Configure Citrix Gateway Session Policies for StoreFront

This article describes how to configure a Citrix Gateway domain only authentication with StoreFront for users who are using Citrix Workspace app or a web browser.

localized image

Minimum requirements

  • Citrix StoreFront 2.x or 3.0

  • Citrix ADC 10.5 and higher

  • Citrix Workspace app for Windows 4.x

  • Citrix Workspace app for Mac 11.8

  • Web browser (Citrix Workspace app for Web)

  • Authentication configured on the Citrix ADC appliance as outlined in CTX108876 - How to Configure LDAP Authentication on a Citrix ADC appliance

  • SSL Certificates configured for StoreFront Server and Citrix Gateway. For details on the following topics, see StoreFront Documentation.

    ​- Install and set up for StoreFront 2.6

    • Windows 2012 Server Certificates

    • To add an SSL binding to a site

    • Installing and Managing Certificates for Citrix ADC appliance 10.5

Configure Citrix Gateway with StoreFront

localized image

Create a session policy for web browser based access

  1. To create session policy, navigate to Citrix Gateway > Policies > Session.

  2. In the Session Policies field, click Add.

  3. In the Name field, type the name of the Session Policy. For example, Web_Browser_Policy.

  4. Click the box with the + sign.

    localized image

  5. Type in the name of the new Session Profile in the Configure Citrix Gateway Session Profile window.

    localized image

  6. In the Client Experience tab, enable the following settings:

    • Clientless Access: set to On

    • Single sign-on to Web Application: Select the check box

    • Plug-in Type: Set to Windows/MAC OS X

    localized image localized image localized image

  7. In the Security tab, enable Default Authorization Actions and set it to ALLOW.

    localized image

  8. In the Published Application tab, enable the following settings:

    • ICA Proxy: Set to ON.

    • Web Interface Address: FQDN of the StoreFront server followed by the path to the store for web

    • Single Sign-on Domain - NetBIOS name for the domain

    localized image

  9. Click Create.

  10. If you are using Classic Policy expression, in the Expression field, add the following information and click Create.

    REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver
    

    localized image

  11. If using Advanced Policy expression, in the Expression field, add the following information and click Create.

    HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver").NOT
    

    localized image

    This policy is needed for the Citrix ADC to differentiate between web browser based and Citrix Workspace app based connections. This policy is applied to web browser based connections.

Create a session policy for Citrix Workspace app for Windows or Mac, and Mobile Devices on Citrix Gateway

  1. Navigate to Citrix Gateway > Policies > Session.

  2. In the Session Policies field, click Add.

  3. In the Name field, type the name of the session policy. For example, Receiver_Policy

  4. Click the box with the + sign.

    localized image

  5. Type in the name of the new session profile in the Configure Citrix Gateway Session Profile window.

    localized image

  6. In the Client Experience tab, enable the following settings:

    localized image localized image localized image

    • Home Page: Set to None

    • Split Tunnel: Set to OFF

    • Clientless Access: Set to On

    • Single Sign-on to Web Application: Select the check box

    • Plug-in Type: Set to Java

    localized image

  7. In the Security tab, set Default Authorization Actions to ALLOW.

    localized image

  8. In the Published Application tab, enable the following settings:

    • ICA Proxy: Set to ON.

    • Web Interface Address: FQDN of the StoreFront server followed by the path to the store

    • Single Sign-on Domain: NetBIOS name for the domain

    • Account Services Address: Enter the account services address. The last back slash is important.

    localized image

  9. Click Create.

  10. If using Classic Policy expression, in the Expression field, add the following information and click Create.

    REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver
    

    localized image

  11. If using Advanced Policy expression, in the Expression field, add the information listed below and click Create.

    HTTP.REQ.HEADER("User-Agent").CONTAINS("CitrixReceiver")
    

    localized image

    This policy is needed for the Citrix ADC to differentiate between the web browser based and Citrix Workspace app based connections. This policy is applied for Citrix Workspace app based connections.

Configure authentication on the Citrix ADC appliance

For information about configuring LDAP authentication on a Citrix ADC appliance, see Configuring LDAP Authentication.

Create Citrix Gateway virtual server and bind the session policies

  1. Navigate to Citrix Gateway > Virtual Server and click Add to add a new virtual server.

    localized image

  2. After the virtual server is created, bind the specific session policy to the virtual server based on your company’s requirements.

Configure authentication for StoreFront

  1. Enable the pass-through authentication from Citrix Gateway on StoreFront. For more information, see Configure the authentication service.

    StoreFront must trust the issuer of the Citrix Gateway virtual server’s bound certificate (Root and/or Intermediate certificates) for the Authentication Callback service.

  2. Add Citrix Gateway to StoreFront. For more information, see Add a Citrix Gateway connection.

    The Gateway URL must match exactly with what the users are typing into the web browser address bar.

  3. Enable remote access on the StoreFront store. For more information, see Manage remote access to stores through Citrix Gateway.