This one slipped under the radar!

This change that was quietly slipped into the recent NetScaler 10.5 56.12 build should please a lot of people.  You may be aware that version 10.5 did away with a lot, but not all, of the requirements for Java when administering the NetScaler GUI.  However a few features still required it – the upgrade wizard, most options under the Diagnostics tab, visualisers, AppFW and a handful of other features.

However as of build 56.12 it seems all requirements for Java have completely disappeared, the upgrade wizard, diagnostic settings and more no longer require Java – as a NetScaler admin this removes a major pain point.  I no longer need to worry about maintaining that old install of Java 1.6 on my machine and having to manipulate the various and ever changing Java security settings just so I can administer my NetScalers! Woo hoo!

I can’t find anything official in the release notes regarding this change, and at time of writing this blog entry the Citrix eDocs still refers to the Java requirements here: But regardless, this change made me happy enough I wanted to share it with anyone that wasn’t aware, so enjoy :)

Java Upgrade Wizard
The old Java upgrade wizard present in builds 55.8 and earlier
HTML Upgrade Wizard
The new HTML upgrade wizard present in builds 56.12 onwards

StoreFront 2.5 Gotcha

While the main new features of StoreFront 2.5 have been extensively covered (Citrix blog post here), I found a new addition has been quietly slipped in and because at the time of writing the Citrix eDocs site has not been updated for StoreFront 2.5, it caught me out.

If you have setup StoreFront and NetScaler Gateway before you will be familiar with the process of adding the NetScaler Gateway settings, which also adds the corresponding Authentication Method “Pass-though from NetScaler Gateway” under the Authentication pane.  Here’s the new bit though – in the Receiver for Web pane, there is now a separate Authentication Methods option just for Receiver for Web.  And when you add a NetScaler Gateway to your deployment and check the “Pass-though from NetScaler Gateway” authentication option under the Authentication pane, it doesn’t automatically enable the same option in the Receiver for Web pane.


For reference, the symptoms of not having this configured correctly are logging on to the NetScaler, then being prompted again for credentials by StoreFront.  However StoreFront still will not log you in, and you get a message in the event log of your StoreFront server similar to:

"Gateway data from the request and the authentication token are not matching. Request was made to store XYZ Apps."

So there you have it – make sure you check this option under both the Authentication and Receiver for Web panes, I hope the time I burned figuring this out will save someone else wasting their time!

NetScaler Gateway session profiles and Receiver for Windows RT clients

This one catches me out occasionally, because there’s only about three people in the world who use a Surface tablet and now and again one of those three people is a customer of mine.  Symptoms are an otherwise functioning Citrix XenApp or XenDesktop environment can be accessed (via a NetScaler) by any Receiver client with the exception of the Receiver for Windows RT client.  The usual symptoms are after entering the server URL and authentication credentials, you will get a blank “My Apps” screen and the progress/busy dots (I’m sure there’s an official name for them) just continually zip across the screen, the apps will never actually populate.

Receiver RT Screenshot

The issue lies with the URL in the Session Profile.  Your URL should look like the following screenshot:


Ie, it should read https://storefront.ActiveDirectoryFQDN.internal and there should be no trailing slash.  Bizarrely though, most Receiver clients will tolerate any of the following:

1: https://storefront.ActiveDirectoryFQDN.internal/Citrix/StoreName/
2: https://storefront.ActiveDirectoryFQDN.internal/Citrix/StoreName
3: https://storefront.ActiveDirectoryFQDN.internal/
or the correct
4: https://storefront.ActiveDirectoryFQDN.internal

The exception to this is the Receiver for Windows RT client, it works with the 2nd, 3rd and 4th options but not the first, displaying the behaviour described at the start of this post.  So either remove the trailing slash from your URL, or remove the sub-paths from the URL, and you should be good to go!

Step by Step – Installing NetScaler Green Bubble Theme with no internet access

For those new to NetScaler and unix (like me), this might save you some time.  In attempting to follow this Citrix blog post on uploading the Green Bubble theme (, I found the instructions are high level and assume you already know your way around a NetScaler :)

I spent nearly an hour messing around trying to determine the exact commands to install this theme without Internet access, so to save others the time and frustration here are the step by step commands.

1. Download the script file and theme to your PC, eg and
2. SSH to your NetScaler (ie use Putty) and enter the shell command
3. Run the following command:

mkdir /var/vpn/customizations

4. Use WinSCP to connect to your NetScaler. Copy the downloaded script file (GreenBubble.txt) to the /root folder and the GreenBubble1.gz file to /var/vpn/customizations
5. Run the following commands:

cd /var/vpn/customizations
gunzip GreenBubble1.gz
tar -xvf GreenBubble1
cd /root
mv GreenBubble.txt
chmod +x

6. Hopefully now you have the theme installed, watch for errors in the script. A successfull output should look like this:

+ basename ./ .sh
+ SKINNAME=GreenBubble1
+ SKINARC=GreenBubble1.gz
+ SKINDIR=/var/vpn/customizations
+ DL=/tmp
+ EPA=ns_gui/epa/epa.html
+ [ -d /var/vpn/customizations/GreenBubble1 ]
+ fgrep var nsversion= /var/vpn/customizations/GreenBubble1/ns_gui/epa/epa.html
+ cut -d -f2
+ echo
+ tr , .
+ nsapimgr -d hwinfo
+ grep Version:
+ sed -e s/Version: NetScaler NS// -e s/: Build /\./ -e s/, Date.*//
+ cut -d. -f1,2,3,4
+ echo
+ tr . ,
+ COMMAVER=10,0,54,7
+ [ != ]
+ cp -rf /var/vpn/customizations/GreenBubble1/ /netscaler/
+ cp ./ /var/vpn/customizations
+ chmod 755 /var/vpn/customizations/
+ touch /nsconfig/
+ chmod 755 /nsconfig/
+ fgrep -q /var/vpn/customizations/ /nsconfig/

7. Reboot and enjoy green bubbly goodness :)

Note that if you have two NetScalers in a HA pair, you will need to perform these steps on both units.