Tag: Safari

Debug SAML Response in ShareFile Single sign-on (SSO)

Citrix Leave a comment
For all browsers, go to the ShareFile login page where single sign-on is enabled: https://<subdomain>.sharefile.com. Before reproducing the sign-in issue, follow the steps for the appropriate browser:

Chrome

To view a SAML response in Chrome

Please note you may need to adapt these steps accordingly with future browser updates.

  1. Press F12 to open the developer console.
  2. Select the Network tab.
  3. Select the checkbox Preserve log.
  4. On the ShareFile login page, click Sign in on the left “Company Employee Sign in” side.
  5. Locate “acs” POST request in the Name column.
  6. Under the Headers tab, locate the SAMLResponse.
  7. Copy the encoded request for further review.

Firefox

To view a SAML response in Firefox

Please note you may need to adapt these steps accordingly with future browser updates.

  1. Press F12 to open the developer console.
  2. In the developer tools window, click the options (gear) icon.
  3. Under Common Preferences, select Enable persistent logs.
  4. Select the Network tab.
  5. On the ShareFile login page, click Sign in on the left “Company Employee Sign in” side.
  6. Locate “acs” POST request.
  7. In the Form Data window, select the Params tab and locate the SAMLResponse.
  8. Copy the encoded request for further review.

Internet Explorer

To view a SAML response in Internet Explorer

The best way to analyze network traffic in Internet Explorer is through the use of a third-party tool. Follow these steps on Microsoft Technet to download and install Fiddler to capture this data.

Safari

To view a SAML response in Chrome

Please note you may need to adapt these steps accordingly with future browser updates.

  1. Open the Preferences window, select the Advanced tab, and then select Show Develop menu in the menu bar.
  2. Click Develop, then select Show Web Inspector.
  3. Select the Network tab.
  4. On the ShareFile login page, click Sign in on the left “Company Employee Sign in” side.
  5. Locate “acs” POST request in the Name column.
  6. Under the Headers tab, locate the SAMLResponse.
  7. Copy the encoded request for further review.

Decode SAML Response

Once you find the Base64-encoded SAML response, copy it and paste in your favorite SAML decoding tool to extract the XML tagged response.

Note: Because the SAML response may contain sensitive security data, we recommend you do not use an online SAML decoder tool. Instead use the built-in options below.


Decode SAML Response using Windows PowerShell

PS C:> [System.Text.Encoding]::UTF8.GetString([System.Convert]::FromBase64String("encodedSAMLtext"))

Decode SAML Response using MacOS and Linux

$ echo "encodedSAMLtext" | base64 --decode

Related:

Safari Extension Reminder Keeps Popping Up

Symantec Community Leave a comment
I need a solution

Issue:
User has Symantec DLP Endpoint Prevent installed. He goes into Safari preferences>extensions and enables the Symantec DLP browser extension. 15-20 minutes later, he will receive the reminder to enable the Safari extension again. He goes back into the Safari preferences and the extension is disabled again. He will reenable the extension again until he eventually quits using Safari. I’ve uninstalled and reinstalled the endpoint agent. Besides altering the notification settings, does anyone have suggestions on how to resolve this issue? The extension notification settings are currently set to default.

Symantec DLP Endpoint Prevent 15.5 MP1 & MP2 (Tiried two different versions)
Workstation: Mac OS X 10.14.6

0

Related:

Install ShareConnect for Mac

Citrix Leave a comment

To begin using ShareConnect, you must install the ShareConnect desktop app to turn them into remote computers for your ShareConnect account. When you install ShareConnect on your Mac, the installation package (including applications and plugins) will be downloaded onto your computer. By leaving the applications installed and the plugin enabled, you can avoid the extended download process if you need to install ShareConnect once more on your Mac.

Note: These instructions apply to Mac customers only; also see Install ShareConnect on Windows.

About the installation package

The installation package includes the following components:

  • ShareConnect desktop application

    This is the main software that is installed on your Mac to enable it be a remote computer that users can connect to from their iPad or Android tablet.
  • ShareConnect Launcher application

    This “helper” application is required to install and launch the ShareConnect desktop application. It must be installed on the computer, even if the ShareConnect application is already installed.
  • Web Deployment browser plugin (optional)

    This plugin allows your web browser to automatically start the Launcher application, which in turn launches the ShareConnect application. Although disabling or blocking the plugin will not prevent you from starting sessions, our products work best if the plugin is allowed to run when the browser prompts by clicking Allow, Run this time or Trust.

User-added image

Download ShareConnect

1. Click the Add This Computer button to initiate the software download.

User-added image

Once the web browser launches, you will see the following:

  • If the Launcher application is not installed (either first time joining or it was removed), then the Citrix Online Launcher.dmg file will automatically start downloading. Continue to Step #2.
  • If the Launcher application is already installed, then the web browser will automatically start the Launcher app, which will then launch the ShareConnect application (or install it again, if needed).

2. If the Launcher application is not already installed, the Citrix Online Launcher.dmg file will automatically begin downloading. Depending on which web browser you are running, you can complete the download as follows:

  • Apple Safari

    Double-click the “Citrix Online Launcher” file in the browser’s Downloads window

User-added image

  • Mozilla Firefox®

    Select “Open with” then click OK when prompted (click restart the download in the browser window if needed).
User-added image
  • Google Chrome™

    When the download finishes, click Citrix Online Launcher file.zip at the bottom of the page to open the file (you may need to refresh the page and/or click download & run ShareConnect).

When the Citrix Online Launcher window opens, double-click the Launcher icon

User-added image
4. You will see a message noting that “Citrix Online Launcher” is an application downloaded from the internet. Enable the “Don’t warn me […]” check box, then click Open to continue. The ShareConnect application will then finish downloading and you will need to follow the instructions on the screen to finish installation.
User-added image
Make sure that you enter your email address associated with your ShareConnect account to register your Mac as a new remote computer! You will now see the ShareConnect icon on your Menu bar.
User-added image
User-added image

Related:

RightSignature Security Updates – TLS 1.0 and 1.1

Citrix Leave a comment
As part of our ongoing efforts to provide the best security possible, we’re upgrading the security protocol used by RightSignature’s API. As of May 31, 2018, RightSignature will no longer be supporting TLS 1.0 or TLS 1.1.

Who does this impact?

1. End users (Signers and Senders) using very old browsers.

2. Partners and customers who are utilizing the RightSignature public API.

Why the change?

TLS stands for “Transport Layer Security”. RightSignature, like many web-based services, uses it to secure communication between external applications and the RightSignature API. To further strengthen the security of your documents and data, the RightSignature API will no longer support TLS 1.0 or TLS 1. 1 after May 31, 2018.

What do you need to do by June 1, 2018?

End users (Signers and Senders) should use following browser versions or newer:

a. Chrome 66
b. Firefox 59
c. IE 11
d. Safari 11.1
e. iOS Safari 11.3

Partners should contact their IT department, and ensure that they’ve enabled TLS 1.2 for connecting to the RightSignature API. This applies to all private, public, and partner applications connecting to the the API.

For more information on the risks and deprecation of TLS 1.0 and TLS 1.1, check out this blog post.

For questions related to the RightSignature API, visit our Customer Community.

Related:

  • No Related Posts

Mac OS 10.15 Catalina Support and Known Issues

Sophos Leave a comment

This article provides information about support for MacOS 10.15 Catalina, as well as known issues. It is highly advisable to read the known issues as there are several unavoidable issues in this OS release.

Apple has new enforced per application permissions in this version. Some permissions (such as user folders) will present a pop-up notice to the user to allow access, however for system level access, no notification is presented by the OS. Several Sophos services require this system level of access in order to detect and clean threats. This means that Apple will not notify users if these issues are being experienced.

All of our applications and installers are 64-bit, and will not be limited by Apple’s 32-bit restriction.

The following sections are covered:

Applies to the following Sophos products and versions

Central Mac Endpoint

Sophos Anti-Virus for Mac OS X

Operating systems

MacOS 10.15 Catalina

MacOS 10.15 Catalina overview

With the release of macOS 10.15 Catalina, Apple has added additional security lock downs to the operating system, including per application disk access lock downs. This results in several large impacting issues that must be corrected for full protection. Please see the Known Issues section below for full details. It is not recommended upgrading to 10.15 until your organization has a transition plan in place.

Required version: Sophos Endpoint 9.9.4 or above

In order to support macOS 10.15 Catalina, Sophos Endpoint 9.9.4 or above is required. Earlier versions will run if present during an upgrade, but are subject to the same known issues below, but not all permissions can be added (SophosServiceManager and SophosScanAgent cannot be added with 9.9.3), 9.9.3 and below will not install on a 10.15 system, and Central clients 9.9.2 or below will fail to communicate with Central until they update.

Sophos released 9.9.4 to Central in September 2019. 9.9.4 is also Preview subscription for Enterprise Console customers as of mid-September 2019.

For both Central and Enterprise Console, 9.9.5 releases in mid-October 2019 (to Recommended and Preview for Enterprise Console), and includes permissions popup to make installations a bit easier.

Apple has locked down the following User Folders in OS 10.15.

  • Desktop
  • Documents
  • Downloads
  • Mail
  • Safari cache

The agents will need to be added to the Full Disk Access area of security and privacy, unless otherwise noted.

All Versions

The following issues will be experienced after upgrading to macOS 10.15 and before applying the corrective steps.

  • SophosCleanD – Unable to clean up threats in the above folders
  • SophosScanAgent – On Demand scans / Scheduled scans will not detect threats in the above folders
  • Sophos Finder Scan (Through SophosScanAgent) – Will not detect threats in the above folders
  • SophosServiceManager – Parent process for SophosScanAgent
  • Sophos Diagnostic Utility (Standalone only) – User prompted to allow access to the above folders, This is “Files and Folders” access.
  • sweep – Command line scanning tool. Only used manually and only needs to be added if command line scans are being run.
  • SDU4OSX / Sophos Diagnostic Utility – Unable to access all logs

Sophos Central 9.9.4 and above

  • SophosEndpointUIServer – User is not notified of threat detection (no popup)
  • SophosCleanD – Unable to restore files (Cryptoguard) in the above folders
  • Sophos MCS Server Change – MCS has been changed to use SHA2+TLS1.2 for its connection. This uses different servers than before, and should only be an issue if specific firewall allow rules are required for the communication). (note: 9.9.3 has this change in place already)

Sophos Endpoint (Enterprise Console Managed) 9.9.4 and above

  • For initial install, all install files must be copied from the CID share locally first before running the install.
  • SophosAutoUpdate – Cannot update from SMB shares. Only HTTP/HTTPS will work until approved

Older Endpoint versions

  • Subject to the same limitations as above
  • May have other issues not covered
  • Will upgrade to 9.9.4 (other than if impacted by SophosAutoUpdate issue) even with errors
  • 9.9.2 and below will fail to communicate with MCS (Central)

The following can be performed on OS 10.14, before upgrading to 10.15, or after 10.15 has been installed. The only exception to this is SophosServiceManager, which can only be added on 10.15.

  1. Open System Preferences.
  2. Open Security & Privacy.
  3. Go to the Privacy tab.
  4. Click the lock in the lower left and authenticate to make changes
  5. Select “Full Disk Access” on the left side
  6. Leave this window open.
  7. Open a Finder window
  8. Go, go to folder
  9. Enter: /Library/Sophos Anti-virus and click go.

  10. Drag and drop the following item from the Finder window to the Security & Privacy Full Disk Access window
    • SophosAutoUpdate (Enterprise Console managed only)
    • SophosCleanD
    • SophosScanAgent
    • SophosServiceManager
    • Sophos Endpoint UIServer (Central Managed only)
    • Sophos Diagnostic Utility (from /Library/Sophos Anti-virus/tools/)

  11. You may receive a notice that some applications will not have full access until it is quit. This is fine, Later or Quit Now are both valid.

Note: The tool “sweep”, which is /usr/local/bin/, cannot be added via this method as it is not a .app. It will prompt the user the first time the tool is run in order to be allowed. It will only be called if you are using it via command line.

Alternate Method of correction:

Using an MDM solution like Apple Profile Manager, or JAMF, you can add permissions in TCC to allow these processes. Visit the following kba articles for further instructions:

KNOWN ISSUE: “Full disk access required” message displays on Catalina when using an MDM solution with the correct access (with Sophos 9.9.5). Please see this KB134833

If you’ve spotted an error or would like to provide feedback on this article, please use the section below to rate and comment on the article.

This is invaluable to us to ensure that we continually strive to give our customers the best information possible.

Related:

  • No Related Posts

Users are Unable to Start published apps as they recieve launch.jsp instead of launch.ica

Citrix Leave a comment

There are some generic rewrite policies which support the following platforms:

  • iPhone Receiver
  • iPad Receiver
  • Android Receiver
  • Blackberry Receiver
  • Mac Receiver

List of generic rewrite actions

  • add rewrite action replaceLocationJspToIca replace “HTTP.RES.HEADER(“Location”).REGEX_SELECT(re#/site/launch.jsp#)” “”/site/launch.ica”” -bypassSafetyCheck YES
  • add rewrite action replaceLaunchUrlIcaToJsp replace “HTTP.REQ.URL.PATH.REGEX_SELECT(re#/site/launch.ica#)” “”/site/launch.jsp”” -bypassSafetyCheck YES
  • add rewrite action replaceContentType replace “HTTP.REQ.HEADER(“Content-Type”)” “”application/x-www-form-urlencoded”” -bypassSafetyCheck YES
  • add rewrite action insertXmlDocument insert_before “HTTP.REQ.BODY(6).SUBSTR(0,1)” “”xmlDocument=”” -bypassSafetyCheck YES
  • add rewrite action replace_launch_jsp_in_body replace “http.RES.BODY(5000).REGEX_SELECT(re#launch[.]jsp#)” “”launch.ica””

List of generic rewrite policies

  • add rewrite policy rw_wi_302_by_ipad_iphone “(HTTP.RES.STATUS.EQ(302) || HTTP.RES.STATUS.EQ(200)) && HTTP.REQ.URL.SUFFIX.EQ(“jsp”) && (HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPad”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“Safari”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPhone”)) && HTTP.RES.HEADER(“Location”).CONTAINS(“/site/launch.jsp?CTX_UID=”)” replaceLocationJspToIca

If the above expression does not work,change it to:

(HTTP.RES.STATUS.EQ(302)) && (HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPad”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“Safari”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPhone”)) && HTTP.RES.HEADER(“Location”).CONTAINS(“/site/launch.jsp?CTX_UID=”)

  • add rewrite policy rw_wi_launch_ica_by_ipad_iphone “HTTP.REQ.URL.SUFFIX.EQ(“ica”) && (HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPad”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“Safari”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPhone”)) && HTTP.REQ.URL.PATH_AND_QUERY.CONTAINS(“/site/launch.ica?”) && HTTP.REQ.HEADER(“Cookie”).CONTAINS(“JSESSIONID=”)” replaceLaunchUrlIcaToJsp

If the above expression does not work,change it to:

HTTP.REQ.URL.SUFFIX.EQ(“ica”) && (HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPad”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“Safari”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPhone”)) && HTTP.REQ.URL.PATH_AND_QUERY.CONTAINS(“/site/launch.ica”) && HTTP.REQ.HEADER(“Cookie”).CONTAINS(“JSESSIONID=”)

  • add rewrite policy rw_wi_posthdr_by_receiver “HTTP.REQ.METHOD.EQ(POST) && HTTP.REQ.URL.SUFFIX.EQ(“jsp”) && (HTTP.REQ.URL.PATH_AND_QUERY.ENDSWITH(“enum.jsp”) || HTTP.REQ.URL.PATH_AND_QUERY.ENDSWITH(“launch.jsp”)) && HTTP.REQ.BODY(6).STARTSWITH(“<?xml “)” replaceContentType
  • add rewrite policy rw_wi_postbody_by_receiver “HTTP.REQ.METHOD.EQ(POST) && HTTP.REQ.URL.SUFFIX.EQ(“jsp”) && (HTTP.REQ.URL.PATH_AND_QUERY.ENDSWITH(“enum.jsp”) || HTTP.REQ.URL.PATH_AND_QUERY.ENDSWITH(“launch.jsp”)) && HTTP.REQ.BODY(6).STARTSWITH(“<?xml “)” insertXmlDocument
  • add rewrite policy rw_wi_200_by_ipad_iphone “HTTP.RES.STATUS.EQ(200) && HTTP.REQ.URL.CONTAINS(“launcher.jsp”) && (HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPad”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“Safari”) || HTTP.REQ.HEADER(“User-Agent”).CONTAINS(“iPhone”)) ” replace_launch_jsp_in_body

Related:

When Enrolling iPad using Enrollment Invitation wrong profile is downloaded and enrollment fails

Citrix Leave a comment

It is recommended to use the iOS URL (platform = iOS).

Safari on iPad devices, now reports itself as a macOS device.

Citrix Endpoint Management site has no option to redirect to the correct iOS site, before the browser will redirect to the right web page. As a result, the wrong profile is downloaded.

When enrolling an iPadOS device using the iOS URL (i.e. https://serverFQDN:8443/instanceName/ios/otae), the following message will be displayed. Please ignore the message and enter credentials to enroll

Note:Enrolling using OTA URL is not supported anymore for iPadOS and iOS (only for macOS)

Related: