Skip to main content

​
Before you start

  • Neo uses the Parallels RAS REST API, which the RAS Web Administration Service serves at https://<server>:20443/api/ unless you changed its port.
  • Neo reaches the farm over the internet. The REST API must answer on HTTPS with a certificate from a public certificate authority, at a public address. RAS’s own certificate is self-signed, so Neo refuses it: put a reverse proxy with a public certificate in front of the API, or give the Web Administration Service a public certificate.
  • Neo connects to each client’s farm on its own. Add the client to your Companies tab first.

​
If the RAS server is only on the client’s internal network

Most are. This guide publishes only the REST API, never the RAS Console or the user portal, through a reverse proxy at the client’s network edge that:
  • answers on a public name over HTTPS, with a certificate from a public certificate authority;
  • forwards only paths under /api/ to the RAS server, and refuses every other path;
  • accepts connections only from Neo’s addresses;
  • passes the auth_token header through.
Save the proxy’s public address in Neo.

​
1. Make a RAS administrator for Neo

1

Create the user

Create a domain user for Neo, such as ACME\neo-ras, with a strong password that does not expire without notice.
2

Make it a RAS administrator

In the RAS Console, open Administration > Accounts, add Neo’s user, and give it the permissions your agents need: a power administrator with view rights for an agent that only reads; the right to manage sessions, RD Session Hosts and publishing for the drain, session and publishing jobs; a root administrator only when Neo should also change farm settings.
Neo can do only what this administrator may do, whatever the agent’s access profile says.
If the password expires or you lock the user, Neo loses access to that client’s farm until you save the new password here.

​
2. Add the connection in Neo

1

Open Integrations

In the Neo Dashboard, open Integrations → Parallels RAS, under Servers & Virtualization.
2

Pick the client

In Customer, choose the client this farm belongs to. The client must be on your Companies tab. For a second client, click Add customer.
3

Save the address, user name and password

Enter the Server URL with its port (for example https://ras.example.com:20443, or the proxy’s address), Neo’s User name (such as ACME\neo-ras) and its Password, then click Save settings. Neo signs in and out again before saving, so a wrong address or a refused password is rejected straight away, with what to fix.

​
3. Turn Parallels RAS on per agent

Open the agent, go to the Integrations section, and configure the Parallels RAS block. Agents see only what Neo’s RAS administrator can see.

​
Pick an access profile

Read Only

Read farm health, hosts, sessions, published resources and licence use. Nothing is changed.

Helpdesk

Host, session and publishing changes (drain a host, log off a session, publish or unpublish an application) wait on a technician. Everything else is read only.

IT Admin

Host, session, publishing and client policy changes run without approval, except the changes that always ask. Farm server, settings and administrator changes wait on a technician.

Full Automation

Every change runs without approval, except the changes that always ask a technician.
To publish and unpublish applications only after a technician approves, use Helpdesk, or set Published Resources to Read/Write with technician approval.

​
Or set each area by hand

Each area can be Disabled, Read Only or Read/Write, and has its own technician approval setting.

​
Changes that always ask a technician

These wait on a technician under every profile, whatever the area’s own approval setting:
  • Deleting a site, a Connection Broker, a Secure Gateway, an Enrollment Server, a HALB, a provider, an RD Session Host, a host pool, a template, an AVD workspace, a VDI host, a tenant, a certificate or a RAS agent.
  • A reboot, shutdown, stop, reset or restart, and recreating a host pool’s hosts or a template’s desktops.
  • Creating a reboot, shutdown or disable schedule, changing any schedule, adding a host to one, and changing the auto-upgrade settings, which drain hosts and can log off their sessions.
  • Activating or deactivating the RAS licence, and promoting a site or a Connection Broker.
  • Sending a support request or a system report to Parallels.
  • Joining or leaving a tenant broker, and making a new tenant join hash or invitation.
  • Changing the Web Administration Service settings, which serve the REST API Neo calls.
  • Any change to administrators, administrator sessions, multi-factor authentication or authentication.
  • Any change that stores a credential: a password, a secret key, a licence key or a join hash.

​
Troubleshooting