In Citrix Virtual Apps and Desktops service
In All products
Product documentation
In Citrix Virtual Apps and Desktops service
In All products
Citrix Virtual Apps and Desktops service
View PDF

Manage security keys

September 17, 2020
Contributed by:  C

Important:

You must use this feature in combination with StoreFront 1912 LTSR CU2 or later. StoreFront 1912 LTSR CU2 has not yet been released.

This feature lets you allow only approved StoreFront and Citrix Gateway machines to communicate with Citrix Cloud. After you enable this feature, any requests that do not contain the key are blocked. Use this feature to add an extra layer of security to protect against attacks originating from the internal network.

By default, the feature is disabled. To enable it, use the Remote PowerShell SDK. For more information about the Remote PowerShell SDK, see SDKs and APIs.

To enable the feature, perform these steps:

  1. Run the Citrix Virtual Apps and Desktops Remote PowerShell SDK.
  2. In a command window, run the following commands:
    • asnp Citrix*. This command adds the Citrix snap-ins.
    • Set-ConfigSiteMetadata -Name "Citrix_DesktopStudio_SecurityKeyManagementEnabled" -Value "True"

To verify that the feature is enabled, navigate to the Citrix Cloud > Virtual Apps and Desktops service > Manage tab and click Configuration in the Studio navigation pane. If the feature is enabled, the Manage Security Key option appears in the Configuration pane. You might need to click Refresh for the option to appear.

The Manage Security Key window appears after you click Manage Security Key.

Manage Security Key wizard

There are two keys available for use. Select a key and then click the refresh icon to generate your key.

Important:

  • Use only one key at a time. The unused key is used only for key rotation.
  • Do not click the refresh icon to update the key already in use. If you do, service interruption will occur.

Require key for communications over XML port (StoreFront only). Indicates whether to require a key to authenticate communications over the XML port. StoreFront communicates with the Delivery Controller over this port. For information about changing the XML port, see Knowledge Center article CTX127945.

Require key for communications over STA port. Indicates whether to require a key to authenticate communications over the STA port. Citrix Gateway and StoreFront communicate with the Delivery Controller over this port. For information about changing the STA port, see Knowledge Center article CTX101988.

After applying your changes, click Close to exit the Manage Security Key window.

You now have successfully completed the configuration in Citrix Studio. You also need to configure settings in StoreFront. Make sure that you use StoreFront 1912 LTSR CU2 or later.

To use the key to authenticate communications over the XML port:

  1. Copy the key you generated in Studio.

  2. Select Validate XML Service endpoint when adding the delivery controller to the store.

    Validate XML Service endpoint

  3. Paste the key into the Shared secret field.

To use the key to authenticate communications over the STA port:

  1. Copy the key you generated in Studio.

  2. Select Enable STA endpoint validation when adding the Secure Ticket Authority.

    Enable STA endpoint validation

  3. Paste the key into the Shared secret field.

For more information about XML and STA authentication, see the StoreFront documentation.

Manage security keys

September 17, 2020
Contributed by:  C
September 17, 2020
Contributed by:  C

In this article