XenMobile Server 10.3 Rolling Patch 2

Package name: xms_10.3.0.10032.bin
For: XenMobile Server 10.3.0
Deployment type: On-premises only
Replaces: xms_10.3.0.10004, xms_10.3.0.10010, xms_10.3.0.10014, xms_10.3.0.2002, xms_10.3.0.3006
Date: April, 2016
Languages supported: English (US)
Readme version: 1.00

Readme Revision History

Important Notes about This Update

Note: As a best practice, Citrix recommends that you install this and other updates only if you are affected by the specific issues they resolve.

Where to Find Documentation

This document describes the issue(s) resolved by this release and includes installation instructions. For additional product information, see XenMobile Server 10.3 on the Citrix Product Documentation site.

Known Issue(s) in this Release

1. The log file sizes and maximum number of backup files that you configure through the XenMobile console are not reflected in the console. The settings are also not retained when you restart the XenMobile server.

   [#551199]

New Fixes in This Update

1. When adding Google Play credentials in XenMobile server, the error "Invalid device ID" appears and you cannot log on.

   [From xms_10.3.0.10032.bin][#623182]

2. On April 13, 2016 the WH-APNs certificate for XMS 10.3 application pushing will expire in the XenMobile solution. Agent Notification cannot run because of the expiration of Worx Home APNs certificate. This new certificate will expire on December 10, 2016 at 11:43 AM PST.

   [From xms_10.3.0.10032.bin][#628329]

3. In the XenMobile console, when you add a public app store app for the Windows phone and tablet platform, searching for a public app returns no results and an error message appears.

   [From xms_10.3.0.10032.bin][#627984]

4. This fix addresses a security vulnerability. For more information, see security bulletin http://support.ctx.org.cn/CTX207824.citrix.

   [From xms_10.3.0.10032.bin][#624347]

5. This fix addresses a security vulnerability. For more information, see security bulletin http://support.ctx.org.cn/CTX206991.citrix.

   [From xms_10.3.0.10032.bin][#623687]

6. If you set the server property wsapi.mdm.required.flag (enrollment required) to true from the default setting of false, required apps do not automatically deploy to users with iPads when they enroll. Users must open the WorxStore a second time in order to receive the required apps.

   [From xms_10.3.0.10032.bin][#620781]

7. Policy deployments and RBAC role assignment might fail if explicit UPN doesn't match implicit UPN for the user.

   [From xms_10.3.0.10032.bin][#617227]

8. Users cannot log on to RBAC admin console if using "domainalias\samaccountname" and the page redirects to self help portal.

   [From xms_10.3.0.10032.bin][#610915]

9. On iPads, XenMobile 10.3 always carries out deletion (or removal) actions first, regardless of the order you set in the XenMobile console.

   [From xms_10.3.0.10032.bin][#620459]

10. Users are unable to authenticate to Worx Home after an upgrade from XenMobile 9.0 to XenMobile 10.1 followed by setting the LDAP option User search by to sAMAccountName and then upgrading to XenMobile 10.3.x.

    [From xms_10.3.0.10032.bin][#624340]

11. When users enroll a device, occasionally Worx Home crashes with an 403 error message stating that the app store is locked. Alternately, users may enroll successfully, but when downloading an app, the same error occurs or an error stating “unable to fetch details.

    [From xms_10.3.0.10032.bin][#633515]

12. When users enroll a device, MDM enrollment is successful but occasionally MAM registration fails with an error, your apps are locked.

    [From xms_10.3.0.10032.bin][#632073]

13. Some VPP licenses have negative IDs, such as -123441212, in which case you cannot distribute the public apps.

    [From xms_10.3.0.10032.bin][#631443]

14. When you import VPP licenses to XenMobile, if some licenses were refunded by Apple, the licenses are considered valid in XenMobile in error. As a result, users cannot install apps on iOS devices through the Worx Store.

    [From xms_10.3.0.10032.bin][#601845]

Fixes from Replaced Releases

1. This fix ensures that when a user sets the log file size and maximum number of backup log files, these values are configured correctly in XenMobile and the files roll over properly. However, the XenMobile console might not reflect the updated values as noted in Known Issue #551199.

   [From xms_10.3.0.10004.bin][#597772]

2. When you have an Advanced license type and you select the Enrollment required check box in the XenMobile console, users can register in MAM-only mode and access the Worx Store.

   [From xms_10.3.0.10004.bin][#604113]

3. When users try to remove an app or weblink from within Worx Home, the following error appears: Worx Home could not connect.

   [From xms_10.3.0.10004.bin][#599934]

4. The properties $user.dnsroot and $user.netbiosename are used in macros to deploy policies using user properties. The dnsroot and netbiosename user properties were deprecated in XenMobile 10.1. This fix enables these properties again in XenMobile 10.3.

   [From xms_10.3.0.10004.bin][#604240]

5. When you configure a WiFi device policy, even though the deployment schedule is set to Only when previous deployment has failed, the WiFi policy is pushed to devices every time the device connects.

   [From xms_10.3.0.10004.bin][#610325]

6. Security patch: This addresses Vulnerability Note VU#576313: Apache Commons Collections Java library insecurely deserializes data.

   [From xms_10.3.0.10004.bin][#610427]

7. PIN-based enrollment might fail if multiple PINs are in a pending state for users. The issue occurs when users try to enroll in one instance without an invitation link.

   [From xms_10.3.0.10004.bin][#600264]

8. When the iOS device is registered in Device Enrollment Program (DEP), Worx Home might not download to the iOS device.

   [From xms_10.3.0.10004.bin][#595822]

9. When you have LDAP configured with different base DNs for users and groups, after updating to XenMobile 10.3, you cannot add new groups to delivery groups.

   [From xms_10.3.0.10004.bin][#610014]

10. When you configure LDAP with a lockout limit, after upgrading to XenMobile 10.3, when a new user in the same domain enrolls a device in Worx Home with invalid credentials, such as a mistyped password, Worx Home stops responding and SQL Server fails.

    [From xms_10.3.0.10004.bin][#615179]

11. Occasionally, the XenMobile server goes into recovery mode after about 20 to 30 minutes due to a known Java Runtime Environment (JRE) issue. After restarting the server, the issue occurs again.

    [From xms_10.3.0.10004.bin][#616992]

12. When a server has a custom instance name, after updating from XenMobile 10.1 to XenMobile 10.3, users cannot enroll devices.

    [From xms_10.3.0.10004.bin][#616954]

Installing This Update

Important: Before installing this update, take a snapshot of the current settings and create a backup of the database.

For installation instructions, see Upgrading XenMobile on the Citrix Product Documentation site.

Note: XenMobile might not require a restart after the update installs. In this case, a message indicates that the updated installation is successful. If, however, XenMobile does require a restart, you must use the command line.

Important: If your system is configured in cluster mode, follow these steps to update each node:

1. Download and extract the content of the zip file on a Windows machine.
2. Upload the .bin file on all nodes.
3. Shut down all the nodes.
4. Bring up one node and check that the service is running.
5. Bring up other nodes.

If for some reason the update cannot be completed successfully, an error message appears indicating the problem. The system reverts to its state prior to the update attempt.

To verify the patch deployment

After installing this patch, log on to the XenMobile console as an administrator, then navigate to Settings page > Release Management > Updates. Information about the most recent successful patch installation appears in this section.