text:
This article applies to Federated Authentication Service (FAS) versions 2003, 1912 (LTSR), 1909, 7.15.5000 (LTSR), and all other versions 7.9 and newer.
- Change Log
- Overview
- Install/Upgrade FAS Service
- FAS Group Policy
- FAS Configuration
- StoreFront Configuration
- SAML Configuration:
- Active Directory Shadow Accounts
- Verify FAS
Change Log
- 2020 Mar 28 – updated Versions and Install sections for version 2003
- 2020 Mar 18 – Configure SAML on Citrix ADC – added note about nFactor requirement for Workspace app support
- 2020 Feb 3 – Overview – added link to CTA Julian Mooren Citrix FAS – Notes from the Field
- 2019 Dec 21 – updated Versions and Install sections for version 1912
- 2019 Oct 23 – updated Versions section for version 7.15.5000
- 2019 Sep 21 – updated Versions and Install sections for version 1909
- FAS 1909 has a completely new GUI to perform FAS Configuration
- 2019 Jul 7 – FAS Configuration – added link to Set up multiple CA servers for use in FAS at Citrix Docs
- FAS Configuration – added link to Citrix Blog Post Automating the Citrix Federated Authentication Service with PowerShell
- 2019 Jun 21 – updated Versions and Install sections for version 1906
- 2019 Apr 23 – updated Versions section for version 7.15.4000
- 2019 Apr 1 – FAS Configuration – added PowerShell command to show expiration date of Authorization certificate (h/t CTP Carl Webster)
- 2019 Mar 28 – updated Versions and Install sections for version 1903
- 2019 Feb 4 – Overview – added link to Michael Shuster HowTo: Active-Active Multi-Datacenter Citrix FAS.
- 2018 Dec 19 – ADC SAML Configuration – updated for ADC 12.1, including metadata import
- Azure AD as SAML Identity Provider – new section
- SAML Traffic Flow – new section
Citrix Federated Authentication Service (FAS) enables users to log in to Citrix Gateway and Citrix StoreFront using SAML authentication.
With SAML, Citrix Gateway and StoreFront do not have access to the user's password and thus cannot perform single sign-on to the VDA. FAS works around this limitation by using issuing certificates that can be used to logon to the VDA.
- StoreFront asks Citrix Federated Authentication Service (FAS) to use a Microsoft Certificate Authority to issue Smart Card certificates on behalf of users.
- The certificates are stored on the FAS server.
- The VDA requests the user's certificate from FAS so it can complete the VDA Windows logon process.
FAS can be used for any authentication scenario where the user's password is not provided.
- Microsoft Certification Authority (CA) in Enterprise mode.
- When configuring FAS you tell it what CA server to use.
- You can build a new CA server just for FAS.
- You can install CA on the FAS server.
- Domain Controllers must have Domain Controller certificates. See CTX218941 FAS – Request not supported.
- The certificates on the Domain Controllers must support smart card authentication. Certificates created using the Microsoft CA certificate template named Domain Controller Authentication supports smart cards. Manually created Domain Controller certificates might not work. See CTX270737 for the Domain Controller certificate requirements.
- The certificates on the Domain Controllers must support smart card authentication. Certificates created using the Microsoft CA certificate template named Domain Controller Authentication supports smart cards. Manually created Domain Controller certificates might not work. See CTX270737 for the Domain Controller certificate requirements.
- Citrix Virtual Apps and Desktops or XenApp/XenDesktop 7.9 or newer
- StoreFront 3.6 or newer
- NetScaler Gateway or Citrix Gateway.
- StoreFront 3.9 and newer also support SAML authentication natively without Citrix ADC.
- SAML is web-based authentication and thus requires a browser.
- SAML authentication might work in the newest builds of Workspace app and Citrix ADC 12.1 (and newer) if you configure nFactor. However, nFactor (Authentication Virtual Server aka AAA) requires ADC Advanced Edition or ADC Premium Edition.
Configuration overview:
- Build one or more FAS servers.
- For security reasons, FAS should be its own server and not installed on a Delivery Controller.
- Upload Certificate Templates to Active Directory and configure a CA server to issue certificates using the new templates.
- One of the Certificate Templates is for Smart Card logon to Citrix VDA.
- The other two Certificate Templates are to authorize FAS as a certificate registration authority.
- The registration authority certificate does not renew automatically so be prepared to renew it manually every two years. For details, see Renew registration authority certificates at Citrix Docs.
- Install the Citrix FAS group policy .admx template into PolicyDefinitions.
- Create a group policy object (GPO) and configure the GPO with the addresses of the FAS servers.
- The GPO must apply to FAS servers, StoreFront servers, and every VDA. It does not need to apply to Delivery Controllers, but there's no harm in applying it to the Delivery Controllers.
- Authorize FAS to request certificates from a Microsoft CA server.
- Configure FAS Rules to permit StoreFront servers to request FAS to generate certificates for users and permit VDA machines to retrieve the certificates from FAS.
- Configure StoreFront to use FAS for VDA single sign-on.
- CTA Julian Mooren Citrix FAS – Notes from the Field
- CTP Wilco van Bragt Citrix Federated Authentication Service (FAS) Tips and Tricks
From Citrix CTX225721 Federated Authentication Service High Availability and Scalability: you can build multiple FAS servers. Enter all FAS server FQDNs in the Group Policy. StoreFront will then use a hashing algorithm on the username to select a FAS server.
- If you have less than 10K users, one FAS server with 4 vCPUs (2.5Ghz) should be sufficient.
- You will require a minimum of one FAS server (with 8 vCPUs) per 25,000 users if all users expect to be able to logon under cold start conditions (no keys or certificates cached) within 60-90 minutes.
- A single FAS server can handle greater than 50K users under warm start conditions (keys and certificates pre-cached)
- One reserve FAS server for every four FAS servers for "Day 1" cold start (Users get new keys/certificates) & disaster recovery scenarios
- Split the FAS Certificate Authority from Certificate Authority that performs other tasks for both security and scalability purposes.
Michael Shuster explains the Group Policy configuration for FAS in multiple datacenters at HowTo: Active-Active Multi-Datacenter Citrix FAS.
Also see the Citrix Federated Authentication Service Scalability whitepaper.
Federated Authentication Service Versions
The most recent Federated Authentication Service Current Release is version 2003.
- FAS version 2003 is included in the Citrix Virtual Apps and Desktops 7 2003 ISO.
For LTSR versions of Citrix Virtual Apps and Desktops (CVAD) and StoreFront, install the version of FAS that comes with the CVAD LTSR version.
- FAS LTSR version 1912 is included in the Citrix Virtual Apps and Desktops 7 1912 LTSR ISO.
- FAS LTSR Version 7.15.5000 is included on the XenApp/XenDesktop 7.15.5000 LTSR ISO.
Install/Upgrade Federated Authentication Service
The service should be installed on a secure, standalone server that does not have any other Citrix components installed. The FAS server stores user authentication keys, and thus security is paramount.
- On the Federated Authentication Service server, go to the Citrix Virtual Apps and Desktops, or XenDesktop 7.9, or newer ISO, and run AutoSelect.exe.
- In Citrix Virtual Apps and Desktops, or XenDesktop 7.13 and newer, in the lower half of the window, click Federated Authentication Service.
- Or in XenDesktop 7.9 through 7.12, on the bottom right, click Federated Authentication Service.
- In the Licensing Agreement page, select I have read, understand, and accept the terms of the license agreement, and click Next.
- In the Core Components page, click Next.
- In the Firewall page, click Next.
- In the Summary page, click Install.
- The installer might require a restart. Let it restart, and login again.
- After logging in, if you see a Locate 'Citrix Virtual Apps and Desktops 7' installation media window, don't click anything in the window.
- Go to the Citrix_Virtual_Apps_and_Desktops_7_2003.iso file and mount it.
- Go back to the Locate 'Citrix Virtual Apps and Desktops 7' installation media window.
- On the left, expand This PC, and click the DVD Drive.
- Click Select Folder.
- Installation will resume.
- After logging in, if you see a Locate 'Citrix Virtual Apps and Desktops 7' installation media window, don't click anything in the window.
- In the Finish Installation page, click Finish.
FAS Group Policy
Configure a Group Policy that instructs StoreFront servers and VDAs on how to locate the FAS servers.
- On the Federated Authentication Service server, browse to C:\Program Files\Citrix\Federated Authentication Service\PolicyDefinitions. Copy the files and folder.
- Go to \\domain.com\SYSVOL\domain.com\Policies\PolicyDefinitions and paste the files and folder. If PolicyDefinitions doesn't exist in SYSVOL, then copy them to C:\Windows\PolicyDefinitions instead.
- Edit a GPO that applies to all StoreFront servers, all Federated Authentication Service servers, and all VDAs.
- Navigate to Computer Configuration > Policies > Administrative Templates > Citrix Components > Authentication.
- Edit the setting Federated Authentication Service.
- Enable the setting and click Show.
- Enter the FQDN of the Federated Authentication Service server. You can add more than one Federated Authentication Service server.
- Michael Shuster explains the Group Policy configuration for FAS in multiple datacenters at HowTo: Active-Active Multi-Datacenter Citrix FAS.
- Michael Shuster explains the Group Policy configuration for FAS in multiple datacenters at HowTo: Active-Active Multi-Datacenter Citrix FAS.
- Click OK twice.
- On the Federated Authentication Service server, and VDAs, run gpupdate.
- On the FAS server, and on VDAs, look in the registry at HKLM\Software\Policies\Citrix\Authentication\UserCredentialService\Addresses. Make sure this key and value exists. The number one cause why FAS doesn't work is because this key is missing from VDAs. The FAS Address GPO must apply to VDAs too.
- If the VDAs and Users are in different domains, see CTX220497 Users from one AD Domain not able to get FAS user certificates from another trusted domain: add the Citrix StoreFront Servers, FAS server and VDA servers to the Windows Authorization Access Group in the users' domain.
- By default, the VDAs will verify the certificates aren't revoked by downloading the Certificate Revocation List. You can disable CRL checking by configuring HKEY_Local_Machine\System\CurrentControlSet\Control\LSA\Kerberos\Parameters\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors (DWORD) = 1 as detailed at CTX217150 Unable to login using the FAS Authentication – Getting Stuck on Please wait for local session manager.
FAS 1909+ Configuration
If you prefer to script the FAS configuration, then see Citrix Blog Post Automating the Citrix Federated Authentication Service with PowerShell.
FAS 1909 and newer have a different configuration GUI than FAS 1906 and older.
Here are 1909 and newer GUI configuration instructions:
- Log into the FAS server as a Domain Administrator or Enterprise Administrator that can upload certificate templates to Active Directory.
- On the FAS server, from the Start Menu, run Citrix Federated Authentication Service as administrator. Make sure you run it elevated.
- In the tab named Initial Setup, in the row named Deploy certificate templates, click Deploy.
- Click OK to deploy the templates to Active Directory.
- In the row named Set up a certificate authority, click Publish.
- Select an Enterprise Certificate Authority that will be issue the FAS certificates and click OK.
- In the row named Authorize this service, click Authorize.
- Select a CA that will issue this FAS server a Registration Authority certificate. Later, you will need to open the Certificate Authority console on the chosen server. Click OK.
- The row named Authorize this service has a new icon indicating it is waiting on the registration authority certificate to be approved.
- Open the Certification Authority console and point it to the CA server. In the Pending Requests node, find the certificate request for the FAS server and Issue it.
- Back in the FAS Administration Console, on the top right, click Refresh.
- The row named Authorize this service should now have a green check mark.
- In the row named Create a rule, click Create.
- In the Rule name page, leave it set to Create the default rule and click Next.
- In the Template page, click Next.
- In the Certificate authority page, select the CA that has the issuing templates configured and click Next. You can select more than one CA server.
- In the In-session use page, click Next.
- In the Access control page, click the link to Manage StoreFront access permissions.
- In the Permission for StoreFront Servers page, add your StoreFront servers and give them the permission Assert Identity. Click OK.
- Back in the Create Rule wizard, click Next.
- In the Restrictions page, you can optionally reduce the VDAs that are authorized to use FAS. Click Next.
- In the Summary page, click Create.
- The FAS Registration Authority certificate expires in two years. You'll need to manually renew the FAS Registration Authority certificate before it expires. Put a notification on your calendar. For details, see Renew registration authority certificates at Citrix Docs.
- In the row named Authorize this service, you can click the link for authorization certificate to see when it expires. Before expiration, use the Reauthorize button on the right of the same row.
- In the row named Authorize this service, you can click the link for authorization certificate to see when it expires. Before expiration, use the Reauthorize button on the right of the same row.
- Jump ahead to Certificate Templates.
FAS 1906 and older Configuration
If you prefer to script the FAS configuration, then see Citrix Blog Post Automating the Citrix Federated Authentication Service with PowerShell.
Here are GUI configuration instructions for FAS 1906 and older:
- Log into the FAS server as a Domain Administrator or Enterprise Administrator that can upload certificate templates to Active Directory.
- On the FAS server, from the Start Menu, run Citrix Federated Authentication Service as administrator. Make sure you run it elevated.
- The Federated Authentication Service FQDN should already be in the list (from group policy). Click OK.
- In Step 1: Deploy certificate templates, click Start.
- Click OK to add certificate templates to Active Directory. Sufficient permission is required.
- In Step 2: Setup Certificate Authority, click Start.
- Select a Certificate Authority to issue the certificates, and click Ok.
- In Step 3: Authorize this Service, click Start.
- Step 3 automatically submits an online request for the Registration Authority certificate to the CA and stores the non-exportable private key in the standard Microsoft Enhanced RSA and AES Cryptographic Provider.
- Alternatively, you can submit the certificate request manually, and store the private key in TPM or HSM as detailed at Federated Authentication Service private key protection at Citrix Docs. When running New-FasAuthorizationCertificateRequest, the -UseTPM switch is optional.
- Select the issuing Certificate Authority, and click OK.
- Authorize this Service only lets you select one Certificate Authority. If you want to load balance certificate requests against multiple Certificate Authorities, then see Set up multiple CA servers for use in FAS at Citrix Docs.
Set-FasCertificateDefinition -Name default_Definition -CertificateAuthorities @("ca1.corp.local\CA1.corp.local", "ca2.corp.local\ca2.corp.local")
- Authorize this Service only lets you select one Certificate Authority. If you want to load balance certificate requests against multiple Certificate Authorities, then see Set up multiple CA servers for use in FAS at Citrix Docs.
- Step 3 is now yellow.
- On the Microsoft CA server, go to the Certification Authority Console > Pending Requests. Find the pending request, and Issue it.
- In a minute or two, Federated Authentication Service will recognize the issued certificate and Step 3 will turn green.
- If it doesn't turn green, then there might be a private hotfix. See David Lloyd at Citrix Discussions.
- Another user at XenDesktop 7.9 FAS at Citrix Discussions had to bump up the Validity Period of the Citrix_RegistrationAuthority_ManualAuthorization template to 2 days before it would authorize.
- If it doesn't turn green, then there might be a private hotfix. See David Lloyd at Citrix Discussions.
- After FAS authorization with the CA, in the FAS Configuration tool, switch to the User Rules tab.
- Use the Certificate Authority drop-down to select the issuing Certificate Authority.
- Use the Certificate Template drop-down to select the Citrix_SmartcardLogon template.
- Click Edit next to List of StoreFront servers that can use this rule.
- Remove Domain Computers from the top half, and instead add your StoreFront servers. You could add an Active Directory security group instead of individual StoreFront servers.
- On the bottom half, make sure Assert Identity is Allowed. Click OK.
- By default, all users and all VDAs are allowed. You can click the other two Edit boxes to change this.
- When done, click Apply.
- Click OK when you see Rule updated successfully.
- The FAS Registration Authority certificate expires in two years. You'll need to manually renew the FAS Registration Authority certificate before it expires. Put a notification on your calendar. For details, see Renew registration authority certificates at Citrix Docs.
- To see the expiration date of the authorization certificate, run the following PowerShell command after running
add-pssnapin Citrix.Authentication.FederatedAuthenticationService.V1:
Get-FasAuthorizationCertificate -FullCertInfo -address myFASServer
- To see the expiration date of the authorization certificate, run the following PowerShell command after running
Certificate Templates
The deployed FAS Certificate Templates have Autoenroll enabled. You might want to disable that.
- Open the Certificate Templates console. One option is to open the Certification Authority console, right-click Certificate Templates, and then click Manage.
- There should be three templates with names starting with Citrix_. Open the properties on each one.
- On the Security tab, highlight each group assigned to the template.
- On the bottom half, uncheck the box in the Autoenroll row but leave Enroll checked. Perform this step for every group assigned to this template. Then click OK.
- Repeat disabling autoenroll for the other two templates.
The Registration Authority certificate templates are permitted to all Domain Computers. You might want to change that.
- Open the Properties of one of the Citrix_RegistrationAuthority certificate templates.
- On the Security tab, remove Domain Computers.
- Add your FAS servers and enable the Enroll permission.
- Repeat for the other Registration Authority certificate.
To further restrict who can be issued certificates, go to your Certificate Authority's Properties and use the Enrollment Agents tab to restrict enrollment agents.
StoreFront Configuration
Once FAS is enabled on a StoreFront store, it applies to all connections through that store, including password-based authentications. One option is to create a new store just for FAS users.
- Check the registry at at HKLM\Software\Policies\Citrix\Authentication\UserCredentialService\Addresses to confirm that the group policy with FAS addresses has been applied to the StoreFront servers.
- On the StoreFront 3.6 or newer server, run the following elevated PowerShell command:
& "$Env:PROGRAMFILES\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"
- Run the following commands. Adjust the store name as required.
$StoreVirtualPath = "/Citrix/Store" $store = Get-STFStoreService -VirtualPath $StoreVirtualPath $auth = Get-STFAuthenticationService -StoreService $store Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory" Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
- If you have multiple StoreFront servers, Propagate Changes.
- On a Citrix Delivery Controller, run the following commands:
asnp citrix.* Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true
If you ever need to disable FAS on StoreFront, run the following commands. Adjust the store name as required.
$StoreVirtualPath = "/Citrix/Store" $store = Get-STFStoreService -VirtualPath $StoreVirtualPath $auth = Get-STFAuthenticationService -StoreService $store Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "standardClaimsFactory" Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider ""
SAML Configuration
SAML Flow
SAML flows like this:
- (Optional) User goes to the web application aka Service Provider (e.g. Citrix Gateway).
- The Service Provider (SP) redirects the user's browser to the Identity Provider's (IdP) SAML Single Sign-on (SSO) URL and includes an authentication request in the Redirect. The IdP SSO URL might be different for each Service Provider.
- The Authentication Request from the Service Provider includes a Service Provider Entity ID. The IdP matches the SP Entity ID with an entry in its database so it knows which SP is making the authentication request. The Entity ID must match on both the SP and the IdP.
- If the Authentication Request is signed by the Service Provider's certificate private key, then the IdP will verify the signature using the Service Provider's certificate public key. In this scenario, the Service Provider's certificate (without private key) must be loaded into the IdP.
- The user authenticates to the IdP, typically using Multi-factor Authentication.
- If the user was redirected from the SP, then the IdP already knows which SP to authenticate with.
- If the user went directly to the IdP, then the user typically needs to click an icon representing the web application (Service Provider).
- IdP generates a SAML Assertion containing the user's userPrincipalName or email address.
- Configure the IdP to include the user's UPN or email address in the NameID field of the assertion. SAMAccountName won't work with Citrix FAS.
- The SAML Assertion also includes the Service Provider's Entity ID. The ID in the Assertion must match the ID configured on the SP.
- IdP signs the SAML Assertion using an IdP certificate private key.
- IdP has a configuration for the SP that includes a SAML Assertion Consumer Service (ACS) URL. IdP redirects the user's browser to the SP's ACS URL and POST's the SAML Assertion.
- The ACS URL on Citrix Gateway ends in /cgi/samlauth
- SP uses the IdP certificate's public key to verify the signature on the SAML Assertion.
- The IdP's certificate (without private key) is installed on the Citrix ADC so it can verify the Assertion's signature.
- SP extracts the user's userPrincipalName from the Assertion and uses the UPN for Single Sign-on to StoreFront and the rest of the Citrix components.
- Note that the SP does not have access to the user's password and thus that's why we need Citrix FAS to generate certificates for each user.
Configure the SAML IdP
You typically start the configuration on the Identity Provider (IdP). Every IdP has unique instructions. Search Google for your IdP and NetScaler and you might find a IdP-specific guide. After IdP configuration, you download the IdP's certificate and copy the IdP's SSO URL so you can configure them on Citrix ADC.
- Azure Active Directory IdP – See the next section. Also see:
- Marius Sandbu Setting up Citrix SSO with Windows 10 and Azure AD Join
- ADFS IdP – jump to the ADFS as IdP section. Also see:
- George Spiers ADFS authentication to StoreFront using NetScaler, SAML and Citrix Federated Authentication Service
- Dennis Radstake SAML authentication for Citrix XenDesktop and XenApp.
- Citrix Blog Post ADFS v3 on Windows Server 2012 R2 with NetScaler.
Azure AD as SAML IdP
- In Azure Portal, go to Azure Active Directory.
- On the left, click Enterprise applications.
- In the new blade that appears, on the All applications page, on the right, click New application.
- In the All Categories view of the gallery, on the top right, click Non-gallery application.
- Give the application a descriptive name. Azure AD shows this name in the myapps portal. Click Add.
- After the application is created, on the left, in the Manage section, click Single sign-on.
- On the right, click the big button for SAML.
- In section 1 labelled Basic SAML Configuration, click the pencil icon.
- In the Identifier (Entity ID) field, enter an identifier in URI format. Usually it matches the FQDN of the Citrix Gateway and can be entered in https://gateway.corp.com format. You'll later need to specify the exact same Identifier on the Citrix ADC.
- In the Reply URL (Assertion Consumer Service URL) field, enter a URL similar to https://mygateway.company.com/cgi/samlauth. The path must be /cgi/samlauth. The scheme should be https. And the FQDN is your Citrix Gateway's FQDN.
- Click Save. Then you might have to click the x on the top right to make it go away.
- In section 2 labelled User Attributes & Claims, notice that it defaults to sending the userprincipalname. You can click the pencil to change the attribute used for the Name identifier value. Whatever value you send will need to match the userPrincipalNames of local Active Directory accounts (aka shadow accounts).
- In section 3 labelled SAML Signing Certificate, click the Download link in the Certificate (Base64) line.
- Citrix ADC 12.1 and newer support SAML metadata so feel free to copy the App Federation Metadata Url field.
- If you are running NetScaler 12.0 or older, then you will need to copy the Login URL field from section 4 labelled Set up gateway5.corp.com
- On the left, under Manage, click Users and groups.
- Use the normal process to assign Azure AD users and groups to this application. Click Assign.
- Jump to the section named Citrix ADC SAML Configuration.
ADFS as SAML IdP
The screenshots in this section use ADFS as an example IdP. Your IdP will be different.
- In your SAML IdP, create a Relying Party Trust (aka service provider trust) or new Application.
- Since we're configuring the IdP before we configure Citrix ADC and thus don't have access to the SP metadata, select the option to Enter data about the relying party manually.
- For the Assertion Consumer Service URL (aka relying party service URL), enter the URL to your Citrix Gateway with /cgi/samlauth appended to the end (e.g. https://gateway.corp.com/cgi/samlauth)
- Enter a Relying party trust identifier in URI format. You must specify the same identifier (Issuer Name) on the Citrix ADC as detailed in the next section.
- Configure the SAML IdP to send email address or User-Principal-name as Name ID. Citrix ADC receives the Name ID and sends it to StoreFront. StoreFront will look in Active Directory for an account with userPrincipalName that matches the Name ID.
- Citrix ADC will sign the authentication requests it sends to the IdP. On the Citrix ADC, you will soon configure the Citrix ADC SAML SP signing certificate with private key that signs the authentication requests that are sent to the IdP. In your SAML IdP, import the same Citrix ADC SAML SP signing certificate but without the private key.
- Copy the SAML authentication URL (aka Token Issuance URL) from your SAML IdP. You'll need to enter this same URL on your Citrix ADC later.
- Export the IdP Token-signing certificate from your SAML IdP. The IdP could be ADFS, Okta, Ping, etc.
Citrix ADC SAML Configuration
- Instructions for Citrix ADC 13.0, Citrix ADC 12.1, NetScaler 12.0, and NetScaler 11.1 are essentially the same.
- Citrix ADC 12.1 and newer support SAML Metadata while older versions of NetScaler do not support SAML Metadata.
- NetScaler 11 is very similar, except Certificates are in a different place in the NetScaler menu tree.
- Workspace app support – If you bind a SAML Authentication Policy directly to the Gateway Virtual Server (no nFactor/AAA), then Workspace app and Gateway VPN plug-in won't work. To support SAML with Workspace app and Gateway VPN plug-in, configure nFactor (Authentication Virtual Server with Authentication Profile) instead of directly on the Gateway Virtual Server. Note: nFactor authentication is only available with ADC Advanced Edition and ADC Premium Edition.
- On Citrix ADC, import the IdP SAML token-signing certificate (without private key) under Traffic Management > SSL > Certificates > CA Certificates. Citrix ADC uses this certificate to verify the signature of the SAML assertion from the IdP.
Note: when you later create the SAML Action on Citrix ADC, there's a place to add a SAML certificate. Unfortunately, the SAML Action is trying to import the wrong type of certificate since it wants the private key, which you don't have access to. If you import the certificate here under CA Certificates, then there's no prompt for private key.
- SAML IdP certificates are shown in the Unknown Certificates node.
- If you want ADC to sign the authentication requests it sends to the IdP, then do the following:
- Move up two nodes to Server Certificates and Import or create a SP SAML signing certificate with private key. This can be the same certificate used on Citrix Gateway. Or a more common practice is to create a self-signed certificate.
- You'll also need to import this SAML SP signing certificate (without private key) to your SAML IdP so it can verify the SAML authentication request signature from the Citrix ADC.
- Move up two nodes to Server Certificates and Import or create a SP SAML signing certificate with private key. This can be the same certificate used on Citrix Gateway. Or a more common practice is to create a self-signed certificate.
- Go to Citrix Gateway > Policies > Authentication > SAML. The quickest way to get here is to enter SAML in the search box on top of the menu.
- On the right, switch to the tab labelled Servers, and click Add.
- In the Name field, give the SAML Action a name that indicates the IdP's name.
- If your Citrix ADC is 12.1 or newer, then get the SAML Metadata URL (or file) from the IdP.
- In the SAML Server on Citrix ADC, in the SAML IDP Metadata URL field, paste in the URL.
- Scroll down and click Create.
- Edit the SAML Server again.
- If you uncheck the box next to Import Metadata, you can see the fields that it filled in for you. Unfortunately, other fields must be configured manually as detailed soon.
- In the SAML Server on Citrix ADC, in the SAML IDP Metadata URL field, paste in the URL.
- Configure the SAML Server based on the data provided by your IdP. If you imported Metadata, then some of the fields might already be populated.
- For IDP Certificate Name, select the SAML IdP's certificate that was exported from the SAML IdP and imported to Citrix ADC. Citrix ADC will use this IdP certificate to verify SAML assertions from the IdP.
Note: the Add button here does not work correctly. Instead, if you need to import the SAML IDP certificate, then do it at the CA Certificates node as detailed earlier in this section.
- For Redirect URL, enter the URL to the SAML IdP's authentication page. Citrix Gateway will redirect users to this URL. For ADFS, enter your ADFS URL appended with /adfs/ls (e.g. https://adfs.corp.com/adfs/ls). For other IdP's, get the URL from your IdP.
- For User Field, enter the name of the SAML Claim from the IdP that contains the value that matches the userPrincipalName of your local Active Directory users (aka shadow accounts). This defaults to the NameID field, but you might have to use a different claim, like emailaddress.
- Optionally, for Signing Certificate Name, select the SAML SP certificate (with private key) that Citrix ADC will use to sign authentication requests to the IdP. This same certificate (without private key) must be imported to the IdP, so the IdP can verify the authentication request signature. This field usually isn't needed by most IdPs.
- In the Issuer Name field, enter the ID that the SAML IdP is expecting for the Relying Party. This Issuer Name must match the name you configured on the IdP's Relying Party (Service Provider) Trust. Azure AD calls this the Identifier or Entity ID.
- Scroll down and click More.
- Citrix ADC defaults to SHA1. You might have to change the Signature Algorithm and Digest Method to SHA256.
- Review the other settings as needed by your IdP. Click Create when done.
- For IDP Certificate Name, select the SAML IdP's certificate that was exported from the SAML IdP and imported to Citrix ADC. Citrix ADC will use this IdP certificate to verify SAML assertions from the IdP.
- On the right, switch to the tab labelled Policies, and click Add.
- Give the policy a name, select the SAML Server, and enter ns_true for the expression. Click Create.
- Give the policy a name, select the SAML Server, and enter ns_true for the expression. Click Create.
- Create Citrix Gateway Session Polices if you haven't already.
- Edit your Session Policy/Profile.
- On the tab labelled Published Applications, make sure Single Sign-on Domain is not configured. Repeat this for your other Session Policies/Profiles.
- On the tab labelled Published Applications, make sure Single Sign-on Domain is not configured. Repeat this for your other Session Policies/Profiles.
- Create a Citrix Gateway Virtual Server if you haven't already.
- Edit your Citrix Gateway Virtual Server.
- Scroll down to the Basic Authentication section, and add a policy by clicking the plus icon.
- Change the type to SAML and click Continue.
- Select your SAML policy and bind it. This is the only authentication policy you need. You can remove all other authentication policies.
- Next step: configure StoreFront for SAML Citrix Gateway.
Configure StoreFront for SAML Citrix Gateway
- In StoreFront 3.6 or newer, in the StoreFront Console, go to Stores, right-click the store, and click Manage Authentication Methods.
- Make sure Pass-through from NetScaler Gateway is selected.
- Click the bottom gear icon on the right, and click Configure Delegated Authentication.
- Check the box next to Fully delegate credential validation to NetScaler Gateway, and click OK twice.
- In StoreFront, add a NetScaler Gateway object that matches the FQDN of the Citrix Gateway Virtual Server that has SAML enabled.
- On the Authentication Settings page, make sure you configure a Callback URL. It won't work without it.
- Then assign (Configure Remote Access Settings) the Gateway to your Store.
- Next step: create Active Directory Shadow Accounts
Native SAML on StoreFront without Citrix ADC
StoreFront 3.9 and newer have native support for SAML Authentication without Citrix ADC. Notes:
- SAML overrides Explicit and Pass-through authentication.
- SAML in StoreFront without Citrix ADC seems to work in Workspace app and Receiver Self-Service for Windows.
For an example configuration using StoreFront PowerShell commands and SAML metadata, see CTX232042 Configure StoreFront with OKTA.
To configure native SAML in StoreFront 3.9 or newer:
- Export the signing certificate from your SAML IdP. The IdP could be ADFS, Okta, Ping Identity, etc.
- In StoreFront 3.9 or newer console, right-click a Store, and click Manage Authentication Methods.
- Check the box next to SAML Authentication. If you don't see this option (because you upgraded from an older version), click the Advanced button on the bottom of the window, and install the authentication method.
- On the right, click the gear icon for SAML, and click Identity Provider.
- Change the SAML Binding to the method your IdP expects.
- Enter the IdP token issuance endpoint URL. For example, in ADFS, the path is /adfs/ls.
- Click Import.
- Browse to the signing certificate exported from your IdP, and click Open.
- Then click OK to close the Identity Provider window.
- On the right, in the SAML Authentication row, click the gear icon, and then click Service Provider.
- Click the first Browse button.
- Give the Signing certificate a name, and save it somewhere.
- Click the second Browse button.
- Give the Encryption certificate a name, and save it somewhere.
- Copy the Service Provider Identifier. Or you can change it to your desired value. Then click OK.
- In your IdP (e.g. ADFS), create a Relying Party Trust.
- Import the Encryption certificate that you exported from StoreFront.
- Enable SAML 2.0.
- For the Assertion Consumer Service (ACS) path, enter something similar to https://storefront.corp.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService. The hostname portion of the URL is equivalent to your StoreFront Base URL. /Citrix/StoreAuth matches your Store name with Auth on the end. The rest of the path must be /SamlForms/AssertionConsumerService. You can get this ACS value by looking in the SAML metadata at the bottom of https://<storefront host>/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata.
- For the Relying party trust identifier, enter the identifier you copied from the Service Provider window in StoreFront.
- Configure the Claim Rules to send the user's email address or userPrincipalName as Name ID.
- Edit the Relying Party Trust. Import the Signing certificate that you exported from StoreFront.
- Create Active Directory Shadow Accounts. Federated users must be userPrincipalName mapped to local Active Directory accounts.
- If you point your browser to https://<storefront-host>/Citrix/<storename>Auth/SamlTest, it should perform a SAML Login, and then show you the assertion that was returned from the IdP. See Citrix CTX220639 How to configure SAML Authentication-Test Configuration.
- See Citrix CTX220682 Storefront SAML Troubleshooting Guide for event logs, SAML Metadata, Active Directory account mapping, Trust XML, etc.
- When you go to your Receiver for Web page, it should automatically redirect you to your IdP. After authentication, it should redirect you back to StoreFront and show you your icons.
- ADFS also works in Receiver 4.6 and newer, and Workspace app.
- When you logoff, it won't let you log on again unless you close your browser and reopen it.
- To fix this problem, see CTP Sacha Thomet StoreFront – Allow relogin without browser close. Edit the file C:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js, and add the following line:
CTXS.allowReloginWithoutBrowserClose = true
- Now when you logoff, you're given an option to log on again.
Active Directory Shadow Accounts
To login to Windows (Citrix VDA), every user must have an Active Directory account in a domain trusted by the VDA. For Federated Users, you typically need to create shadow accounts for each Federated user in your local Active Directory. These Shadow accounts need a userPrincipalName that matches the SAML attribute (usually email address) provided by the SAML IdP.
If the email address provided by the SAML IdP does not match the UPN suffix for your domain, then do the following:
- Open Active Directory Domains and Trust.
- Right-click the top left node (not a domain node), and click Properties.
- In the UPN Suffixes tab, add a UPN suffix that matches the email suffix provided by the SAML IdP.
- When creating a shadow account in your Active Directory, the new UPN suffix is available in the drop-down list. Note that the pre-Windows 2000 logon name can't conflict with any other user in the domain.
- The password for these Shadow accounts can be any random complex password since the Federated users never need the Shadow account's password.
- If the shadow account is already created, edit the account, and on the Account tab, use the drop-down to select the new UPN suffix.
- Create a shadow account for every federated user. There are third party Identity Management tools that can automate this. Or get an export from the IdP and use PowerShell scripting to create the acccounts.
Verify FAS
When FAS is enabled on StoreFront, every user that logs into StoreFront (local or remote) causes a user certificate to be created on the FAS server. You can see these user certificates by running the following PowerShell commands:
Add-PSSnapin Citrix.Authentication.FederatedAuthenticationService.V1 Get-FasUserCertificate -address fas01.corp.local
Citrix uses these certificates to logon to the VDA as the user. No password needed.


text:
Modern Romance
Printed Shirts
Think of the modern romance trend as a return to old-school glamour, when getting dressed up for dinner wasn't out of the ordinary. The MR PORTER edit includes classic tuxedos, dress shirts, bow ties and sophisticated men's watches. To situate it in the 1970s, as seen at Givenchy, Tom Ford and Saint Laurent with bohemian-inspired printed shirts, pleated trousers and lashings of velvet, corduroy and silk.
Filter1 Result
- Recommended
- Price Low to High
- Price High to Low
- New In

subset: commoncrawl


text:
In discussions I have had with people who hold to an ancient Earth, the suggestion has been made, based on the passage in Hebrews 4:4-11, that the seventh "day" of Creation (i.e., God's Sabbath rest) discussed in Genesis 2 still is continuing, and that it is in that seventh "day" that the time may be placed to accommodate an old Earth. Is this view correct?
People who believe in what is known as the Day-Age theory (which teaches that the "days" of Genesis 1 were "ages" rather than normal 24-hour days) sometimes suggest that the seventh "day" still is continuing. Their argument is that since the phrase "evening and morning" is not used in regard to the seventh day, it must not have been a 24-hour day. Therefore, we are living in the seventh day—a position they must defend to remain consistent. There are, however, a number of serious problems with this approach. The first has been explained by Guy N. Woods.
Jehovah finished his labors at the end of the sixth day, and on the seventh rested. The narrative provides no basis for the assumption that the day he rested differed in any fashion from those which preceded it. It evidently was marked out and its length determined in the same manner as the others. If it was not a day of twenty-four hours, it sustains no resemblance to the sabbath which was given to the Israelites (1976, pp. 17-18, emp. added).
Moses' obvious intent was for the reader to understand that God: (1) rested (past tense); and (2) gave the seventh day (the Sabbath) as a day of rest because He had rested on that day.
There is a second problem with the view that the seventh day still is continuing. James Pilgrim has addressed that problem.
...[I]f the "day-age" theorists accept day seven as an "age" also, we ask, "What about day eight, or day nine, or day ten...?" On the assumption that the earth is 7,000 years old (a most distinct possibility), let the "day-age" proclaimers put 2,555,000 days (7,000 years at 365 days per year) on a page. Now let them circle the day which began the normal 24-hour day. Let them also give just one scripture reference to substantiate the validity of that circle. Can they do it? No! Will they do it? No! (1976, 118:522, emp. in orig.).
The third problem with the idea that the seventh day is continuing has to do with Adam, as Woods has noted:
Adam, the first man, was created in the sixth day, lived through the seventh day, and into at least a portion of the eighth day. If these days were long geologic periods of millions of years in length, we have the interesting situation of Adam having lived in a portion of one age, through the whole of another age, and into at least a portion of a third age, in which case he was many millions of years old when he finally died! Such a view of course is absurd; and so are the premises which would necessitate it (1976, p. 18, emp. in orig.).
Whitcomb has explained why these things are true.
...Genesis 2:2 adds that He rested on the seventh day. That day also must have been literal, because otherwise the seventh day which God blessed and sanctified would have been cursed when God cursed the world and cast Adam and Eve out of the Garden. You see, the seventh day must have ended and the next week commenced before that Adamic curse could have come. Adam and Eve lived through the entire seventh day and into the following week, which is simply a confirmation of the fact that each of the days, including the seventh, was literal (1973, 2:64-65).
It also has been suggested that Hebrews 4:4-11, where the writer speaks of the continuation of God's Sabbath rest, provides support for this unusual view. First, I would like to present the passage in question, along with the argument framed from it. Then I would like to offer an explanation of why the passage does not support the concept of the seventh day continuing, and why the argument based on it is faulty. Here is the passage.
For he hath said somewhere of the seventh day on this wise, "And God rested on the seventh day from all his works"; and in this place again, "They shall not enter into my rest." Seeing therefore it remaineth that some should enter thereinto, and they to whom the good tidings were before preached failed to enter because of disobedience, he again defineth a certain day, "Today," saying in David so long a time afterward (even as hath been said before), "Today if ye shall hear his voice, Harden not your hearts." For if Joshua had given them rest, he would not have spoken afterward of another day. There remaineth therefore a sabbath rest for the people of God. For he that is entered into his rest hath himself also rested from his works, as God did from his. Let us therefore give diligence to enter into that rest, that no man fall after the same example of disobedience.
Here, now, is the argument. Proponents of the idea suggest that since God's Sabbath Day (the seventh day of the creation week) continues to this very day, then it follows logically that the other days of the creation week were long periods of time as well (see Ross, 1994, pp. 48-49,59-60; Geisler and Brooks, 1990, p. 230). In support of this position, progressive creationist Hugh Ross suggested: "Further information about the seventh day is given in Hebrews 4.... We learn that God's day of rest continues" (1994, p. 49).
Wrong! Here is the correct meaning of the passage. While the text speaks clearly of the cessation of God's creative activity—beginning on the seventh day—it nowhere implies or states that God's seventh day has continued from the past into the present. Nor does the passage speak of the duration of the seventh day. Mark Van Bebber and Paul Taylor have addressed this point.
Like David in the Psalms, the writer of Hebrews is warning the elect not to be disobedient and hard-hearted. Thus, he alludes to Israel in the wilderness who because of their hard hearts could not receive God's promise of rest in Canaan. "Rest," as used in these verses by both David and the writer of Hebrews, had a specific historic reference to the promised land of Canaan. The Hebrew word used by David for "rest" was menuwchah, which is a general term for rest which has a special locational emphasis (e.g., "the resting place or abode of resting") [see Brown, et al., 1979, p. 629b]. This concept is echoed by the author of Hebrews who uses the Greek word katapausis, which also may refer to an abode or location of resting (Hebrews 4:1,3-5,8).
At the climax of this passage, the author promises a future day of rest (Hebrews 4:9, Greek: Sabbatismos). This is the only time in the New Testament that this word for "rest" is employed. It seems to be a deliberate reference to Day Seven of Creation. The author does not say, however, that the seventh day continues on into the future. He uses Sabbatismos without an article (like saying a Sabbath, rather than the Sabbath). In Greek, this grammatical structure would generally represent the character or nature of Day Seven, without really being Day Seven. That is, the context makes it clear that the future day of rest will be similar to the original seventh day. The task will be complete; we will live with Christ eternally—our work on earth will be done (1996, pp. 72-73, emp., parenthetical, and bracketed items in orig.).
The passage in Hebrews thus is employing the essence of the seventh day of creation to refer to the coming essence of heaven—i.e., a place of rest. It is not speaking about the actual length of that seventh day. Furthermore, the fact that God has not been involved in creative activity since the close of day six says absolutely nothing about the duration of the various days of creation. When God completed the creation, He "rested"—but only from His work of creation. He is very much at work now—but in His work of redemption, not creation. Jesus Himself said: "My Father worketh even until now" (John 5:17). While it is correct to say that God's rest from creative activity continues to this very hour, it is not correct to say that His Sabbath continues. That was not the point the Hebrew writer was making, and to suggest that it was represents either a misunderstanding or misuse (or both) of the passage.
God was not saying, via the Hebrew writer, that He wanted to share a literal Sabbath Day's rest with His creation. Rather, He was saying that He intended to enjoy a rest that was typified by the Sabbath Day's rest. The Israelites who rebelled against God in the wilderness were not able to share either a "rest" by entering into the physical presence of the Promised Land or a "rest" by entering into the eternal presence of God. R.C.H. Lenski commented on the text as follows:
The point lies in taking all these passages together. The rest from which the Jews of the Exodus were excluded, into which we are entering, is God's rest, the great Sabbath since the seventh day; of course not of the earthly days and years that have rolled by since then and are still continuing, but the timeless, heavenly state that has been established and intended for men in their glorious union with God.
These are not different kinds of rest: the rest of God since creation and a future rest for his people; or a rest into which men have already entered and one that has been established since the redemptive work of Jesus, into which they are yet to enter; or a rest "at the conclusion of the history of mankind." The seventh day after the six days of creation was a day of twenty-four hours. On this day God did not create. Thus God made the first seven-day week (Exod. 20:8-11; 31:12-17), and the Sabbath of rest was "a sign" (v. 17) so that at every recurrence of this seventh day Israel might note the significance of this sign, this seventh day of rest being a type and a promise of the rest instituted for man since the days of creation. Like Canaan, the Sabbath was a type and a promise of this rest (1966, pp. 132-133, emp. added).
Additionally, even if it could be proven somehow that the seventh day of creation was longer than the others (which it cannot), that still would establish only one thing—that the seventh day was longer. It would say absolutely nothing about the length of the other six days. And concerning those days, the Bible could not be any clearer than it is in explaining their duration of approximately twenty-four hours. Genesis 1 defines them as periods of "evening and morning" (1:5,8,13,19,23,31). While God's activity within each literal day may have been miraculous, there is nothing miraculous about the length of the days themselves. They were, quite simply, the same kinds of "days" that we today enjoy. Attempts to reinterpret the message of Hebrews 4 do not alter that fact.
Brown, Francis, S.R. Driver, and Charles A. Briggs (1979), The New Brown-Driver-Briggs-Gesenius Hebrew and English Lexicon (Peabody, MA: Hendrickson).
Geisler, Norman L. and Ronald M. Brooks (1990), When Skeptics Ask (Wheaton, IL: Victor).
Lenski, R.C.H. (1966), The Interpretation of the Epistle to the Hebrews and of the Epistle of James (Minneapolis, MN: Augsburg).
Pilgrim, James (1976), "Day Seven," Gospel Advocate, 118:522, August 12.
Ross, Hugh (1994), Creation and Time (Colorado Springs, CO: Navpress).
Van Bebber, Mark and Paul S. Taylor (1996), Creation and Time: A Report on the Progressive Creationist Book by Hugh Ross (Gilbert, AZ: Eden Communications).
Whitcomb, John C. (1973), "The Days of Creation," And God Created, ed. Kelly L. Segraves (San Diego, CA: Creation-Science Research Center), 2:61-65.
Woods, Guy N. (1976), Questions and Answers: Open Forum (Henderson, TN: Freed-Hardeman University).


text:
FULTON, MO -- A Missouri Y has teamed up with an area hospital to create a fitness-focused annex on hospital grounds for members of the community.
The YMCA of Callaway County opened its new annex on the campus of Fulton State Hospital in an unused portion of the hospital complex's cafeteria earlier this month, according to The Fulton (MO) Sun. Although the annex is open to all members of the community, it is expected to be especially beneficial to employees of the state-run hospital.
In exchange for providing the building, the Y is offering employees of the Fulton State Hospital a reduced membership rate of $10 a month compared to the usual $37.50. The facility is open 24 hours to allow better access for hospital shift workers.
A spokesperson from the Y said he hoped the new annex would also help to reduce overcrowding at the town's main Y fitness facility.
The annex's modest 6,000-square-foot facilities include a group exercise studio and a locker room with two private shower rooms. Most of the weights, strength and cardio equipment was purchased from a for-profit club that went out of business in the St. Louis area.
Funding for the new facility was made possible through a $300,000 three-year grant from the Missouri Foundation for Health.


text:
Your connection to the latest beauty products and trends—plus insider tips and tricks. Tune in, have fun, get inspired—and know your beauty.
Shopping is meant to be fun. When you shop QVC®, you'll find top brands, engaging personalities, and award-winning service. Watch, shop, and connect with us anywhere at any time.
V Channel (also seen on Sky ch. 671 in the UK) is a 24/7 channel focusing on entertainment, lifestyle and shopping of trending products.
Shop N Give TV offers a revolutionary way to fund raise combining online retail, Virtual Marketplace, shop at home network with Internet Streaming TV, Mobile Streaming, marketing and advertising to raise money virtually for Non-profits, Schools, Teams and Churches at NO COST and almost NO WORK..Broadcasting 24 / 7, SNG TV home and mobile fundraising empowers Non-profits, Schools, Teams and Churches through technology and social media so they can focus more time on advancing their respective causes. Our beautiful models and show host will display featured items at great prices and at the end of the day 20% each customers gross purchase will be donated to the featured organization of the day.
The best deals are found on Deals TV. From health, fitness, fashion and more, you'll find it here on Deals TV.
Smart, entertaining, and informative—the destination channel for all who love the world of TV shopping. Original, live programs and plenty to discover.
America's Auction Network offers a unique home shopping experience featuring real estate, modern & classical art, antiques & collectibles, rare coins & currency, jewelry & gemstones, Persian rugs, entertainment memorabilia, sports memorabilia and more.
The Caribbean Shopping Channel (CSC) is a 24hr TV station showcasing the stories behind local & International brands. CSC gives a fun, informative look behind the scenes of international products & brands and brings you beauty, entertainment, food & travel features. Visit the Caribbean Shopping Channel website at www.caribbeanshoppingchannel.com/
Product Showcase Network is the television network that is dedicated to introducing you to the newest and most innovative products now available for purchase. From the latest trends to new inventions, PSN TV helps make you an informed consumer as you take advantage of tremendous savings off retail prices. To purchase online and SAVE go to www.productshowcasetv.com and use promotional code FILMON100.
Starshop (Celebrity TV) - ap into Celebrity! StarShop is an entertainment powerhouse that gives mobile shoppers VIP access to celebrities and their favorite products via exclusive videos. Stars feature their own brands and talk about other hot products and trends they like, wear, use, or live by within StarShop exclusive videos. Visit Starshop.com to order!
You need to be logged in order to record!
Sorry, You need to login to post in chat!


text:
Barnyard Critters
by: Reinhard Staupe
Game Type(s):
Card Games,
Players: 2 - 8
Age: 13 +
Available Languages
Status: Out of Print
Stock Number: 164
Farmer Brown has lots and lots of animals. He has horses, cats, dogs, pigs, and cows. He also has one of each in his favorite colors, which are red, blue, yellow, green, and purple. Every night before he goes to bed, he looks in the barnyard to make sure all his animals are there. Today the animals are playing hide and seek with farmer Bro wn. Can you help him find all his animals so he can go to bed?Learning "Teacher's Choice Awards Winner"
You may also be interested in...


text:
Top $
Once upon a time, the Phillies made Mike Schmidt the highest paid player. Years later, they did the same with the signing (first time) of Jim Thome.
Now, they've paid the steepest price for a closer. A lot was written and posted today about Papelbon after his press conference yesterday. Bottom line: Phillies have a proven closer to go along with a proven starting pitching rotation. That's pretty good, folks.
Sorry to see Madson depart. He leaves having pitched more games out of the bullpen than anyone in Phillies history.
When the gates to Citizens Bank Park first opened in 2004, three of the current players were on the field for the April inaugural–Madson, Chase and J-Roll. If J-Roll leaves via free agency, then we're down to Chase as the senior member of the club.
Nick Strincevich, a 96-year-old right-handed pitcher, recently died. He was the oldest living Phillies Alumnus. Nick pitched for the Phillies in 1948.
When he was released in June of '48, a rookie stepped in and took over his uniform and locker…Robin Roberts. So, Nick is part of a trivia question: Who was the last Phillies player to wear #36 before Robbie?
The oldest living former Phillie now is 95-year-old Freddy Schmidt, another right-hander. He pitched for the Phillies in 1947. The Wind Gap, PA, resident has attended the Alumni Night the last two seasons.
In August, we lost OF Alex Pitko (97) and last month, OF Danny Litwhiler (95).
Thanks to Jay Meyers for posting a correction in the blog about Thome. I wrote that Hank Aaron hit his 400th home run in 1966 at Veterans Stadium. It was pretty difficult to hit a homer at the Vet in 1966 because it didn't even exist. The correct ballpark was Connie Mack Stadium, as Jay pointed out.
Phillies Insider climbed notch for 15 to 14 in the October rankings of "MLB Pro" blogs. Credit goes to you. Thanks.
Keith Olbermann's "Baseball Nerd" blog ranks # 1 in the same category.
Don't believe Phillies Insider will ever catch Keith.
1 Comment
What the Phillies totally missed was the character of Papelbum!! He and Beckett were the cancers on the RS, now the Phils have him………YES!!


text:
He asked, you said yes, and now the real questions start! Who should you call first with the good news? How long should an engagement last? And what if (gasp!) you don't like your ring—should you tell your fiancé? Our wedding etiquette experts are here to help you navigate the wild road to your wedding with their essential tips for brides-to-be.
Who pays for the bachelorette party?
The bachelorette party is one event where the hosts aren't necessarily expected to foot the bill for everyone. In fact, the hosts are often more "organizers" than traditional hosts; they take charge of getting a group of friends together for a night out. Typically, everyone chips in to cover the cost of the bride's food and any drinks, since she's the one being honored. Any arrangement you come up with for funding the evening is fine—just be sure that everyone knows what to expect before the night begins.
If the event is more of a classic party being hosted by one or a few people at a single venue, then the traditional rules of hosting apply: the hosts covers all of the costs: food, drinks, decorations and any party favors.
While gifts aren't usually given at bachelorette parties, it is popular to give the bride an inexpensive little something to commemorate the evening—usually a token like a T-shirt (or perhaps a more intimate garment) saying "Bride-to be" or "Taken." In this case, the group usually either decides on a gift together and all chip in, or one person takes the initiative and pays for it herself.
Is it okay to invite my best male friends to my bridal shower?
Of course. But even men who are super in touch with their feminine sides would probably run screaming from the room if forced to endure a traditional shower, complete with girly games and an abundance of pink ribbon. A hipper, more inviting option is a coed party where, along with the usual female suspects, the groom, his male buddies, and assorted husbands and boyfriends congregate for a meal. Serve grown-up drinks like martinis and margaritas, and lose the lingerie in favor of fun presents with a his-and-hers theme. For example, the groom gets grilling tools; the bride gets a hammock. Another great group gift is a set of luggage for the honeymoon. Crank up the music and make sure someone's got a digital camera on hand. As long as you mix things up, everyone will have a blast at this all-inclusive party.
Do I have to open gifts at my bridal shower?
'Fraid so, since receiving gifts—and opening them—is the main focus of a shower. But don't worry: Even the shyest of brides can sail through the gift-wrap spectacle with a little pre-party planning. Figure out a few gracious stock responses that you can use after unwrapping each gift ("Thank you so much—I love it!" or "Oh, wow—how gorgeous!" are good ones); this will prevent you from fumbling for words. Next, recruit a witty friend who can think on her feet to sit beside you, oooh and ahhh where appropriate, and fill in any dead air in the case of an uncomfortable silence. Sharing the spotlight with someone should help you relax and enjoy raking in the loot.
Should we invite out-of-town family and future in-laws to the shower?
Absolutely invite them. It's a nice gesture that shows you're thinking of them and wish they could be there, even though it's unlikely that they'll attend. By the way, you don't have to invite every female on your fiancé's guest list. A shower is supposed to be a party for a bride's closest friends and family members, so send invites to his immediate kin (mother, grandmothers, sisters) and maybe a few of his closest friends. It's doubtful that they'll think you're being greedy—in fact, they're more likely to feel slighted if you leave them out.
When are you supposed to ask people to be attendants?
Ideally within a month or two of the engagement, but there are no set rules. You'll first need to figure out how large a bridal party you want, which is often determined by the size of your event. (If you're having only 40 guests, 10 attendants will look off-balance.) Whatever your approach, be sure to ask everyone around the same time, especially if would-be members of the party are in the same social circles.
I'm pregnant. Can I have a big wedding? And should we invite the family members who are against it?
If you want a big wedding, then go for it! The old rules that say a bride with a child should have a quick-and-dirty ceremony are just that, old. If it's important to you and your fiancé that these family members be present, a compromise would be best: Have a small-scale reception after the ceremony and invite the relatives to that. A few weeks later, have a huge blowout with the friends and family who support you. That way you'll get to have your big wedding—but without the big drama.
Do we have to have an engagement party?
You aren't required to have an engagement party, but it isn't a bad idea. Often it's the perfect opportunity to introduce parents and attendants to each other before the wedding. And don't think you're doomed to a stuffy cocktail party. Anything goes when it comes to engagement parties—from backyard barbecues to clam bakes—so make it as laid-back as you want.
Who should I tell first about my engagement?
Your parents and his should be the first people you tell about your engagement. You don't want them hearing about it from another person—even if that other person is a grandparent, sibling, or aunt. If you can't tell them in person, call them. Sending an email is fine to announce your engagement to your friends, but your parents—especially if you are expecting them to help pay for the wedding—deserve a phone call. After you tell both sets of parents, you can see, call, or email anyone you are close to and share your exciting news: grandparents, siblings, aunts, uncles, cousins, close friends.
Does my boyfriend have to ask my father for permission to marry me?
While it's more of a tradition than a requirement, many dads appreciate the gesture of being asked for their daughter's hand in marriage. However, since you can marry whomever you like, regardless of your father's wishes, nowadays most men ask for a father's blessing, not permission. If you think your dad may be upset if your future groom doesn't consult him ahead of time, tell your boyfriend to make sure to talk to him before proposing. If you're not sure what your dad would like and don't want to ask him, talk to your mom. She'll be able to tell you if your father expects to be asked.
If the wedding is cancelled, who keeps the engagement ring?
Even though technically the bride isn't required to return the ring (at least in most states), it's the best thing to do, regardless of who called off the wedding. While the ring was a gift, it was more importantly a symbol of a commitment to marry. Since there will no longer be a marriage, do you really want to keep a reminder of a future that won't happen? After all, the ring isn't a consolation prize. The emphasis here should be on appreciating the relationship you once had, not on cashing out any material value. Returning the ring gives everyone a fresh start. In the end, you will need to let your conscience be your guide.
If, however, the ring was a family heirloom of the groom's family, there's no question: It should be returned. If you and your fiancé purchased the ring together, one solution would be to sell it and split the proceeds proportionately.
—Anna Post, The Emily Post Institute
My family invited several people to my engagement party that I'm not planning on inviting to the wedding. What should I do?
If the invitations have gone out there's nothing much you can do. You can't call them up and un-invite them to the party. You need to schedule a time to talk with both set of parents about the size and style of wedding you and your fiancé want. Based on the size of wedding you want and the amount of people that your reception site can hold, you need to let both sets of parents know how many guests they can each invite—including relatives and friends. If the space allows more people, you may now have to invite these extra guests, or ask your parents to spread the word that the bride and groom have decided to hold a more intimate wedding with only immediate family and close friends.
Here's a general rule to follow: If you send an engagement party or bridal shower invitation or a save-the-date card to anyone, you will also have to send them a wedding invitation.
Can I propose to my boyfriend?
Of course you can! You can make your proposal of marriage to him as traditional or as fun and informal as you want. And don't be afraid to get down on one knee either. While we're not suggesting you buy him a diamond ring, you could buy him another accessory he can wear every day—a watch, necklace, bracelet, or another style ring. Some brides-to-be who decide to propose to their boyfriends have bought themselves an engagement ring, and when the groom-to-be says yes she asks him to slip it onto her ring finger.
I hate my engagement ring. Can I tell my fiancé?
You must absolutely tell him how you feel! And together you can pick out an engagement ring of equal or lesser value. Most guys will understand that your opinion counts for a lot, since YOU are the one who will be wearing the ring—and literally wearing it every day! And guys are cautioned all the time to discuss ring styles with their partner before making a purchase, so you have good reason to speak up. If you think his feelings will be really hurt or if you think voicing your thoughts will make him angry and resentful (and take away from the joy you are both feeling upon getting engaged) wait a year before saying anything.
In general, a new ring is in order if you dislike the color of metal, you dislike the shape or cut of the diamond (round vs. square, emerald-cut vs. cushion, etc.), the ring is too modern/too glitzy/too old-fashioned-looking/too plain, and your style is just the opposite.
However, it is NOT okay to say you want a different ring because you think the stone is too small or of poor quality. Because that's like saying, "You didn't spend enough money." You would never want him to feel that his choice was inadequate in that regard—surely he bought you the most beautiful ring he could afford, so if everything else about the ring works for (metal, stone shape, style) then hold your tongue. Five years from now you can discuss upgrading to a diamond of better quality.
I'm planning on having a very long engagement. By the time I get married, I will have been engaged for over three years. Is this appropriate?
You can plan to be engaged as long as you want but you may not want to book any vendors or buy your wedding dress so far away from your wedding day. Styles and your own personal taste will change over the course of three years, so enjoy being engaged and start getting ideas from wedding Web sites and bridal magazines. Don't start signing contracts with vendors until about 12 to 18 months from your wedding date.
What do I say when people ask me how much my engagement ring costs?
Um, who are these people? In no universe is it ever OK for anyone to ask a woman how much her engagement ring cost. Let us be clear: The only thing someone should say when you flash your rock is "It's so beautiful! How did he propose?" Cut. Scene. End of story.
Rant over. On to your question: Though you may be tempted to come back with a big fat "None of your business," rise above and dodge the question instead. Say something like "Oh, my fiancé would never tell. And I would never ask. Takes the romance out of it, don't you think?" That ought to give her the message.
My boyfriend says he wants to propose to me soon—and he wants me to help pick out the engagement ring. Is this appropriate?
Definitely. In fact, 62 percent of couples now go ring shopping together. The question is, do you feel comfortable with being a part of the process? We're sensing from your question that you do not—and there's nothing wrong with that. Just tell your boyfriend that you don't want to do a joint shopping trip because you think it's more romantic to be surprised. But don't set the poor guy totally adrift. Help him the old-fashioned way: Show your mom, your sister, and/or your BFF some photos of rings you like, and ask them to give him some guidance. You're going to wear this rock until death do you part; try not to leave things completely to chance.
My engagement ring is a vintage piece. Do I need a vintage wedding ring to match?
There is no rule that says that if one ring is vintage, the other has to be, too. The two rings should simply complement each other. Plenty of jewelry designers, such as Tacori and Penny Preville, now sell new wedding bands with a vintage feel. Can't find one you like? Ask a jeweler to custom design a wedding ring that works with your engagement rock.
How much is too much to spend on engagement ring?
The answer depends entirely on your fiancé-to-be's financial situation. On average, a guy will spend about $5,229 on the engagement ring, but some guys spend a lot less and some spend a whole lot more. (Justin Theroux, for example, forked over about half a mil on Jennifer Aniston's rock—hello!) As a rule of thumb, most jewelers suggest that men shell out about three months of their salary. But if he's heavily in debt or concerned about his job security, he may want to scale back. Worried your boyfriend will be tempted to go overboard? Slip your opinion into a casual conversation. Try something like "You know, Jen was just telling me the other day that she really wishes her husband had spent less on the engagement ring so they could have had a bigger wedding budget to play with. I think some guys are going a little crazy these days. If a woman really loves you, she's also going to love the ring, no matter how much it costs. Honestly, I don't think anyone should spend more than $[fill in the max you want him to spend here], don't you?".
When I told my two (single) best friends that I'm engaged, I expected them to be happy for me—but they seem jealous instead. It really hurts my feelings. How can I deal?
We're so sorry. This is not the reaction you want during one of the happiest times of your life. Know that this is not about you and so totally about them. Weddings bring up crazy stuff for people. Despite our best, most zen-minded intentions, we are constantly measuring ourselves against others, especially our peers. In this case, you've just announced that you are embarking on one of the most momentous rites of passage of your life. Your BFFs probably feel as if they're being left behind—and maybe losing you in the process, to boot. They may just need a minute to get a grip. Reach out to them, and make it clear that you want them to be with you every step of the way and that you will always need your girlfriends. (Note: Whatever you do, do not accuse them of being jealous of you. That's going to make them feel defensive and make you look like a raving bridezilla.) If these two are really your best friends, they're going to give you a giant hug, tell you they love you, and jump on that joy train. If they're still being surly, back off and start looking elsewhere for bridesmaids. You do not need any negativity with you in the dressing room on your big day.
My boyfriend and I don't have a lot of money, but he wants to propose to me. Is it appropriate to substitute a non-engagement silver ring for an engagement ring?
Go for it. An engagement ring is any ring that symbolizes the love and commitment between you and your fiancé. So whether it comes out of a coin-operated toy dispenser or from the chicest jeweler in your town, all that matters is that you love it. And, yes, it is possible that a few judgy family members and friends will be a little, well, judgy about your simple silver ring. But who cares? If we had to choose between getting married to our soul mate this year or waiting years for him to save up for a rock that might live up to their standards, we know what our choice would be. Besides, there's nothing to stop him from upgrading you to the diamond of your dreams as an anniversary present someday.
Is it appropriate for my sister to help my boyfriend pick out an engagement ring for me?
Absolutely! In fact, you want someone who knows your style to be at his side, steering him toward the rings you'll love and away from the rings you just won't. Feel free to get as specific with your sis as you want. If you're obsessed with emerald-cut diamonds, tell her. If you've been spending every lunch break shopping for rings online, send her links to all your faves. If you'd rather have a bigger diamond with a few flaws than a smaller diamond with none, slip her that nugget of info, too. With your sister on the case, he'll get a sounding board, you'll get a ring you'll adore, and she'll have the thrill of being part of one of the biggest moments in your life. Everyone wins.
My boyfriend has hinted that he's proposing soon. How do I tell him the type of engagement ring I want without being overbearing?
You could try the old trick of opening a copy of Brides to your dream ring and leaving it on the coffee table. Or post a photo of your favorite ring as a screensaver on your computer or phone. Or start commenting on other women's rocks. ("Did you see Donna's ring? It's princess cut, which I think is really pretty, but I'm not a big fan of the gold.") But, let's face it, not every guy will get the hint. Your best bet is to talk to your BFFs, sister(s), and/or mom about the kind of ring you want and have them give your guy the scoop—or even volunteer to go shopping with him.


text:
By Joseph Hahn
(Univ. of IL, College of Veterinary Medicine)
Many people enjoy running or hiking with their dogs. "Training is the key," says Dr. Gerald Pijanowski, a veterinarian at the University of Illinois College of Veterinary Medicine at Urbana. "It is as important to train your dog to run or hike long distances as it is to train yourself."
Dr. Pijanowski recommends starting out slowly, putting the dog on a training schedule similar to your own. Begin a training regime by running or walking your dog around your neighborhood increasing the distance as you and your dog become conditioned. Once properly conditioned, trips on running or hiking trails can be attempted.
Nutrition is another consideration in training your dog. A complete and balanced diet will allow your dog to keep its energy up during a hike or run. The advice on feeding from Dr. Pijanowski is, "Do not run on a full stomach. Feed after the run and make sure your dog is rested and cooled down." This will help avoid an upset stomach during the exercise.
The biggest threat for your dog while running or hiking in the summer is the heat and humidity. "The early morning is the best time to run or hike with your dog. If the evenings cool off, then that can be a good time as well," says Dr. Pijanowski. "Dogs can quickly overheat, especially if they have a dark or heavy coat." If overheating occurs, Dr. Pijanowski suggests hosing down your pet with cool water and offering cold water to drink. It is important not to force feed your dog water, it will drink when ready.
The most common type of injury suffered by dogs that are running or hiking with their owners are footpad injuries. Dr. Pijanowski advises owners not to run with their dogs on hot pavement as this can easily lead to burns. Those hiking in the woods can get cuts and scrapes. While these are difficult to avoid, leather boots are available for those dogs that will be exercising on extremely rough ground or ice and snow. If your pet gets a cut or scrape, proper first aid care should be administered immediately. Finally, those dogs that run in grass can catch a nail on grass leading to any number of soft tissue or joint injuries. Keeping the nails trimmed is a good way to prevent this last type of injury.
Dr. Pijanowski encourages pet owners to, "Leash their pets and keep them under control at all times, especially in the woods." This will help your dog avoid trouble and out of the path of others. Good obedience training builds a solid foundation for the control necessary to run or hike with your dog. Dr. Pijanowski also suggests a short leash (4 to 6 feet in length) to help maintain control.
When should you start exercising with your dog? A dog can start running at any age. However, if you can start with a puppy, it will have an easier time with the training.
Are certain breeds better suited for this type of activity? While the larger, long legged dogs will have an easier time keeping up, some of the smaller active breeds, such as the Beagles, Shelties, and Border Collies, do very well running or hiking long distances.
When should a dog discontinue running or hiking with its owner? "If the dog is showing no signs of lameness and is willing to run, there is no reason to quit," he says. However, lameness can be something as simple as muscle soreness which is gone in one to two days or as complex as arthritis which will continue to worsen as the dog ages. It is important to visit your local veterinarian to determine the cause of the lameness and your dog's ability to continue exercising.
Using common sense when hiking or running with your dog will make it an activity that can be enjoyed safely for a long time. For further information contact your local veterinarian.


text:
(CBSNEWS.COM) — After some debate, Harvard Medical School researchers are saying they have confirmed that compound resveratrol that's found in red wine does provide anti-aging benefits.
The study, which was published on March 8, 2013, in Science, shows that resveratrol stimulates production of SIRT1, a serum that blocks diseases by speeding up the cell's energy production centers known as mitrochondria.
Researchers have also figured out which gene allows resveratrol to produce SIRT1, and believe that some drugs currently in clinical trials may be able to provide the same anti-aging benefits as well.
Resveratrol is a naturally-occuring polyphenols antioxidant that is found in some plant products like grapes and cocoa. It is categorized as a phytoalexin, an antimicrobial compound that is produced by plants to protect them from rough environments like excessive ultraviolet light, infections and climate changes.


text:
| 4.5°C Dublin
Chelsea interim manager Rafael Benitez hopes to be employed by a leading club next season but first plans to satisfy his thirst for silverware at Stamford Bridge.
The Blues on Monday beat Manchester United to advance to the FA Cup semi-finals and play Rubin Kazan in the first leg of their Europa League quarter-final on Thursday in their third of six games in 16 days.
Benitez, who revealed in February he will be leaving at the end of his spell in May, said: "I like to win, to challenge for trophies. I would like to stay in a top side. A top side, why not in England?"
Benitez's appointment in November until the end of the season was prompted by the Champions League winners' group-stage elimination from the same tournament and a top-four Barclays Premier League place is imperative to return to the competition next term.
He added: "If we can achieve trophies and finish in the top three, fantastic. Everybody will be happy. That is my aim at the moment."
There has been constant speculation on a permanent Chelsea boss since Roberto Di Matteo's departure and Benitez's temporary appointment, with former boss Jose Mourinho, now at Real Madrid, continually linked.
Benitez's designs on the permanent position could be shaped by the fans' views, although their stance evident in vitriolic chanting from the stands is apparently softening following his plea to back the team after the win at Middlesbrough but he remains the subject for repeated criticism, with Ray Wilkins the latest to comment on Benitez's team selection.
Ashley Cole suffered a hamstring injury against Manchester United on Monday and former Chelsea captain, assistant boss and caretaker coach Wilkins believes the left-back would not have done so had he played against Southampton two days earlier.
Benitez dismissed the 'April Fools' Day' comments from Wilkins.
Benitez said: "April 1. You cannot take the comment seriously. It was April 1. I have a degree in sports science from Spain. It's the first time ever I've heard something like this. April 1."
PA Media


text:
Oh, those clever Mayans. When they weren't busy developing written languages, deciphering complicated astronomical systems and fending off conquistadores, they happened to invent sipping chocolate. Even if the Mesoamerican version was a spicy drink served cold, we can still thank them for having conceived of a drinkable cocoa concoction that has endured, in some form or another, for millennia.
It wasn't until the Spanish explorers brought chocolate back to Europe in the 16th century that sweetened warm versions of the elixir were consumed. Indeed, from the 16th to 19th centuries, hot chocolate was valued as a special drink, as well as taken as a medicine.
Drinkable chocolate has been used for years to treat ailments and maladies. When chocolate made its way to France in the 17th century, it was used "to fight against fits of anger and bad moods." And that wasn't just the French being French; it was truly insightful, given that modern research has discovered that chocolate reduces levels of stress hormones in the bodies of people feeling highly freaked out.
Which begs the question: We keep hearing more and more about the health benefits of chocolate, can the same be applied to hot cocoa as well? As it turns out, the answer is a resounding yes.
Try to avoid commercial instant hot cocoa mixes — they're full of artificial flavors and ingredients. (Photo: masatoshi_ from Kyoto, Japan [CC BY 2.0]/Wikimedia Commons)
Research continues to show us that antioxidants help prevent cancer, heart disease, age-related macular degeneration and aging in general because they fight free radicals in the body. The trendy so-called superfoods are the ones bursting with antioxidants — acai, goji berries, blueberries and pomegranate have become the superfood darlings. But antioxidants come in surprising forms too, like in vehicles once considered more vice than health food, such as coffee, red wine, and yes, chocolate. In fact, that's one of the areas where chocolate, especially in the form of hot cocoa, shines. Here's how.
1. According to a study conducted at Cornell University, the antioxidant concentration in hot cocoa is almost twice as strong as red wine. Cocoa's concentration was two to three times stronger than that of green tea and four to five times stronger than that of black tea.
2. Professor Chang Yong Lee, the leader of the Cornell study, added that the "hot" in "hot chocolate" is important as well. More antioxidants are released when it's heated up.
3. A cup of hot cocoa contains 611 milligrams of the phenolic compound gallic acid equivalents (GAE) and 564 milligrams of the flavonoid epicatechin equivalents (ECE). The antioxidant gallic acid is used to treat internal hemorrhages, albuminuria (the presence of albumin in the urine, which can indicate kidney disease) and diabetes.
4. Although a regular bar of chocolate has strong antioxidant activity, the health benefits may be outweighed because of the saturated fats present — cocoa generally has much less fat per serving compared to the 8 grams of fat in a standard chocolate bar.
The cacao tree's seeds, cocoa beans, are used to make chocolate liquor, cocoa solids, cocoa butter and chocolate. (Photo: Keith Weller, USDA ARS [Public domain]/Wikimedia Commons)
5. The flavonoids help your body process nitric oxide, which is why hot cocoa can improve blood flow, help lower your blood pressure and improve heart health.
6. The flavonoids in hot chocolate also help prevent platelets in your blood from mingling together and forming clots.
7. According to the American Association for the Advancement of Science, drinking hot chocolate can help you think better, too. The flavonoids increase the blood flow and oxygen to the brain. Since dementia is caused by a reduced flow of blood to the brain, researchers think it could be treated with cocoa.
Now comes the tricky part. Commercial instant hot cocoa mixes are often more of an artificial monstrosity that may eradicate any good the cocoa may have to offer. One of the most popular mixes, for example, lists cocoa fifth on the list of ingredients, beneath the higher-level ingredients of sugar, corn syrup and a medley of vegetable oils.
But not to worry, making your own healthy versions from scratch couldn't be easier. See 5 healthy recipes for hot cocoa for the hot cocoa how-to.


text:
Madison Ruppert, Contributing Writer
Activist Post
Despite the repeated statements made by United States Secretary of Defense Leon Panetta which have clearly indicated that Iran is not developing nuclear weapons and the analysis of the American intelligence community, the heated anti-Iranian rhetoric never seems to let up.
Indeed, it has even been reported by none other than the New York Times that intelligence analysts in America have yet to find any hard evidence indicating that Iran has even decided to construct a nuclear bomb. American intelligence assessments have continued to be congruent with the 2007 intelligence report which clearly concluded that Iran had in fact completely abandoned their nuclear program years before (scroll to the bottom of the article to read the embedded report).
According to anonymous U.S. officials, this assessment was reinforced by the 2010 National Intelligence Estimate and "it remains the consensus view of America's 16 intelligence agencies."
So, how can the governments of the United States and Israel continue to ignore their own intelligence agencies and nonsensically push forward with the effort to go to war with Iran?
If nothing else, it has become painfully clear that our so-called leaders are ignoring any and all contrary evidence which might weaken their war effort and making the relentless push towards war.
Given that American intelligence agencies like the Central Intelligence Agency (CIA) have concluded that the Iranian nuclear weapons program was likely halted all the way back in 2003, and Panetta himself has debunked the Iranian nuclear myth, it becomes evident that they have no interest in the truth.
To make matters even worse, it appears that the International Atomic Energy Agency (IAEA), an agency of the United Nations (UN) has now become little more than a tool of the warmongering factions of Western governments.
Recently the IAEA claimed that Iran had actually accelerated their nuclear program, increasing their production of highly enriched uranium and refused to answer some of the agency's key questions about their program.
In their report issued Friday, the director-general of the IAEA, Yukiya Amano, said that their inspectors continue "to have serious concerns regarding possible military dimensions to Iran's nuclear program," according to the Los Angeles Times.
Apparently Amano and the IAEA know better than one of the best funded and arguably the most powerful intelligence community on the planet.
"As Iran is not providing the necessary cooperation … the agency is unable to provide credible assurance about the absence of undeclared nuclear material and activities in Iran, and therefore to conclude that all nuclear material in Iran is in peaceful activities," Amano stated.
To any thinking person, this statement should be laughable. That's like me saying that my neighbor cannot provide credible assurance about the absence of undeclared thirty-foot tall spiders in his garage, and therefore I cannot conclude that my neighbor is peaceful.
If the IAEA is worried about "undeclared nuclear material and activities" they should be focusing their efforts solely on Israel, not Iran.
Counter Markets Newsletter - Trends & Strategies for Maximum Freedom
According to Reuters, even though the IAEA's report was far from conclusive and the preponderance of the American intelligence community has dismissed the alleged Iranian nuclear weapons program, the latest report from the nuclear agency "will further inflame Israeli fears the Islamic Republic is pushing ahead with atomic bomb plans."
"The report by the International Atomic Energy Agency gives added proof that Israeli beliefs are true" about Iran's nuclear program, a statement from Prime Minister Benjamin Netanyahu's office said, according to AFP.
My favorite part of that statement is the usage of the world "beliefs," since that is exactly what it is. It is not based on fact or logic, but instead blind faith and a belief that Iran is this bloodthirsty, genocidal nation relentlessly seeking nuclear weapons.
Of course, none of that is true, but apparently Netanyahu has no interest in the truth, either.
"Iran is pursuing its nuclear program with no end in sight. It is enriching uranium to 20 percent, totally ignoring demands by the international community," Netanyahu also said.
Israeli leadership – especially Netanyahu – pointing to the demands of the international community is painfully ironic. Israel regularly rejects the opinion of the international community in their oppression of Palestinians, raids on humanitarian aid flotillas and more.
The White House has also jumped on the report as more fuel for the anti-Iranian fire. They stated that Iran was in violation of United Nations Security Council resolutions with their nuclear enrichment efforts, even though their own intelligence assets have said that there is no weapons program.
"When combined with its continued stonewalling of international inspectors, Iran's actions demonstrate why Iran has failed to convince the international community that its nuclear program is peaceful," Tommy Vietor, the White House National Security Council spokesman said.
The problem here is that Vietor is not speaking for the international community; he is merely speaking for the National Security Council – the same group that makes the call to murder American citizens without charge or trial.
There is no arguing against the reality of the Iranian nuclear program and their efforts to enrich nuclear fuel.
However, the problem arises when one makes the leap of faith required to come to the conclusion that Iran is developing nuclear weapons or their program is anything other than peaceful.
Iran is a sovereign nation and, as such, the West has absolutely no right to tell them that they cannot pursue peaceful nuclear technology.
Thanks to the American intelligence community, yet another blow to the anti-Iranian propaganda has been dealt, but obviously the leaders of the Western world care not about these facts.
Hopefully the real international community can take note of the truth, and ignore the insane delusions of our so-called leaders who are making the relentless push to bring us to war.
Did I miss something? Want to give me your opinion or tip me off to an important story? Email me at [email protected]
This article first appeared at EndtheLie.com. Read other contributed articles by Madison Ruppert here.
linkwithin_text='Related Articles:'


text:
Baseball's Greatest Fielders By Position
This is for non-pitchers since 1901:
|Position/Research Link
|Greatest All-Time
|Honorable Mention
|Greatest Active
|Yadier Molina
|Jim Sundberg
|Yadier Molina
|Keith Hernandez
|John Olerud
|Mark Teixeira
|Joe Gordon
|Mark Ellis
|Chase Utley
|Brooks Robinson
|Clete Boyer
|Evan Longoria
|Mark Belanger
|Jack Wilson
|Brendan Ryan
|Barry Bonds
|Bernard Gilkey
|Carl Crawford
|Paul Blair
|Devon White
|Austin Jackson
|Jesse Barfield
|Roberto Clemente
|Ichiro Suzuki
Of course, this list means no disrespect to players like Willie Mays, Tris Speaker, Johnny Bench, Ivan Rodriguez, Ozzie Smith, Luis Aparicio, Adrian Beltre, Mike Schmidt, Bill Mazeroski, Frank White, Bill Terry, Vic Power, Dwight Evans, Dave Parker, Rickey Henderson and others. It's just that I think those listed above are the best defensively, all-time and currently, based only on their merits in the field (and not including what they did at bat). Your mileage may vary….
…but, I encourage you to click the links in the Position/Research Link column to see the data behind these selections.


text:
Sorry if this is the wrong forum, I'm new here. But years ago I had a small grey castle, it's figures were guys with holes in their heads that their helments had pegs for. I can't seem to find it anywhere online. I'm not sure if it's lego, but it is compatible with them if it's not. It's actually my first castle set I got, that got me into lego castle. Here I am 20 years later and can't figure it out.
The shields to it where all different designs. Can someone point me in the right direction?


text:
Yesterday we had the 1st snow for this winter.It's just about 1-2 inch.Usually the white flake comes around Christmas eve or day but this year it's seem to came early then usual..I heard that we will have a very freezing cold winter this season..Personally I hate winter becos I hate cold..I rarely step out of the house if unnecessary during winter..Well,what is the best food to eat during this cold season? For me personally I like pipping hot and spicy soup like tomyam or curry broth..It's feel good to have this kind of exotic broth to warm up our body,right?
For Broth:(A)
4-5 cups water
2 cubes shrimp bouillon
3 tbsp tomyam paste
1 tbsp garlic,minced fine
2 tbsp sambal olek or
1/4 cup apple cider vinegar
2 tbsp tamarind concentrated juice
5-6 kaffir lime leaves,cut small (daun limau purut)
Sugar and salt to taste
200 gm white meat chicken,sliced
1 lb clam,cleaned
2 piece flounder,sliced
1 large tomato,cut cubes
10 baby corn,cut
10 white mushroom,washed and sliced
1 large onion,peeled and sliced
1 small carrot,peeled and sliced
scallion or cilantro for garnishing
1:Prepare water in stock pot,bring it to boil,add in tomyam paste,shrimp bouillon ,
sambal or chili paste ,garlic and kaffir lime leaves.Simmer the broth for another 15 minutes
2:Add in the rest of ingredients(A) into the broth.Check the seasoning.Then add in ingredients(B),increase heat to high.When it's bubbly boil,check the seasoning again before remove from heat
3:Dish out into individual bowl and serve warm .


text:
The caption to this newspaper clipping read as follows: "Favored by Many…Plain City's hustling ball club has many of the bleacherites at the 1938 Utah farm bureau tournament picking it to walk off with the state title before the joust closes." The caption goes on to list the names of the individuals included in the photograph which I reproduced as the caption to the photo above. I list the names just as they were listed in the caption for the photo. The title of the article was "Plain City Clubbers Show Ability." The clipping is included in Grandpa's clippings but we do not know exactly when it was published. The team did end up going to Lagoon and playing Sandy for the state championship, but lost.
This team obviously played and practiced in Plain City, Weber, Utah. Grandpa has told me numerous times how he used to play baseball. With Grandpa just past 90, it is a bit hard to imagine him hustling after anything, let alone after a ball. The other thing that struck me about this team is I expected them to all be much closer in age.
William Sessions Freestone (1901-1998) Manager.
Norman Elmer Carver (1919-2001)
Alfred Glen Charlton (1919-1974)
Fred Singleton (?-Alive?)
Bert Elmer Singleton (1918-1996) For those baseball fans out there, Elmer went on to play 24 seasons in his career. He played for teams like Boston Braves, Chicago Clubs, Pittsburgh Pirates, and Washington Senators.
Clair Marcus Folkman (1910-1975)
Elwood "Dick" Francis Skeen (1908-1977)
Albert Sharp (1909-1984)
Abraham "Abe" Edward Maw (1906-1985)
Milo James Ross (1921-2014)
Elwood "F" Skeen (1908-1977)
Walter "Walt" Jeremiah Moyes (1907-1983)
George Arnold Taylor (1911-2000)
Lynn William Stewart (1916-2011)
William Theron Rhead (1914-1999)