Citrix Virtual Apps and Desktops service

Manage security keys

Note:

You must use this feature in combination with StoreFront 1912 LTSR CU2 or later.

This feature lets you allow only approved StoreFront and Citrix Gateway machines to communicate with Citrix Cloud. After you enable this feature, any requests that do not contain the key are blocked. Use this feature to add an extra layer of security to protect against attacks originating from the internal network.

A general workflow to use this feature is as follows:

  1. Enable the feature in Studio by using the PowerShell SDK.

  2. Configure settings in Studio. (Use the Studio console or PowerShell).

  3. Configure settings in StoreFront. (Use PowerShell).

Enable the security key feature

By default, the feature is disabled. To enable it, use the Remote PowerShell SDK. For more information about the Remote PowerShell SDK, see SDKs and APIs.

To enable the feature, perform these steps:

  1. Run the Citrix Virtual Apps and Desktops Remote PowerShell SDK.
  2. In a command window, run the following commands:
    • Add-PSSnapIn Citrix*. This command adds the Citrix snap-ins.
    • Set-ConfigSiteMetadata -Name "Citrix_DesktopStudio_SecurityKeyManagementEnabled" -Value "True"

Configure settings in Studio

You can configure settings in Studio by using the Studio console or PowerShell.

Use the Studio console

After enabling the feature, navigate to Studio > Configuration > Manage Security Key. You might need to click Refresh for the Manage Security Key option to appear.

The Manage Security Key window appears after you click Manage Security Key.

Manage Security Key wizard

Important:

  • There are two keys available for use. You can use the same key or different keys for communications over the XML and STA ports. We recommend that you use only one key at a time. The unused key is used only for key rotation.
  • Do not click the refresh icon to update the key already in use. If you do, service interruption will occur.

Click the refresh icon to generate new keys.

Require key for communications over XML port (StoreFront only). If selected, require a key to authenticate communications over the XML port. StoreFront communicates with Citrix Cloud over this port. For information about changing the XML port, see Knowledge Center article CTX127945.

Require key for communications over STA port. If selected, require a key to authenticate communications over the STA port. Citrix Gateway and StoreFront communicate with Citrix Cloud over this port. For information about changing the STA port, see Knowledge Center article CTX101988.

After applying your changes, click Close to exit the Manage Security Key window.

Use PowerShell

The following are PowerShell steps equivalent to Studio operations.

  1. Run the Citrix Virtual Apps and Desktops Remote PowerShell SDK.

  2. In a command window, run the following command:
    • Add-PSSnapIn Citrix*
  3. Run the following commands to generate a key and set up Key1:
    • New-BrokerXmlServiceKey
    • Set-BrokerSite -XmlServiceKey1 <the key you generated>
  4. Run the following commands to generate a key and set up Key2:
    • New-BrokerXmlServiceKey
    • Set-BrokerSite -XmlServiceKey2 <the key you generated>
  5. Run one or both of the following commands to enable the use of a key in authenticating communications:
    • To authenticate communications over the XML port:
      • Set-BrokerSite -RequireXmlServiceKeyForNFuse $true
    • To authenticate communications over the STA port:
      • Set-BrokerSite -RequireXmlServiceKeyForSta $true

See the PowerShell command help for guidance and syntax.

Configure settings in StoreFront

After completing the configuration in Studio, you need to configure relevant settings in StoreFront by using PowerShell.

On the StoreFront server, run the following PowerShell commands:

  • To configure the key for communications over the XML port, use the Get-STFStoreServie and Set-STFStoreService commands. For example:
    • PS C:\> Set-STFStoreFarm $farm -Farmtype XenDesktop -Port 80 -TransportType HTTP -Servers <domain name1, domain name2> -XMLValidationEnabled $true -XMLValidationSecret <the key you generated in Studio>
  • To configure the key for communications over the STA port, use the New-STFSecureTicketAuthority command. For example:
    • PS C:\> $sta = New-STFSecureTicketAuthority –StaUrl <STA URL> -StaValidationEnabled $true -StavalidationSecret <the key you generated in Studio>

See the PowerShell command help for guidance and syntax.

Manage security keys