Citrix Federated Authentication Service (SAML)

Last Modified: Mar 16, 2017 @ 10:07 am

Navigation

Overview

Citrix Federated Authentication Service enables users to login to NetScaler Gateway and StoreFront using SAML authentication.

Citrix Federated Authentication Service uses Microsoft Certificate Authority to issue certificates on behalf of users. These certificates are used for the StoreFront and Virtual Delivery Agent logon process.

Requirements:

  • Microsoft Certificate Authority in Enterprise mode
  • XenApp/XenDesktop 7.9 or newer
  • StoreFront 3.6 or newer
  • NetScaler Gateway. Note: StoreFront 3.9 and newer also supports SAML authentication natively without NetScaler.
  • Receiver for Web only.
  • Receiver Self-Service for Windows 4.6 and newer supports SAML auth when connecting to StoreFront native SAML without NetScaler.

Install Service

The service should be installed on a secure, standalone server that does not have any other Citrix components installed.

  1. On the Federated Authentication Service server, go to the XenDesktop 7.9 or newer ISO and run AutoSelect.exe.
  2. In XenDesktop 7.13 and newer, in the lower half of the window, click Federated Authentication Service.
  3. Or in XenDesktop 7.9 through 7.12, on the bottom right, click Federated Authentication Service.
  4. In the Licensing Agreement page, select I have read, understand, and accept the terms of the license agreement, and click Next.
  5. In the Core Components page, click Next.
  6. In the Firewall page, click Next.
  7. In the Summary page, click Install.
  8. In the Finish Installation page, click Finish.

StoreFront Configuration

  1. On the StoreFront 3.6 or newer server, run the following elevated PowerShell command:
    & "$Env:PROGRAMFILES\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"
  2. Run the following commands. Adjust the store name as required.
    $StoreVirtualPath = "/Citrix/Store"
    $store = Get-STFStoreService -VirtualPath $StoreVirtualPath
    $auth = Get-STFAuthenticationService -StoreService $store
    Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"
    Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
  3. If you have multiple StoreFront servers, Propagate Changes.
  4. On a XenDesktop Delivery Controller, run the following commands:
    asnp citrix.*
    Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true

If you ever need to disable FAS on StoreFront, run the following commands. Adjust the store name as required.

$StoreVirtualPath = "/Citrix/Store"
$store = Get-STFStoreService -VirtualPath $StoreVirtualPath
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "standardClaimsFactory"
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider ""

FAS Group Policy

  1. On the Federated Authentication Service server, browse to C:\Program Files\Citrix\Federated Authentication Service\PolicyDefinitions. Copy the files and folder.
  2. Go to \\domain.com\SYSVOL\domain.com\Policies\PolicyDefinitions and paste the files and folder. If PolicyDefinitions doesn’t exist in SYSVOL, then copy them to C:\Windows\PolicyDefinitions instead.
  3. Edit a GPO that applies to all StoreFront servers, all Federated Authentication Service servers, and all VDAs.
  4. Navigate to Computer Configuration > Policies > Administrative Templates > Citrix Components > Authentication.
  5. Edit the setting Federated Authentication Service.
  6. Enable the setting and click Show.
  7. Enter the FQDN of the Federated Authentication Service server. You can add more than one Federated Authentication Service server.
  8. Click OK twice.
  9. On the Federated Authentication Service server, run gpupdate.
  10. By default, the VDAs will verify the certificates aren’t revoked by downloading the Certificate Revocation List. You can disable this by configuring HKEY_Local_Machine\System\CurrentControlSet\Control\LSA\Kerberos\Parameters\UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors (DWORD) = 1 as detailed at CTX217150 Unable to login using the FAS Authentication – Getting Stuck on Please wait for local session manager.

FAS Configuration

  1. From the Start Menu, run Citrix Federated Authentication Service as administrator. Make sure you run it elevated.
  2. The Federated Authentication Service FQDN should already be in the list (from group policy). Click OK.
  3. In Step 1: Deploy certificate templates, click Start.
  4. Click OK to add certificate templates to Active Directory. Sufficient permission is required.
  5. In Step 2: Setup Certificate Authority, click Start.
  6. Select a Certificate Authority to issue the certificates, and click Ok.
  7. In Step 3: Authorize this Service, click Start.
  8. Step 3 automatically submits an online request for the Registration Authority certificate to the CA and stores the non-exportable private key in the standard Microsoft Enhanced RSA and AES Cryptographic Provider. Alternatively, you can submit the certificate request manually, and store the private key in TPM or HSM as detailed at Federated Authentication Service private key protection at Citrix Docs. When running New-FasAuthorizationCertificateRequest, the -UseTPM switch is optional.
  9. Select the issuing Certificate Authority, and click OK.
  10. Step 3 is now yellow.
  11. Go to the Certificate Authority Console > Pending Requests. Find the pending request and Issue it.
  12. In a minute or two, Federated Authentication Service will recognize the issued certificate and Step 3 will turn green. If it doesn’t turn green, then there might be a private hotfix. See David Lloyd at Citrix Discussions.
  13. Another user at XenDesktop 7.9 FAS at Citrix Discussions had to bump up the Validity Period of the Citrix_RegistrationAuthority_ManualAuthorization template to 2 days before it would authorize.  💡
  14. After authorization, switch to the User Rules tab.
  15. Use the Certificate Authority drop-down to select the issuing Certificate Authority.
  16. Use the Certificate Template drop-down to select the Citrix_SmartcardLogon template.
  17. Click Edit next to List of StoreFront servers that can use this rule.
  18. Remove Domain Computers from the top half and instead add your StoreFront servers. You could add an Active Directory security group instead of individual StoreFront servers.
  19. On the bottom half, make sure Assert Identity is Allowed. Click OK.
  20. By default, all users and all VDAs are allowed. You can click the other two Edit boxes to change this.
  21. When done, click Apply.
  22. Click OK when Rule updated successfully.
  23. To further restrict who can be issued certificates, go to your Certificate Authority’s Properties, and use the Enrollment Agents tab to restrict enrollment agents.

NetScaler Gateway Config

SAML on NetScaler Gateway 11.1

If NetScaler 11.0, see SAML on NetScaler Gateway 11.0.

Dennis Radstake SAML authentication for Citrix XenDesktop and XenApp has some ADFS configuration instructions.

  1. Export the signing certificate from your SAML iDP. The iDP could be ADFS, Okta, Ping, etc.
  2. Import the iDP SAML signing certificate (without private key) to NetScaler under Traffic Management > SSL > Certificates > CA Certificates. NetScaler uses this certificate to verify the signature of the SAML assertion from the iDP.

  3. Import a certificate with private key for signing of SAML authentication requests to the iDP. You’ll also need to import this certificate (without private key) on your SAML iDP so it can verify the SAML authentication request signature from the NetScaler.
  4. Go to NetScaler Gateway > Policies > Authentication > SAML.
  5. On the right, switch to the Servers tab, and click Add.
  6. Enter the information for authenticating with SAML. This configuration will vary depending on your SAML iDP.
  7. For iDP Certificate Name, select the SAML iDP’s certificate (exported from the SAML iDP) that NetScaler will use to verify SAML assertions from the iDP.
  8. For Redirect URL, enter the URL to the SAML iDP’s authentication page. NetScaler Gateway will redirect users to this URL.
  9. For Signing Certificate Name, select the NetScaler certificate (with key) that was imported to the SAML iDP for the Relying Party. NetScaler uses its private key to sign authentication requests to the iDP. iDP uses the public key to verify the signature.
  10. Enter an Issuer Name that the SAML iDP is expecting for the Relying Party.
  11. Click More.
  12. NetScaler defaults to SHA1. You might have to change the Signature Algorithm and Digest Method to SHA256.
  13. Review the other settings as needed by your iDP. Click Create when done.
  14. On the right, switch to the Policies tab, and click Add.
  15. Give the policy a name, select the SAML Server, and enter ns_true for the expression. Click Create.
  16. If you haven’t created your Session Polices yet, then see http://www.carlstalhood.com/session-policies-for-storefront-netscaler-11-1/.
  17. Edit your Session Policy/Profile. On the Published Applications tab, make sure Single Sign-on Domain is not configured.
  18. If you haven’t created your Gateway Virtual Server yet, then see http://www.carlstalhood.com/netscaler-gateway-11-1-virtual-server/.
  19. Edit your Gateway Virtual Server. Go to the Basic Authentication section, and add a policy.
  20. Bind the SAML policy. This is the only authentication policy you need. You can remove all other authentication policies.

  21. Next step: configure StoreFront for SAML NetScaler Gateway.

SAML on NetScaler Gateway 11.0

If NetScaler 11.1, see SAML on NetScaler Gateway 11.1.

Dennis Radstake SAML authentication for Citrix XenDesktop and XenApp has some ADFS configuration instructions.

  1. Export the signing certificate from your SAML iDP. The iDP could be ADFS, Okta, Ping, etc.
  2. Import the iDP SAML signing certificate (without private key) to NetScaler. NetScaler uses this certificate to verify SAML assertions.

  3. Import a certificate with private key that NetScaler will use to sign SAML authentication requests. You’ll also need to import this certificate (without private key) on your SAML iDP so the SAML iDP can verify the SAML authentication requests from the NetScaler.
  4. Go to NetScaler Gateway > Policies > Authentication > SAML > Servers, and click Add.
  5. Enter the information for authenticating with SAML. This configuration will vary depending on your SAML iDP.
  6. For iDP Certificate Name, select the SAML iDP’s certificate (exported from the SAML iDP) that NetScaler will use to verify SAML assertions.
  7. For Redirect URL, enter the URL to the SAML iDP’s authentication page. NetScaler Gateway will redirect users to this URL.
  8. For Signing Certificate Name, select the NetScaler certificate (with key) that was imported to the SAML iDP for the Relying Party. NetScaler uses its private key to sign the authentication request to the iDP. iDP uses the public key to verify the signature.
  9. Enter an Issuer Name that the SAML iDP is expecting for the Relying Party.
  10. Click More.
  11. NetScaler defaults to SHA1. You might have to change the Signature Algorithm and Digest Method to SHA256.
  12. Review the other settings as needed by your iDP. Click Create when done.
  13. On the right, switch to the Policies tab and click Add.
  14. Give the policy a name, select the SAML Server, and enter ns_true for the expression. Click Create.
  15. If you haven’t created your Session Polices yet, then see http://www.carlstalhood.com/session-policies-for-storefront-netscaler-11/.
  16. Edit your Session Policy/Profile. On the Published Applications tab, make sure Single Sign-on Domain is not configured.
  17. If you haven’t created your Gateway Virtual Server yet, then see http://www.carlstalhood.com/netscaler-gateway-11-virtual-server/.
  18. Edit your Gateway Virtual Server. Go to the Authentication section and add a policy.
  19. Bind the SAML policy. This is the only authentication policy you need. You can remove all other authentication policies.
  20. Next step: configure StoreFront for SAML NetScaler Gateway.

StoreFront Config for SAML Gateway

  1. In StoreFront 3.6 or newer, right-click the store, and click Manage Authentication Methods.
  2. Make sure Pass-through from NetScaler Gateway is selected.
  3. Click the gear icon on the right, and click Configure Delegated Authentication.
  4. Check the box next to Fully delegate credential validation to NetScaler Gateway, and click OK twice.
  5. In StoreFront, add a NetScaler Gateway object that matches the NetScaler Gateway Virtual Server that has SAML enabled.
  6. On the Authentication Settings page, make sure you configure a Callback URL. It won’t work without it.
  7. Then assign (Configure Remote Access Settings) the Gateway to your Store.

  8. Next step: create Active Directory Shadow Accounts

SAML on StoreFront without NetScaler

New in StoreFront 3.9 is native support for SAML Authentication without NetScaler.

Notes:

  • SAML overrides Explicit and Pass-through authentication.
  • SAML in StoreFront without NetScaler seems to work in Receiver Self-Service for Windows.

To configure SAML in StoreFront 3.9 or newer:

  1. Export the signing certificate from your SAML iDP. The iDP could be ADFS, Okta, Ping Identity, etc.
  2. In StoreFront 3.9 or newer console, right-click a Store, and click Manage Authentication Methods.
  3. Check the box next to SAML Authentication. If you don’t see this option (because you upgraded), click the Advanced button on the bottom of the window, and install the authentication method.
  4. On the right, click the gear icon for SAML, and click Identity Provider.
  5. Change the SAML Binding to the method your iDP expects.
  6. Enter the iDP token issuance endpoint URL. For example, in ADFS, the path is /adfs/ls.
  7.  Click Import.
  8. Browse to the signing certificate exported from your iDP, and click Open.
  9. Then click OK to close the Identity Provider window.
  10. On the right, in the SAML Authentication row, click the gear icon, and then click Service Provider.
  11. Click the first Browse button.
  12. Give the Signing certificate a name, and save it somewhere.
  13. Click the second Browse button.
  14. Give the Encryption certificate a name, and save it somewhere.
  15. Copy the Service Provider Identifier. Or you can change it to your desired value. Then click OK.
  16. In your iDP (e.g. ADFS), create a Relying Party Trust.
  17. Import the Encryption certificate that you exported from StoreFront.
  18. Enable SAML 2.0.
  19. For the Assertion Consumer Service (ACS) path, enter something similar to https://storefront.corp.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService. The hostname portion of the URL is equivalent to your StoreFront Base URL. /Citrix/StoreAuth matches your Store name with Auth on the end. The rest of the path must be /SamlForms/AssertionConsumerService. You can get this ACS value by looking in the SAML metadata at the bottom of https://<storefront host>/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata.

  20. For the Relying party trust identifier, enter the identifier you copied from the Service Provider window in StoreFront.
  21. Configure the Claim Rules to send the user’s email address or userPrincipalName as Name ID.
  22. Edit the Relying Party Trust. Import the Signing certificate that you exported from StoreFront.

  23. Create Active Directory Shadow Accounts. Federated users must be userPrincipalName mapped to local Active Directory accounts.
  24. If you point your browser to https://<storefront-host>/Citrix/<storename>Auth/SamlTest, it should perform a SAML Login, and then show you the assertion that was returned from the iDP. See Citrix CTX220639 How to configure SAML Authentication-Test Configuration.
  25. See Citrix CTX220682 Storefront SAML Troubleshooting Guide for event logs, SAML Metadata, Active Directory account mapping, Trust XML, etc.
  26. When you go to your Receiver for Web page, it should automatically redirect you to your iDP. After authentication, it should redirect you back to StoreFront and show you your icons.
  27. When you logoff, it won’t let you log on again unless you close your browser and reopen it.

  28. To fix this problem, see CTP Sacha Thomet StoreFront – Allow relogin without browser close. Edit the file C:\inetpub\wwwroot\Citrix\StoreWeb\custom\script.js, and add the following line:
    CTXS.allowReloginWithoutBrowserClose = true

  29. Now when you logoff, you’re given an option to log on again.

Active Directory Shadow Accounts

To login to Windows (Citrix VDA), every user must have an Active Directory account in a domain trusted by the VDA. For Federated Users, you typically need to create shadow accounts for each Federated user in your local Active Directory. These Shadow accounts need a userPrincipalName that matches the SAML attribute (usually email address) provided by the SAML iDP.

If the email address provided by the SAML iDP does not match the UPN suffix for your domain, then do the following:

  1. Open Active Directory Domains and Trust.
  2. Right-click the top left node (not a domain node), and click Properties.
  3. In the UPN Suffixes tab, add a UPN suffix that matches the email suffix provided by the SAML iDP.
  4. When creating a shadow account in your Active Directory, the new UPN suffix is available in the drop-down list. Note that the pre-Windows 2000 logon name can’t conflict with any other user in the domain.
  5. The password for these Shadow accounts can be any random complex password since the Federated users never need the Shadow account’s password.
  6. If the shadow account is already created, edit the account, and on the Account tab, use the drop-down to select the new UPN suffix.
  7. Create a shadow account for every federated user. There are third party Identity Management tools that can automate this. Or get an export from the iDP and use PowerShell scripting to create the acccounts.

Verify FAS

When FAS is enabled on StoreFront, every user that logs into StoreFront (local or remote) causes a user certificate to be created on the FAS server. You can see these user certificates by running the following PowerShell commands:

Add-PSSnapin Citrix.Authentication.FederatedAuthenticationService.V1
Get-FasUserCertificate -address fas01.corp.local

Citrix uses these certificates to logon to the VDA as the user. No password needed.

119 thoughts on “Citrix Federated Authentication Service (SAML)”

  1. Hi Carl

    in the FAS in step 2 “Setup CA” no CA is shown, although I have a CA in the same network/domain. How is the search working? Or do I have to install FAS on the CA server?

    Thanks and regards
    Udo

  2. Hi Carl

    What could be wrong, if I don’t see a CA in the second step “setup CA” although I have a CA in my network. How is the search working? Or do I have the FAS to install on the CA server itself?

    Regards
    Udo

  3. Hi Carl,

    fyi, I was able to fix it.
    There were two steps I’ve done.
    First step was to run the powershell cmdlets for Storefront and the DDC again and reboot the SF and DDC. After this was done, the error changed. I did not get the Windows logon screen like before, but I got a “Request Not Supported” on the logon screen.
    For this error there is a know solution in CTX218941 – Option B solved this issue.

    I’m now able to log on via SAML without any issue 🙂

    Kind regards
    Georg

  4. Hi Carl,

    thanks for your detailed instructions.
    anyway, I still have some trouble getting it up and running.
    I’m trying to implement the SAML authentication without a Netscaler with Storefront 3.9.
    I am able to logon to Storefront via SAML, but when I try to launch an application, I get the Windows Logon Screen.
    I can see, that FAS created the certificates, but it looks like they are not used to log on the user on the Terminalserver. The GPO gets applied and I also added the UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors RegKey.
    Do you have an idea what might go wrong?

    Kind regards
    Georg

      1. Yes, the GPO is also applied to the VDA (it’s currently only a lab environment with one VDA to test the FAS feature).

        VDA Version is 7.13 on Server 2012R2.

        The only thing I can see in the Event Viewer on the VDA are audit Success events in the Security Log in this order:
        Event 4624 Logon: An account was successfully logged on
        Event 4648 Logon: A logon was attempted using explicit credentials
        Event 4624 Logon: An account was successfully logged on
        Event 4624 Logon: An account was successfully logged on
        Event 4672 Special Logon: Special Privileges assigned to new logon
        Event 4672 Special Logon: Special Privileges assigned to new logon

        and after a short time (if I don’t enter anything in the windows Logon Screen) three Logoff Events:
        Event 4634 Logoff: An account was logged off
        Event 4634 Logoff: An account was logged off
        Event 4634 Logoff: An account was logged off

        Also I checked what happens, if I disable SAML authentication on Storefront and log on explicitly with Username/Password of the VDA Domain. Then passthrough is working without any issue. So most probably it’s not a general configuration issue with my VDA environment/receiver.

        Kind regards
        Georg

        1. Then you might have to call Citrix Support so they can review your configuration. Let me know what they find out.

  5. Hi Carl,
    I was wondering if it is possible to use the netscaler as a SP for multiple IDPs.
    Right now we browse to our netscalerfqdn and get redirected to the IDP.
    We want to browse to our netscalerfqdn/someuniquepageperIDP to redirect to a specific IDP to be able to connect via user@example.com and user@anotherexample.com on the same netscaler.

    1. AAA? Or NetScaler Gateway?

      You might be able to do a Responder policy that redirects you to a iDP that can do an iDP Initiated Flow.

      Or I wonder if you can add an expression to the SAML Auth Policy that uses the URL to select the correct SAML Policy. However, NetScaler might strip off the URL path before evaluating auth policies.

  6. Hi Carl,
    I followed your guide to configure SSO via netscaler 11.1 in POC.
    We can login to the netscaler via ADFS 3.0 but when starting an applications it failed.
    I get an error on the storefront server:
    Failed to launch the resource ‘Controllers.Notepad’ using the Citrix XML Service at address ‘??’. An unknown error occurred interacting with the Federated Authentication Service.
    And a bit further down in the eventdescription:
    Could not contact any Federated Authentication Servers
    Do you have any idea?

      1. Wow, I feel stupid now. I did apply the GPO to our vda’s and delivery controllers but didn’t check our storefront server. It wasn’t in the same OU.
        Thanks for the help and the great guide!

  7. Great article 🙂 I use OTP (safenet) instead of SAML to authenticate users on Netscaler and put in place FAS to get access to the virtual desktop with cert based auth. Despite the fact auth is successful on Netcaler (with no SSO on web resources similar as you asked for SAML), it fails on Storefront with eventid 7 (CitrixAGBasic single sign-on failed because the credentials failed verification with reason: Failed) and eventid 10 (A CitrixAGBasic Login request has failed) with the very common message “cannot complete your request”. Storefront is set with an auth method of “passthrough ffrom netscaler” with credential delegated to Netcaler and auth type of “security token”. I thought that, once auth was successful on Netscaler, it will be straightforward to deal with FAS, but I guess cert based auth is triggered only when you connect on a resource displayed on Storefront, not before right? I’m stuck: any idea of what I miss? Thanks.

  8. Hi!

    If we have an external iDP and use Netscaler as SP, do we need FAS to enable users to connect through the Netscaler to Storefront?

    Currently users get redirected from Netscaler to iDP and then to the Storefront which gives the “cannot complete request”, and the event log says the password for the user failed to meet complexity requirements.

    1. In StoreFront, you can select the option to completely delegate authentication to NetScaler Gateway. You also need Trust XML enabled on your Controllers. This should get you the list of icons, but you it won’t log you into the VDA automatically without FAS.

  9. Carl, I would like to limit the need for domain users connecting remotely to need to enter a username and password to connect. I was thinking Certificate Based Authentication would work in this Scenario. I would also be placing a 2nd factor authentication behind the first (duo security). Would this solution above allow me to do this or facilitate the rollout of it?

    1. As long as you can send the username to StoreFront then it should work. If doing NetScaler, NetScaler needs to send the username (UPN) to StoreFront. Can you get the username from your NetScaler authentication methods? Maybe extract the UPN from the certificate?

      StoreFront will then do the Callback to NetScaler Gateway and create a Federated Authentication Service certificate.

  10. hi carl. is there a way, to get FAS working with Citrix Receiver SelfService, so that i can start a published Application from a Win10 Client directly from startmenue? With Smartcard and FAS we have the problem that the Windows Logon Window from the published App will open, to ask again our credentials. Is there anything to get this use case to working?

    1. It should be possible to use Smart Card to log into the VDA. Is the Smart Card driver installed on the VDA? Do you have Pass-through auth configured on Receiver so it captures the pin? There are several Smart Card guides on the Internet. Smart Cards don’t need FAS.

      1. hi carl, yes smart card driver is on vda installed. the major goal is, that we must use the native receiver with FAS, and to open a published Application from the Client´s Startmenue without Prompt again for Credentials. i am not sure, if that is technical feasible. did you know that?

  11. Please share the link to setup NetScaler AAA and configure with XenApp\XenDesktop for app launch. It will help us to login into StoreFront via NetScaler AAA and launch apps.

    1. I just added a some links to other NetScaler articles for Session Policies and Gateway. Is that what you’re looking for?

  12. Hi Carl-

    A few questions regarding this deployment that I hope you can answer:

    * Can we limit how long those virtual smart cards are active for?

    * The CA creates a virtual smart card and passes it over to the FAS, is that correct? So both have a copy of the virtual smartcard. If so, what security risks are involved and how do we limit this?

    * Once a user a logs into the VDA (desktop) with the virtual smartcard , any other App requiring SSO inside the VDA should work or do they need to authenticate again? Is it using the in-session certificate of the same virtual smart card? Again, can we limit to have it deleted after log off?

    *Also, when we enable FAS on the storefront, users internally who login, would they have a virtual smart card created too? Can we limit this?

    Thanks,
    Bob

    1. By default, the smart cert certificate is only used for VDA logon. There’s a GPO setting to keep it past the logon so the certificate can be used for other cert-auth-based systems.

      Once logged into the VDA, the user should now have a Kerberos TGT, which can be used for Kerberos authentication to other systems.

      I think Federated Authentication Service is enabled for an entire store, no matter how connected. You could use different stores or different StoreFront servers.

      1. Thanks, Carl! Also, when it says XenDesktop 7.9 or newer is required, does that mean VDAs only, or does the delivery controllers have to be updated, as well?

        1. I think it’s StoreFront, VDAs, and Controllers. It’s Controllers that create the authentication ticket for the VDA. I suspect there’s something FAS specific in the VDA authentication mechanism from the Controllers.

  13. We are testing SAML and having an issue with Receiver SSO.

    When logging into a desktop VDA via Netscaler with SAML, Receiver SSO doesn’t work to access XenApp apps from the desktop VDA. Apps launch but users get windows login prompt when launching app. This doesnt happen if the Netscaler uses LDAP login to desktop VDA or if users login to desktop VDA via Storefront.

    1. That’s an interesting point since Reciver doesn’t have the user’s password. I assume browser to StoreFront from inside the session works fine?

      1. I dont have this working yet but I am guessing after reading into it more we need to enable Kerberos for Citrix Receiver – https://docs.citrix.com/en-us/receiver/windows/4-6/secure-connections/ica-kerberos-sspi-v2.html. Existing policy enables SSO for Reciever but no Kerberos. The documentation isn’t clear which machines we need to enable “trust this computer for delegation”. Is this on Storefront Servers? Delivery Controllers? XenDesktop VDA? XenApp VDA? Some combination of those?

        Users login to Windows 10 XenDesktop VDA via SAML and launch XenApp Apps from Server OS VDA running on Windows 2012 R2.

  14. Hi Carl,

    I have configured an environment with this guide but when I click the application into Storefront i received this error: Citrix Receiver cannot connect to the server. Please refer to the Citrix Knowledge Center article on configuring local access for HTML5.
    Have you an idea?

    Thank you

    Silvio

    1. Are you internal?

      Do you have Receiver installed on the endpoint machine? If so, in the browser, click your name on the top right, and click Change Receiver. Make sure you click the blue button to detect Receiver.

      1. I have configured a SAML login with OneLogin and NetScaler ADC 11.1; The login it’s ok but when I launch any applications I receive this error.
        The HTML5 access is wanted. In case that I use the Citrix Receiver installed into my machine I receive this error:
        Cannot connect to the Citrix XenApp server. The Citrix SSL server you have selected is not accepting connections

        Thank you

        1. This looks like an issue with the StoreFront/NetScaler Gateway configuration. STAs are identical on both StoreFront and NetScaler Gateway? The Gateway address is actually reachable from your client machine? ICA Proxy is enabled on your Gateway?

          I don’t think this is related to SAML or FAS.

  15. We want to use keycloak claim to authenticate against xenapp. I think this can be done using FAS without integration with netscalar. Could you please suggest?

      1. Yes i am able to get the user name from keycloak by using oauth token. I have code that returns the username and i have tested that code with magicauthentication sample deployed in storefront. I understand that can give me certificate for the user and i have setup FAS as well. Plan is to user custom FAS claims factory, get user name from keycloak and get certificate from FAS. But struggling to make custom claims factory sample.

        1. This is beyond me. If you post to Citrix Discussions, the StoreFront Product Managers sometimes respond. Or Citrix Consulting can help you with your code.

  16. Can i use federated authentication service without netscalar? We need to authenticate user with oAuth token from keycloak. is there any way without using netscalar?

    1. If you can authenticate with StoreFront, then FAS will be used.

      StoreFront currently supports Kerberos, or password, or a NetScaler Gateway trust relationship. Maybe some custom code can enable other auth scenarios.

      1. I have deployed custom FAS citrix authentication sample and have performed all FAS specific configurations but not able to make the custom FAS sample run. Like magicword atuthentication i am able to deploy and enable it from storefront administration. Could you please guide me to some document that talks about FAS without netscalar?

  17. Hi Carl,

    If we have users in xyz.com domain and SAML IDP is also in the same domain.

    All XenApp, FAS & Netscaler are in abc.com domain.

    Do we need a shadow account in abc.com domain with same user name as in xyz.com domain?

    Regards,
    Ranveer

    1. Yes. The shadow accounts need the same UPN as the user’s email address, or whatever UPN/email the iDP is sending to the SP.

  18. Hey Carl,

    Great article! We followed these instructions to the letter, but we are having an issue: after authenticating at the IdP, the SAML assertion is received properly by the Netscaler (NS) (confirmed with logs), but we are getting a “Error: Not a priviledged user.” message on the browser. We are doing everything as you outlined here, with the only difference is we are using NS version 10.5. Do you know if this config will work with that version, or do we need to upgrade to 11.x?

    Cheers,
    Jim.

      1. We are using PingFederate as the IdP…and the NS logs show the SAML being received, the signature digest validated successfully, and the username is extracted from the SAML assertion. Then we get two “SSLVPN Message 25742 0 : “AAA Client Handler: Found extended error code 589826″” in the log…which is right about when the users gets the privileged user error.

          1. Your suggestion of setting the “Default Authorization Action = ALLOW” did the trick. Thanks a bunch!

  19. Hi Carl-

    I have this working with username and password with ADFS being my iDP.

    How would I enable this for smart cards using ADFS?

    Thanks,
    Bob

    1. I assume there’s some way to add smart card auth to ADFS. The ADFS generates the SAML token and NetScaler/FAS consumes it. Shouldn’t be anything different on the Citrix side. You won’t need the smart card to log into the VDA since FAS takes care of it.

  20. Hi Carl,

    Will the 3 FAS certificates will work with Windows Server 2003 Certificate Authority Services.

    Citrix_RegistrationAuthority_ManualAuthorization
    Citrix_RegistrationAuthority
    Citrix_SmartcardLogon

    1. They are created using the Win2003 version of the templates so they might work. But of course, 2003 is not supported.

  21. Technically are there any restrictions that do not allow the same group of XenApp servers (Delivery Controller, Store Front and VDA) to be configured to support both FAS and AD domain login concurrently?

    1. However, since users connect to VDAs, you probably don’t want users to have access to Federated Authentication Service, which can create logon certificates for anybody in the domain.

    2. Let’s assume that Citrix resources are bound to a customer resource domain, while customer is still authenticated on his regular account domain, i.e. XenDesktop backend servers and front-end desktops are part of vdi.local domain while customer is authenticated on virtual desktop desk00x.vdi.local with james@acme.corp. In which domain would you install the federation server?

      1. The primary goal of Federated Authentication Service is to login to the VDA. So FAS needs to create certificates for AD accounts that are trusted by the VDA.

  22. Hi Carl-

    I’m using ADFS with our NetScaler 11.1 to for the federated service. When I log into the NetScaler with our smart card, it hits the iDP login page with an error. This is the following error I see under Event Viewer in ADFS:

    Exception details:
    System.UriFormatException: Invalid URI: The format of the URI could not be determined.
    at System.Uri.CreateThis(String uri, Boolean dontEscape, UriKind uriKind)
    at Microsoft.IdentityServer.Web.Protocols.Saml.SamlSignInContext.Validate()
    at Microsoft.IdentityServer.Web.Protocols.Saml.SamlProtocolHandler.GetRequiredPipelineBehaviors(ProtocolContext pContext)
    at Microsoft.IdentityServer.Web.PassiveProtocolListener.OnGetContext(WrappedHttpListenerContext context)

    Any help would be much appreciated.

    Thanks

  23. Hi Carl,

    We have setup FAS in our environment and successfully authenticated the users using Saml, but from last 2 months we noticed that some random users while launching the Desktop gets Struck at Welcome screen. After a rebooting the app server, the sessions just works fine. Could you please help us on this.

  24. Hi Carl,

    I believe you have a small error in your text under saml gateway configuration, it says:

    Import a certificate with private key for SAML assertion verification. You’ll also need to import this certificate (without private key) on your SAML iDP. The SAML iDP will use this certificate to sign the SAML assertions. NetScaler will then use the private key to verify the SAML signatures.

    This should be the other way around, the private key is always used to sign, and the public key is used to verify the signature. So the private key of the Netscaler signing certificate should be used to sign the SAML Request and the private key of the IDP(/ADFS) should be used to sign the SAML Response. (Your explanation is right for encryption of the saml response, this would be done with the public key of the Netscaler certificate, and can then only be decrypted with it’s private key.)

    Kind regards,
    Enrico Klein

    1. Once you’re connected to a VDA, you can use any app on the VDA. Or are you saying that your app requires additional authentication?

      1. some applications require another type of authentication that is not LDAP, Password Manager before it could, FAS can do the same?

        1. If NetScaler Gateway receives the user’s UPN, then it can send it to FAS to complete the authentication process.

  25. Hi Carl,

    I tested a configuration with OneLogin.
    After entering the credentials in the OneLogin page I get redirected to the StoreFront site. But the I get an Storefront error “request cannot be completed”.
    On the DDC&StoreFront-Server I realized some Errors in “Citrix Delivery Services”-EventVwr which are indicating that domain and password are missing (see below).
    At the CA there is no certificate created and FAS server shows no error message.
    I think the communication from StoreFront to FAS server is missing. The GPO is configured correctly.
    What else should I check?

    Event ID: 2 Source: Citrix Authentication Service Level: Error
    Access is denied. Contact your system administrator.
    Citrix.DeliveryServices.Security.Authentication.Exceptions.MissingDomainException, Citrix.DeliveryServices.Security, Version=3.6.0.0, Culture=neutral, PublicKeyToken=e8b77d454fa2a856
    The domain of the credential cannot be determined.
    at Citrix.DeliveryServices.Security.Authentication.UserInfo.Parse(String username, String domain, String defaultDomain, String password, Nullable`1 passwordExpired)
    at Citrix.DeliveryServices.Authentication.CitrixAGBasic.Controllers.CitrixAGBasicController.AuthenticateWithoutPassword(String username, String domain, AccessInfo accessInfo)
    at Citrix.DeliveryServices.Authentication.CitrixAGBasic.Controllers.CitrixAGBasicController.Authenticate()

    Event ID: 2 Source: Citrix Authentication Service Level: Error
    Access is denied. Contact your system administrator.
    Citrix.DeliveryServices.Security.Authentication.Exceptions.MissingDomainException, Citrix.DeliveryServices.Security, Version=3.6.0.0, Culture=neutral, PublicKeyToken=e8b77d454fa2a856
    The domain of the credential cannot be determined.
    at Citrix.DeliveryServices.Security.Authentication.UserInfo.Parse(String username, String domain, String defaultDomain, String password, Nullable`1 passwordExpired)
    at Citrix.DeliveryServices.Authentication.CitrixAGBasic.Controllers.CitrixAGBasicController.AuthenticateWithoutPassword(String username, String domain, AccessInfo accessInfo)
    at Citrix.DeliveryServices.Authentication.CitrixAGBasic.Controllers.CitrixAGBasicController.Authenticate()

    1. You didn’t mention NetScaler Gateway.

      Make sure the SAML Name ID matches a userPrincipalName in your local domain.

      1. Thanks Carl,

        I rechecked the SAML Name ID in OneLogin configuration and found some misspelling.
        Now everythink works fine.

        Regards
        Oliver

  26. After installing the Certificate templates, All servers and workstations (ones that have nothing to do with Xenapp) are now requesting the Citrix_RegistrationAuthority_ManualAuthorization certificate. How do we prevent that or is this normal?

  27. I keep getting “The term ‘Get-STFStoreService’ is not recognized as the name of a cmdlet, function, script file, or operable program.” when I get to the storefront configuration. I’m on Storefront 3.6.0.33

        1. Run the command with a & in front of it?

          & “C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1”

          Also run get-modules and make sure Citrix.StoreFront.Stores is in your list.

          1. I ran that command and it worked, but when I run “get-modules”, that also comes back with the same error “not recognized”

          2. The Citrix.Storefront.Stores is not in the list unfortunately. How do I import that module aside from the importmodules.ps1?

          3. Maybe you have a bad installation of StoreFront. If you call Support, they can help you fix your installation.

  28. I have followed the steps, and my account is a local admin on the FAS server and a Domain Admin. But for some reason when i try to open the FAS console it prompts me for a login after passing the FAS server list. It never accepts my credentials and i cannot proceed. Is the anything i am missing.

  29. “Import a certificate with private key for SAML assertion verification. You’ll also need to import this certificate (without private key) on your SAML iDP. The SAML iDP will use this certificate to sign the SAML assertions. NetScaler will then use the private key to verify the SAML signatures.”

    Is this a different certificate from the one bound to the NSG VIP?

    1. It can be the same. But most use self-signed certs. The important part is that NetScaler uses the private key to sign the iDP Auth Request. Then iDP uses the public key to verify it came from the NetScaler.

  30. Thank you Carl, but for the smartcard process, I research also the possibility to use the name mapping with smartcard. Have you a documentation for that process, thank you in advance.

  31. Hello Carl,
    Is there a possibility to use Xenapp or Xenapp and Storefront with smartcard authentication ? But I search a mode without ADFS. Do you have information for that ?

  32. We did manage to get it working, at least to the point of applications enumerating in Storefront but ran in to an issue with XML not trusted.

    1. Hi Tom, you need to run following command (powershell) on your DDC’s
      “Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true”

  33. Hi Carl,

    did you also test NS 11.1.47.14?

    It seams that there are many changes in SAML dialogs.

    Regards
    Oliver

  34. I have followed the steps using shibboleth as my idp, but getting a error when redirection happens from IDP page, getting the error unsupported mechanism found in assertion. Are you aware of this problem

    1. What build of NetScaler?

      You might be able to use Fiddler to trace the SAML communication. Maybe something unsupported by NetScaler? 11.1 adds some new SAML features.

    1. I’ve seen some comments indicating that any auth to StoreFront will kick in FAS but I haven’t seen any instructions for it yet. Otherwise, all documented procedures include Gateway.

    1. Getting an error regarding SAML auth with OKTA:
      SAML Assertion verification failed; Please contact your administrator

      SAML Tracer in Firefox:

      tom@mycorp.com

      Looks like Name ID isn’t matching up??

      1. Did you manage to get this working? Ours is working fine currently with the same environment as yours. We even managed to get it working on SHA256 by creating our own custom OKTA App and using the NS advanced options for SAML. Otherwise the default option for NS and the Native OKTA app are both SHA1. The time I’ve seen errors in the assertion have been when there was a mismatch in the encryption or mis-typed values in either NS or OKTA. I’d be curious to see the full error.

  35. Hi Carl,

    The article give by Citrix is a half baked one regarding netscaler and ADFS on windows 2012R2.Can you provide more info if you have any

  36. Great work! I’m wondering how to configure the relying party trust on ADFS? Do you have any steps on that?

  37. Hi Carl, great work by the way

    you mention in the post the requirements are

    Microsoft Certificate Authority in Enterprise mode
    XenApp/XenDesktop 7.9
    StoreFront 3.6
    NetScaler Gateway
    Receiver for Web only. Receiver Self-Service doesn’t support web-based authentication.

    Then it gets to the bottom and you show a screen for an ADFS server?

    I take it thats a requirement also for this to work?

    best regards

    Phil

Leave a Reply