SGD + Microsoft ISA 2006

Question

*-- Reposted as a Question -- (Didn't realise it helped get replys) :) --*
Hi,
I am hoping someone would be able to help me out here, we have recently purchased the SUN VDI and SGD which we have been looking at for sometime now, due to budgets this year it has taken some time but i have finally got there in the end and i am very happy with the VDI Service.
I am trying to get the SGD working externally at the moment but it appears to be having problems when it launches the java engine, the java client shows the following in the console
Java Plug-in 1.6.0_18
Using JRE version 1.6.0_18-b07 Java HotSpot(TM) Client VM
java.lang.ClassFormatError: Incompatible magic value 1008813135 in class file Tester
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClassCond(Unknown Source)
at java.lang.ClassLoader.defineClass(Unknown Source)
at java.security.SecureClassLoader.defineClass(Unknown Source)
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Exception: java.lang.ClassFormatError: Incompatible magic value 1008813135 in class file Tester
java.lang.ClassFormatError: Incompatible magic value 1008813135 in class file com/tarantella/tta/client/tcc/lwplugin/pluginG/TCCHelper
at java.lang.ClassLoader.defineClass1(Native Method)
at java.lang.ClassLoader.defineClassCond(Unknown Source)
at java.lang.ClassLoader.defineClass(Unknown Source)
at java.security.SecureClassLoader.defineClass(Unknown Source)
at sun.plugin2.applet.Applet2ClassLoader.findClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at java.lang.ClassLoader.loadClass(Unknown Source)
at sun.plugin2.applet.Plugin2ClassLoader.loadCode(Unknown Source)
at sun.plugin2.applet.Plugin2Manager.createApplet(Unknown Source)
at sun.plugin2.applet.Plugin2Manager$AppletExecutionRunnable.run(Unknown Source)
at java.lang.Thread.run(Unknown Source)
Exception: java.lang.ClassFormatError: Incompatible magic value 1008813135 in class file com/tarantella/tta/client/tcc/lwplugin/pluginG/TCCHelperTo be quite honest none of that makes any kind of sense to me, but hopefully someone who is quite savey with Java will know what is going on ;)
I did some logs on ISA using my External IP when access SGD and it did say connection denied to alot of .js paths so i am wondering weather it is the authentication of ISA that is stopping SGD bringing those files down from the server, the problem is i cannot allow it to not use the ISA Authentication as it needs to be over 443 and ISA obviously needs it to be secure using ISA Authentication for me to publish this.
The procedure i have to use is browse to the SGD URL, Authenticate agaist ISA which then shows me the SGD Screen, I click on Login to Desktop which then gives me the SGD login, I then authenticate into SGD which then displays the JAVA Screen at that point is when it justs sits there doing nothing.
Any help/advice will be appriciated
Many Thanks,
James.

Answer 1

Well, I've not seen this before, but I've never seen anyone attempting to use ISA Server, either - I'd hope someone with more knowledge / experience with this product can offer some advice. Until then, guess you're stuck with me ...
Anyway It would appear that the Tester.class applet is being prevented from being downloaded to your client, or is corrupted in some way. ISA Server is almost certainly causing this.
I'd first just confirm you can connect from that client to an SGD host without going through an ISA server - connect to https://sgddemo.sun.com and login anonymously, make sure that works.
You may want to first open up your Java Control Panel, and check your "Temporary Cache Files -> (View)" and then "Resources". you should see a few Java-related files, Tester.class, ttalwwin32G-jps.jar, and ttalwG-jps.jar - if present, make a note of their sizes. Delete these, and then connect to the above URL, they'll be re-loaded.
Delete these again, then attempt to access via your ISA server again; are any of them reloaded? What's their size?
As for connecting through ISA Server, I'm afraid I know little about its details, but I think it could be problematic. Are you running SGD in secure (https/aips) mode? Are you running firewall traversal mode? Once authenticated to ISA server, how is traffic directed to the SGD webserver? Is it proxied, or can you get a direct connection?
Recall that SGD has two connections between the client and the SGD server - the first is the web browser - http or https - that handles logging you in, building a webtop, launching applications, etc. The second is the AIP connection - this is your display traffic, and can be encrypted or left unencrypted. This connection is initiated by a separate client component, and uses tcp port 3144 (for unencrypted connections), 5307 (for encrypted), and most commonly port 443, in "firewall traversal" or "firewall forwarding" mode. In this mode, both https and aip traffic are tunneled on port 443, and are "demultiplexed" on the SGD server.
I'd thinking that firewall forwarding might have the best chance of succeeding in this environment, as ISA server won't be able to recognize the Java class libraries for what they are, since they're encrypted. But I'm still concerned about routing and such in an SSL environment - I'm not convinced you'll be able to route a client connection properly through the ISA server.
Anyway, a quick way to setup security/firewall traversal is using the "tarantella security enable" command line - it'll create a self-signed cert, install it, and configure firewall traversal. Or, if you have a permanent cert, will install that as well.
Here's where I'd recommend you use the Secure Gateway as an alternative entry point to your network ...