Workspace ONE Access uses the Virtual App service and the Citrix StoreFront REST API to launch Citrix-published applications and desktops from the Workspace ONE Intelligent Hub portal or app. You can configure internal and external access to the Citrix-published resources. End users must install Citrix Workspace app or Citrix Receiver on their systems or devices to launch the applications and desktops to which they are entitled.
Internal Access
![Components include Workspace ONE, Citrix Receiver, Workspace ONE Access, Virtual App service, and a Citrix components box with StoreFront, XML server, and STA server.](images/GUID-D117F8FA-3941-4AFB-841E-9A81A6561555-high.png)
- A user launches a Citrix-published application or desktop from the Workspace ONE Intelligent Hub portal or app.
- The request goes to the Workspace ONE Access service, which sends it to the Virtual App service.
- The Virtual App service communicates with the Citrix server farm through the StoreFront REST API to authenticate and request the ICA file.
- The ICA file is retrieved and passed to the Intelligent Hub portal or app.
- The ICA file is passed to the Citrix Workspace app or Citrix Receiver.
- The Citrix Workspace app or Citrix Receiver launches the application or desktop.
External Access With Citrix Gateway (NetScaler) Configured to Allow User Name and Password Access
![Components include Workspace ONE, Citrix Receiver, Workspace ONE Access service, Virtual App service, Citrix components including StoreFront, and NetScaler.](images/GUID-2829A19D-DC89-4CC7-88CD-B028A3010FEE-high.png)
- A user launches a Citrix-published application or desktop from the Workspace ONE Intelligent Hub portal or app.
- The request goes to the Workspace ONE Access service, which sends it to the Virtual App service.
- To communicate with the Citrix server farm to authenticate and request the ICA file, the Virtual App service sends a request to Citrix Gateway (formerly called NetScaler) through the StoreFront REST API.
- Citrix Gateway forwards the request to the StoreFront server.
- The ICA file is retrieved and passed to the Intelligent Hub portal or app.
- The ICA file is passed to the Citrix Workspace app or Citrix Receiver.
- Citrix Workspace app or Citrix Receiver communicates with Citrix Gateway.
- Citrix Gateway communicates with the Citrix STA server with the STA ticket and gets the Citrix session server information.
- Citrix Gateway communicates with the Citrix Session Host server and creates a session for application launch.
Note: In version 7.x, the Citrix Session Host server is referred to as the Citrix VDA server.
External Access With Citrix Gateway (NetScaler) Configured as ICA Proxy
![Components include Workspace ONE, Citrix Receiver, Workspace ONE Access service, Virtual App service, a Citrix components box with two StoreFronts, and NetScaler.](images/GUID-8012C907-DB78-4D4E-B1F4-19302183412E-high.png)
In this architecture, Citrix Gateway (formerly called NetScaler) is configured as a simple ICA proxy and allows only ICA requests. The external launch URL in Workspace ONE Access is configured to point to a separate internal StoreFront, which is configured to always return an ICA file that points to Citrix Gateway. Users cannot connect to Citrix Gateway directly using their user name and password.
- A user launches a Citrix-published application or desktop from the Workspace ONE Intelligent Hub app or portal.
- The request goes to the Workspace ONE Access service, which sends it to the Virtual App service.
- To communicate with the Citrix server farm to authenticate and request the ICA file, the Virtual App service sends a request to a separate StoreFront that always returns an ICA file that points to Citrix Gateway.
- Citrix Gateway forwards the request to the StoreFront server.
- The ICA file is retrieved and passed to the Intelligent Hub portal or app.
- The ICA file is passed to the Citrix Workspace app or Citrix Receiver.
- Citrix Workspace app or Citrix Receiver communicates with Citrix Gateway.
- Citrix Gateway communicates with the Citrix STA server with the STA ticket and gets the Citrix session server information.
- Citrix Gateway communicates with the Citrix Session Host server and creates a session for application launch.
Note: In version 7.x, the Citrix Session Host server is referred to as the Citrix VDA server.