Skip to content

Applications

The Applications module is the central module for declaring the applications (formerly resources) that Bastion users then see in their portal. Each application declares a service type (the access protocol: RDP, SSH, VNC, Web, SMB…) and a set of target, user-experience, security and recording parameters. This page describes the module interface: list, filters, add and edit form, agent actions and import/export.

Accessible from the administration console, this module is also opened in bulk mode from other modules (for example RDS servers) to create several applications at once from a single template.

Application list

The main window shows a paged list of applications.

Column Description
Name Application name, preceded by an icon representing the service type.
Application type Privileged (monitored access) or Standard.
Service Service type, that is, the access protocol (see table below).
Recorded videos Icon showing whether the session is recorded.
Server Address of the target server and associated Edge Gateway. For dynamic-target applications, the IP range / IP list / IP + mask. For Citrix Storefront, the URL. For the generic tunnel, the list of server:port targets.
SSO Configured SSO mode (Enabled, Disabled, Request, Fixed with the alias name).
Tags Associated tags. Column hidden by default.
Description Free text description. Column hidden by default.

The number of rows per page is configurable.

Fields covered by the search field

The search applies by substring, simultaneously across five fields: the name, the description, the tags, the target server and the service type. An application is therefore retained as soon as one of those five fields contains the text entered — including the two columns hidden by default.

Supported service types

The Service type drop-down list of the form offers the following values, sorted alphabetically by label. The right-hand column gives the matching technical identifier, the one used by the public API and by the CSV import / export file.

Service type (displayed label) Role Identifier
Citrix ICA Citrix session through the ICA client. ica
Citrix Storefront Citrix Storefront portal. nfuse
HTML5 (RDP) RDS session rendered in the browser. html5rdp
HTML5 (SSH) SSH terminal in the browser. html5ssh
HTML5 (VNC) VNC session in the browser. html5vnc
netBIOS NetBIOS share mounted as a drive. netBios
RDS Windows Remote Desktop session, native client. rdp
Reverse proxy Web application published through a reverse proxy, with recording. webrecord_rp
SMB SMB file share. smb
SSH (Secure Shell) SSH terminal, native client. ssh
Generic tunnel TCP/UDP tunnel towards one or more server:port targets. redirectionport
VNC (Virtual Network Computing) VNC session, native client. vnc
VPN Isolated VPN access. vpn
Web Recorded web application. webrecord_web

Availability

The three HTML5 types are offered at creation time only when the HTML5 feature is enabled on the platform; otherwise they remain visible for editing only. The VPN, Generic tunnel, Citrix Storefront, Citrix ICA, SMB and netBIOS types exist for Standard applications only.

Agentless mode for RDS

The RDS and HTML5 (RDP) types can run with or without a Bastion agent deployed on the target server: this is a checkbox of the form, not a separate service type. Visually the application icon differs (colour icon with agent, grey icon without), and the list filters do distinguish both variants. The recorded metadata varies accordingly:

Access Keystrokes Clipboard Window opening / closing Program launch
RDS with agent ✓ ✓ ✓ ✓
RDS without agent ✓ — — —
SSH ✓ N/A N/A N/A
VNC ✓ — — —

Filters

A collapsible filter area above the grid narrows the list:

Filter Description
Application type Privileged and/or Standard check-boxes.
Service type A check-box per type, each with its icon.

Click Display to apply, Reset to clear every filter.

Create an application

Click the + button. The creation form opens. Creation happens in two steps:

  1. pick the application type (Privileged / Standard) then the service type;
  2. fill in the fields — these vary strongly with the chosen service type.

The form is organised into two tabs.

Fields common to almost every application (except a few highly specific types).

Field Description
Name Mandatory, unique. Characters @ and , are forbidden.
Description Free text.
Category Display category in the portal (see the Categories module).
Tags Free tags, entered one by one and added with the Add button. A tag already attached is rejected. Attached tags are shown in a dedicated fieldset.
Ask for a comment to the user Asks the user to enter the context of their connection before launch. The comment is available in the recorded video.
Check video integrity at playback Computes and checks the hash of recordings.
Allow manual removal of archives Lets an authorised administrator delete a specific video.
Delete archives automatically Turns on automatic retention.
Archives conservation time (days) Duration in days, between 1 and a configured maximum. Only available when the previous box is ticked. Default: 365.

Pick the service type and fill the specific parameters. Once a type is chosen, several fieldsets appear:

  • Access — target server, port, dynamic mode (IP range, IP list, IP + mask), authentication domain, RDS broker…
  • SSO — see section SSO.
  • Remote application — only for RDP types: RemoteApp mode, published application name, launch directory, parameters.
  • View — resolution, colour depth, dynamic resize, keyboard layout, wallpaper, console mode.
  • Advanced settings — collapsible fieldset with options specific to the service type (CREDSSP/NLA, Restricted Admin, Kerberos disabling, redirections, timeouts, etc.).

Dynamic mode

For the RDS, HTML5 (RDP), SSH, HTML5 (SSH), VNC, HTML5 (VNC) and Generic tunnel types, the target can be entered as an IP range, an IP list or an IP + mask instead of a fixed server. The end user then enters the exact address at launch time.

Click Validate to save. Before saving, several checks apply:

  • the form must be valid;
  • pre-authentication SSO data (for Web resources) is validated;
  • if SSO is Fixed, at least one Keeper alias must be selected;
  • for the generic tunnel, at least one target must be defined (except in dynamic mode);
  • for non-dynamic targets, a duplicate target-server check is run; a list of applications already sharing the same target is shown and the administrator is asked to confirm.

Edit or delete an application

  • Edit: select an application and click the Properties icon, or double-click the row. The form is identical to the creation form.
  • Delete: select one or more applications and click the × button. A confirmation is asked; the text differs between a single-selection and a multi-selection.
  • Duplicate: select one or more applications and click Duplicate Application. Each copy takes the original name followed by a number in brackets — (1), then (2), (3)… up to the first free name. The following are copied over: the service parameters, the tags, the associated administrator groups and, when SSO is in Fixed mode, the attached vault aliases. The button stays disabled as soon as the selection holds a non-duplicable application.

SSO

For every compatible service type, an SSO field picks the authentication method used at launch.

Mode Description
Enabled The Bastion user's credentials are passed to the target service.
Disabled No credentials are sent; the user authenticates manually.
Request The user enters credentials just before launch.
Fixed Credentials are taken from a vault alias. An Alias field appears to pick the alias to use.

SSO not available

For the SMB and netBIOS types, SSO is conceptually unavailable: the field shows a greyed-out label instead of the drop-down list.

SSO is incompatible with SAML domains

The Enabled mode assumes the platform knows the user's password, so that it can forward it to the target service. That is not the case when the user authenticates against a SAML authentication domain: the password is entered at the identity provider, which does not pass it on. An application in Enabled SSO mode is therefore unusable by the users of such domains — reserve the Request or Fixed mode for them, as both take the credentials elsewhere.

SSO for Reverse proxy and Web types

For the Reverse proxy and Web types, if the SSO mode is different from Disabled, an extra SSO section appears in the Service tab.

For Reverse proxy, the section exposes three summary fields:

Field Description
Login attribute Name of the parameter that will carry the login.
Password attribute Name of the parameter that will carry the password.
Extra attributes Complementary parameters.

An Advanced settings check-box gives access to a free-form configuration (parameters and headers).

For Web, the section additionally exposes an SSO type field:

Type Description
Classic Behaviour identical to Reverse proxy.
Form preload The HTML form is fetched, filled and submitted automatically. Additional fields: SSO URL, Form mode (HTTP method), CSRF token input name.
Preauthentication A series of HTTP requests is sent before the final redirect. A Configuration of preauthentication steps button opens a dedicated window.

Pre-authentication step configuration

The configuration window lists the already-defined requests (URL, method, sending order).

Adding a request with the + button opens a form with:

Field Description
URL Request URL, prefixed by the service's configured host.
Method GET or POST.
Enable cache Useful only for GET.
Login parameter / Password parameter Optional parameter names.
ContentType (MIME) Lets you specify for example application/json.

The Advanced settings check-box exposes two extra tabs: Settings and Headers, each used to add name/value pairs.

Special value syntax

The Value field (parameters, headers, cookie values) accepts placeholder strings. The Disable special syntax check-box takes the value literally; entries created this way are shown in italics in the list.

Placeholder Effect
%user% Login used for SSO.
%password% Password used for SSO.
%base64([...])% Base64-encode.
%lowercase([...])% / %uppercase([...])% Lowercase / uppercase.
%trim([...])% Trim leading and trailing whitespace.
%uriencoded([...])% URI-encode special characters.
%md5([...])% MD5 hash.
%sha256([...])% SHA-256 hash.
%hmacmd5(data,key)% HMAC-MD5 (parameters separated by %,%).
%rsa(key,data)% RSA encryption.
%rsaoaep(key,data)% RSA-OAEP encryption (PEM key).
%reqresult(n)% / %reqresult(n,key)% Fetches the result of the n-th previously sent request, optionally filtered by key name.
\% Literal percent sign.

Data-creation steps

A submenu of the add button lets you add a data creation step (as opposed to a request). The data type can be:

Type Effect
Local variable Stored in the browser's local storage.
Session variable Stored in the browser's session storage.
Cookie Stored in a cookie. Exposes extra fields: Path (default /), Lifetime (in hours; empty = no expiration, 0 or negative = immediate expiration), Secured cookie (HTTPS required), SameSite (Strict, Lax, None).

Agent actions

Agent actions are only offered for privileged applications of the RDS or HTML5 (RDP) type, and only when the agentless mode is unchecked. Two buttons are available in the toolbar.

Deploy the agent

Clicking Agent deployment opens a form pre-filled with the selected server list.

Field Description
Target server Target server address (auto-filled for a single server).
Target drive Drive letter on which to install the agent (for example C).
Target directory Installation path.
Gateway Edge Gateway used for deployment.
Domain Active Directory domain.
Username / Password Local or domain administrator account allowed to install the agent.

Click Validate; the installation status is then polled by the console.

Remove the agent

Clicking Agent removal opens a similar form that collects the same authentication and target information to uninstall the agent.

Export / import

  • Export: downloads the filtered list as a .csv file. A preliminary check may show warnings that the administrator must confirm one by one.

  • Import: opens the .csv import window. Fields to fill in:

    • File — the .csv file;
    • Record delimiter — the column separator, ; for a file produced by the export;
    • Field values delimiter — the separator for multiple values, + for a file produced by the export.

    After validation, a window summarises the result for each line of the file.

File columns

The file holds one header row, then one row per application. The columns are the same throughout the file, whatever the service types exported: the export produces the union of every possible parameter, and each row then fills in only the columns that concern its own type. The others stay empty.

The columns are laid out below by family of service types. The common trunk is filled in whatever the type; the other tabs only concern applications of the stated type.

In practice, start from an export

To create applications in bulk, the simplest route remains to export an already configured application of the target type, then duplicate and edit its rows: unused columns are left empty, and the header gives the exact titles in the console language.

A shared column appears only once in the file

Several service types use the same parameters: a column such as Resolution is therefore listed in each tab concerned, but the file holds it only once.

Column Expected format
Name (mandatory) text
Description text
Category (mandatory) text
Comment True / False
Integrity True / False
Manual deletion True / False
Archives conservation time integer
Service Type (mandatory) text
Presented message text
Authorized IP address text
End IP range IP address
Start IP range IP address
Subnet IP IP address
SSO text
Subnet mask text
Authorized networks text
Dynamic True / False
Vidéo recording text
Server text
Port integer
Application type text
Launch VNC application True / False
Column Types concerned Expected format
Without agent HTML5 (RDP), RDS True / False
Embedded gateway HTML5 (RDP), RDS True / False
Gateway name HTML5 (RDP), RDS text
Resolution HTML5 (RDP), RDS text
Console mode HTML5 (RDP), RDS True / False
Remote Executable HTML5 (RDP), RDS text
Launch Directory HTML5 (RDP), RDS text
Authentication Domain HTML5 (RDP), RDS text
Background HTML5 (RDP), RDS True / False
RemoteApp mode HTML5 (RDP), RDS True / False
RemoteApp name HTML5 (RDP), RDS text
RDS Broker HTML5 (RDP), RDS True / False
Disable Kerberos HTML5 (RDP), RDS True / False
Acquire the Kerberos TGT HTML5 (RDP), RDS text
Time before disconnection (seconds) HTML5 (RDP), RDS integer
RDP broker server collection HTML5 (RDP), RDS text
Use another client program RDS True / False
Alternate client program executable RDS text
Client program arguments RDS text
Full Screen RDS True / False
CSSP RDS True / False
Clipboard RDS True / False
Plug and play RDS text
Redirect Audio RDS True / False
Install Disks RDS True / False
Install Printers RDS True / False
Connect COM Ports RDS True / False
Colors HTML5 (RDP), RDS integer
Change title of RDP RDS True / False
Enable the restrictedadmin option RDS True / False
Custom RDP file parameters RDS text
Mstsc args RDS text
Enable AUP RDS True / False
Launch TSE executable RDS True / False
Force RDP auth on client side RDS True / False
Enable wallpaper RDS True / False
Ignore client-side cert RDS True / False
Ask interaction mode HTML5 (RDP) True / False
Redirect Clipboard HTML5 (RDP) True / False
Keyboard format HTML5 (RDP) text
Security HTML5 (RDP) text
User Domain HTML5 (RDP) True / False
Visual styles HTML5 (RDP) text
Customize variable clientname HTML5 (RDP) text
RemoteApp parameters HTML5 (RDP) text
Resize method HTML5 (RDP) text
Extended Clipboard (HTML) HTML5 (RDP) True / False
Font smoothing HTML5 (RDP) True / False
Change the title of tab HTML5 (RDP) True / False
Enable file transfer HTML5 (RDP) True / False
Column Types concerned Expected format
Command to execute at launch HTML5 (SSH), SSH text
Enable file transfer HTML5 (SSH), SSH True / False
Password injection settings HTML5 (SSH), SSH list (+)
Use another client program SSH True / False
Alternate client program executable SSH text
Client program arguments SSH text
Remote Executable SSH text
Parameters SSH text
Local Port SSH integer
Remote Server SSH text
Enable X11 forwarding SSH True / False
local ip SSH IP address
local port SSH integer
Launch Executable SSH True / False
Remote commands file SSH text
Ask interaction mode HTML5 (SSH) True / False
Redirect Clipboard HTML5 (SSH) True / False
Authentication Domain HTML5 (SSH) text
Console mode HTML5 (SSH) True / False
Backspace character HTML5 (SSH) integer
Terminal type (xterm, vt100 ...) HTML5 (SSH) text
Column Types concerned Expected format
VNC proxy address HTML5 (VNC), VNC text
Resize method HTML5 (VNC), VNC integer
Encoding HTML5 (VNC), VNC text
VNC proxy port HTML5 (VNC), VNC text
Compression level HTML5 (VNC), VNC integer
JPEG Quality HTML5 (VNC), VNC integer
Change title of RDP HTML5 (VNC), VNC True / False
Change the title of tab HTML5 (VNC), VNC True / False
Ignore client-side cert HTML5 (VNC), VNC True / False
Custom RDP file parameters HTML5 (VNC), VNC text
Use another client program VNC True / False
Alternate client program executable VNC text
Client program arguments VNC text
Resolution VNC text
Ask interaction mode HTML5 (VNC) True / False
Redirect Clipboard HTML5 (VNC) True / False
Column Types concerned Expected format
Virtualhost Reverse proxy, Web text
URL Reverse proxy, Web text
https Reverse proxy, Web True / False
Authentication type Reverse proxy, Web integer
SSO type Reverse proxy, Web text
Form mode Reverse proxy, Web integer
Login attribute Reverse proxy, Web text
Password attribute Reverse proxy, Web text
Extra attributes Reverse proxy, Web text
SSO settings Reverse proxy, Web text
SSO URL Reverse proxy, Web text
Forbidden Urls Reverse proxy, Web list (+)
SSO on classic HTML forms Reverse proxy, Web True / False
Advanced settings Reverse proxy, Web True / False
csrf Reverse proxy, Web text
IP address(es) Web list (+)
additional networks Web True / False
Column Types concerned Expected format
Authentication Domain Citrix ICA, Citrix Storefront text
Number of colors Citrix ICA integer
Resolution Citrix ICA text
Keyboard type Citrix ICA text
Keyboard Configuration Citrix ICA text
Remote application Citrix ICA text
Borderless window Citrix ICA True / False
Launch ICA application Citrix ICA True / False
Storefront server URL Citrix Storefront text
Protocol Citrix Storefront text
URL Citrix Storefront text
composed URL Citrix Storefront text
List of IPs or domains Citrix Storefront text
Citrix version Citrix Storefront integer
Enable SSO for web portal access Citrix Storefront text
Enable SSO for ICA connections Citrix Storefront text
Enable web parsing Citrix Storefront True / False
Enable handling of Session Reliability mode Citrix Storefront True / False
Column Types concerned Expected format
Display VPN state graphical user interface VPN True / False
Mode VPN text
Protocol Generic tunnel, VPN text
Network VPN IP address
Netmask VPN IP address
User IP address allocation policy VPN text
DNS suffixes VPN text
Redirect all network flows in the VPN tunnel (full tunneling) VPN True / False
Routes pushed VPN list (+)
Authorized IP addresses VPN list (+)
Forbidden IP VPN list (+)
IP ranges VPN list (+)
Allowed network masks VPN list (+)
DNS Servers VPN list (+)
URL Generic tunnel text
Remote Server Generic tunnel text
Remote port Generic tunnel integer
Local server Generic tunnel text
Local Port Generic tunnel integer
Default remote port Generic tunnel integer
Inform user Generic tunnel True / False
Launch Executable Generic tunnel True / False
Launch in a web client Generic tunnel True / False
Executable Generic tunnel text
Parameters Generic tunnel text
Enable URL rewriting Generic tunnel True / False
Avoid windows authentication Generic tunnel True / False
Preserve Host header Generic tunnel True / False
SSO on classic HTML forms Generic tunnel text
Login attribute Generic tunnel text
Password attribute Generic tunnel text
Form mode Generic tunnel integer
Extra attributes Generic tunnel text
Redirections Generic tunnel list (+)
Column Types concerned Expected format
Share(s) SMB text
Force download SMB True / False
Display IP SMB True / False
Drive choice netBIOS text
Drive label netBIOS text
Replace an existing network drive netBIOS True / False
Launch Windows explorer netBIOS True / False
Share netBIOS text

Syntax

Element Separator Example
Columns ; Name;Description;Category;…
Multiple values inside one cell + 10.0.0.1+10.0.0.2
Delegated administrator group @ between the group and its domain AdminsAccounting@AD-Internal
Booleans — True or False; an empty cell counts as False
Integers — Bare value; an empty cell takes the field default

The Name, Category and Service Type columns are mandatory: a row missing one of them is rejected. The category is the only case where an unknown value is created on import; every other referenced value must already exist.

Access contracts

Declaring an application does not make it available to users. You then have to create an access contract that binds an application, one or more user groups and an optional access condition.