StoreFront

Federated Authentication Service Configuration

April 3, 2024

Contributed by:

C S S

When using authentication methods such as SAML, where the user does not enter their credentials directly into Citrix Workspace app, by default it is not possible to single sign-on into VDAs. In these cases, you can use Federated Authentication Service (FAS) to provide single sign-on to VDAs using certificate authentication.

To use FAS with StoreFront, you must configure StoreFront using the PowerShell SDK. Use Set-STFClaimsFactoryNames to set the claims factory to FASClaimsFactory and use Set-STFStoreLaunchOptions to set the VDA logon data logon provider to FASLogonDataProvider.

For example to enable FAS for a store:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
<!--NeedCopy-->

To disable FAS for a store:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "standardClaimsFactory"
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider ""
<!--NeedCopy-->

Substitute [VirtualPath] for the appropriate virtual path, e.g. /Citrix/Store.

To configure the list of FAS servers and other settings you must use Group policy. For more details see FAS documentation.

FAS is not used when authenticating using domain pass-through or smart card through a browser.

FAS server unavailability

If the FAS server is unavailable the launch fails by default. However, you can configure StoreFront such that if the FAS server is unavailable, users can sign on to the VDA by entering their credentials. To change the configuration use Powershell cmdlet Set-STFStoreLaunchOptions with parameter FederatedAuthenticationServiceFailover. For example to enable fail over for a store:

$storeService = Get-STFStoreService -VirtualPath [VirtualPath]
Set-STFStoreLaunchOptions $storeService -FederatedAuthenticationServiceFailover $True
<!--NeedCopy-->

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Federated Authentication Service Configuration

April 3, 2024

Contributed by:

C S S

April 3, 2024

Contributed by:

C S S

Federated Authentication Service Configuration

FAS server unavailability

In this article