There are a number of components to configure to get Kerberos Pass-Through Authentication working for the Citrix Presentation Server Client for Macintosh 10 on OS X including:
- Binding Mac OS X to Active Directory
- Checking Kerberos Functionallity
- Enable Kerberos Delegation on the Presentation Server computer account
- Create a Citrix connection in the Citrix ICA Client Editor
And also some troubleshooting may be required:
- Citrix Servers may require Microsoft Hotfix 940925 for LSA generated an exception
- Enable Kerberos Logging in the System Event Log
- Service Logons Fail Due to Incorrectly Set SPNs
Binding Mac OS X to Active Directory
- Double check that the Mac OS X client is pointed to your AD server for DNS.
- Open /Applications/Utilities and launch Directory Access.
- Check the Active Directory plugin checkbox.
- Click on the Configure... button.
- Provide the directory domain and a computer ID
- Click on the Bind button and provide your AD credentials
- Log off and logon as an Active Directory user
Checking Kerberos Functionallity
- Logon as an Active Directory user
- Access Active Directory resources such as SMB Shares/ISA Server
- In the Finder, navigate to /System/Library/CoreServices and launch the Kerberos application.
You should see that the user obtained a ticket granting ticket from the KDC in the realm you created.
Enable Kerberos Delegation on the Presentation Server computer account in Active Directory Users and Computers
- Right click the Presentation Server computer account and select Properties from the context menu
- Select the Delegation tab
- Select the Trust this computer for delegation to any service (Kerberos only) radio button and click OK
Assuming the Citrix Presentation Server Client for Macintosh is installed:
http://www.citrix.com/English/SS/downloads/details.asp?dID=2755&downloadID=3250&pID=186
Create a Citrix connection in the Citrix ICA Client Editor
- Open /Applications/Citrix ICA Client/Citrix ICA Client Editor
- Select Published Application
- Click Browse to select the required Published Application
- Select the Kerberos Passthrough Authentication option to connect automatically with the credentials configured in the Macintosh Kerberos application.
- Click Save
- Click Connect to Start the ICA session
Citrix Servers may require Microsoft Hotfix 940925 for the following errors:
- Event ID 5000 : The security package LSA generated an exception
- Event ID 26: The system process 'C:\WINDOWS\system32\lsass.exe' terminated unexpectedly with status code -1073741819
- Event ID 1076: System Failure: Stop error Reason Code: 0x805000f
If Kerberos authenticates against the Presentation Server, but not other servers:
- Enable Kerberos Logging in the System Event Log (MSKB: 262177)
- List SPNs of hosts that cannot be accessed using the command SETSPN -L <servername>