieve domain netbios name. +- Citrix Director service account creation and SPN configuration. +- Citrix Director installation and initial configuration +- IIS SSL binding configuration. +- Initial release. diff --git a/README.markdown b/README.markdown index 763a053..74dd2a8 100644 --- a/README.markdown +++ b/README.markdown @@ -21,16 +21,16 @@ A full list of changes in each version can be found in the [change log](CHANGELO ## Integration informations ## -Citrix Director runs with service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. -All the Director nodes in a Director Pool must have their Director IIS ApplicationPool be configured with the same service account and the same SPN. +Citrix Director runs with the identity of a service account to improve security and allow the deployment of multiple Director instances (Director Pool) configured for Kerberos SSO login behind a load-balancer. +All the Director nodes in a Director Pool must have their Director IIS ApplicationPool be configured to use the same service account and the same SPN. The module can be installed on a Standard, Datacenter version of Windows 2012R2 or Windows 2016. **Core version is not supported by Citrix for Director installation**. -Migrated puppet example code in README.md to future parser syntax (4.x). Impact on parameters refering to remote locations (file shares) which have to be prefixed with \\\\ instead of the classical \\. This is because of Puppet >= 4.x parsing \\ as a single \ in single-quoted strings. Use parser = future in puppet 3.x /etc/puppet/puppet.conf to use this new configuration in your Puppet 3.x and prepare Puppet 4.x migration. +Puppet example code has been updated to future parser syntax (4.x). All the parameters refering to remote locations (file shares) have to be prefixed with \\\\ instead of the classical \\. This is because of Puppet >= 4.x parsing \\ as a single \ in single-quoted strings. Use parser = future in puppet 3.x /etc/puppet/puppet.conf to use this module in your existing Puppet 3.x deployment and prepare Puppet 4.x migration. ## Usage ## -### xd7director ### -This class will install and configure IIS and Citrix Director. +### xd7director parameters### + - **`[String]` director_svc_username** _(Required)_: Director service account (on which Director IIS ApplicationPool will run). Use **username** format. **DO NOT** use DOMAIN\username format. - **`[String]` director_svc_password** _(Required)_: Password of the Director service account. Should be encrypted with hiera-eyaml. - **`[String]` setup_svc_username** _(Required)_: Privileged account used by Puppet for installing the software. @@ -46,6 +46,7 @@ This class will install and configure IIS and Citrix Director. - **`[String]` cacertificatesourcepath** _(Required if https = true)_: Location of the SSL Certification Autority root certificate (PEM or CER format). Can be local folder, UNC path, HTTP URL) - **`[String]` cacertificatethumbprint** _(Required if https = true)_: Thumbprint of the SSL Certification Autority root certificate (available in the SSL certificate). +### xd7director example code### ~~~puppet node 'director' { class{'xd7director': diff --git a/metadata.json b/metadata.json index 84745e0..265f147 100644 --- a/metadata.json +++ b/metadata.json @@ -25,7 +25,7 @@ } ], "source": "https://www.virtualdesktopdevops.com", - "summary": "Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp/XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface.", + "summary": "Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp / XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface.", "tags": [ "powershell", "dsc", From d5de953125ab0eb471c0ed01f3d9a8f43acdad2f Mon Sep 17 00:00:00 2001 From: matt6697 <32440697+matt6697@users.noreply.github.com> Date: Tue, 24 Apr 2018 08:09:58 +0200 Subject: [PATCH 5/5] Added issues url --- metadata.json | 1 + 1 file changed, 1 insertion(+) diff --git a/metadata.json b/metadata.json index 265f147..3180562 100644 --- a/metadata.json +++ b/metadata.json @@ -25,6 +25,7 @@ } ], "source": "https://www.virtualdesktopdevops.com", + "issues_url": "https://github.com/virtualdesktopdevops/xd7director/issues", "summary": "Puppet modules installing Citrix Director, which provides Citrix XenDesktop 7.x deployment monitoring capabilities. Director is linked to the XenApp / XenDesktop site Delivery Controllers and configured for Kerberos SSO login, enhancing security level and speeding access to the monitoring interface.", "tags": [ "powershell",