Manage security keys
Note:
You must use this feature in combination with StoreFront 1912 LTSR CU2 or later.
This feature lets you allow only approved StoreFront and Citrix Gateway machines to communicate with Citrix Cloud. After you enable this feature, any requests that do not contain the key are blocked. Use this feature to add an extra layer of security to protect against attacks originating from the internal network.
A general workflow to use this feature is as follows:
-
Enable the feature in Studio by using the PowerShell SDK.
-
Configure settings in Studio. (Use the Studio console or PowerShell).
-
Configure settings in StoreFront. (Use PowerShell).
Enable the security key feature
By default, the feature is disabled. To enable it, use the Remote PowerShell SDK. For more information about the Remote PowerShell SDK, see SDKs and APIs.
To enable the feature, perform these steps:
- Run the Citrix Virtual Apps and Desktops Remote PowerShell SDK.
- In a command window, run the following commands:
-
Add-PSSnapIn Citrix*. This command adds the Citrix snap-ins. Set-ConfigSiteMetadata -Name "Citrix_DesktopStudio_SecurityKeyManagementEnabled" -Value "True"
-
Configure settings in Studio
You can configure settings in Studio by using the Studio console or PowerShell.
Use the Studio console
After enabling the feature, navigate to Studio > Configuration > Manage Security Key. You might need to click Refresh for the Manage Security Key option to appear.
The Manage Security Key window appears after you click Manage Security Key.
Important:
- There are two keys available for use. You can use the same key or different keys for communications over the XML and STA ports. We recommend that you use only one key at a time. The unused key is used only for key rotation.
- Do not click the refresh icon to update the key already in use. If you do, service interruption will occur.
Click the refresh icon to generate new keys.
Require key for communications over XML port (StoreFront only). If selected, require a key to authenticate communications over the XML port. StoreFront communicates with Citrix Cloud over this port. For information about changing the XML port, see Knowledge Center article CTX127945.
Require key for communications over STA port. If selected, require a key to authenticate communications over the STA port. Citrix Gateway and StoreFront communicate with Citrix Cloud over this port. For information about changing the STA port, see Knowledge Center article CTX101988.
After applying your changes, click Close to exit the Manage Security Key window.
Use PowerShell
The following are PowerShell steps equivalent to Studio operations.
-
Run the Citrix Virtual Apps and Desktops Remote PowerShell SDK.
- In a command window, run the following command:
Add-PSSnapIn Citrix*
- Run the following commands to generate a key and set up Key1:
New-BrokerXmlServiceKeySet-BrokerSite -XmlServiceKey1 <the key you generated>
- Run the following commands to generate a key and set up Key2:
New-BrokerXmlServiceKeySet-BrokerSite -XmlServiceKey2 <the key you generated>
- Run one or both of the following commands to enable the use of a key in authenticating communications:
- To authenticate communications over the XML port:
Set-BrokerSite -RequireXmlServiceKeyForNFuse $true
- To authenticate communications over the STA port:
Set-BrokerSite -RequireXmlServiceKeyForSta $true
- To authenticate communications over the XML port:
See the PowerShell command help for guidance and syntax.
Configure settings in StoreFront
After completing the configuration in Studio, you need to configure relevant settings in StoreFront by using PowerShell.
On the StoreFront server, run the following PowerShell commands:
- To configure the key for communications over the XML port, use the
Get-STFStoreServieandSet-STFStoreServicecommands. For example:PS C:\> Set-STFStoreFarm $farm -Farmtype XenDesktop -Port 80 -TransportType HTTP -Servers <domain name1, domain name2> -XMLValidationEnabled $true -XMLValidationSecret <the key you generated in Studio>
- To configure the key for communications over the STA port, use the
New-STFSecureTicketAuthoritycommand. For example:PS C:\> $sta = New-STFSecureTicketAuthority –StaUrl <STA URL> -StaValidationEnabled $true -StavalidationSecret <the key you generated in Studio>
See the PowerShell command help for guidance and syntax.