Smart card deployments
The following types of smart card deployments are supported by this product version and by mixed environments containing this version. Other configurations might work but are not supported.
| Type | StoreFront connectivity |
|---|---|
| Local domain-joined computers | Directly connected |
| Remote access from domain-joined computers | Connected through Citrix Gateway |
| Non-domain-joined computers | Directly connected |
| Remote access from non-domain-joined computers | Connected through Citrix Gateway |
| Non-domain-joined computers and thin clients accessing the Desktop Appliance site | Connected through Desktop Appliance sites |
| Domain-joined computers and thin clients accessing StoreFront through the XenApp Services URL | Connected through XenApp Services URLs |
The deployment types are defined by the characteristics of the user device to which the smart card reader is connected:
- Whether the device is domain-joined or non-domain-joined.
- How the device is connected to StoreFront.
- What software is used to view virtual desktops and applications.
In addition, smart card-enabled applications such as Microsoft Word, and Microsoft Excel can be used in these deployments. Those applications allow users to digitally sign or encrypt documents.
Bimodal authentication
Where possible in each of these deployments, Receiver supports bimodal authentication by offering the user a choice between using a smart card and entering their user name and password. This is useful if the smart card cannot be used (for example, the user has left it at home or the logon certificate has expired).
Because users of non-domain-joined devices log on to Receiver for Windows directly, you can enable users to fall back to explicit authentication. If you configure bimodal authentication, users are initially prompted to log on using their smart cards and PINs but have the option to select explicit authentication if they experience any issues with their smart cards.
If you deploy Citrix Gateway, users log on to their devices and are prompted by Receiver for Windows to authenticate to Citrix Gateway. This applies to both domain-joined and non-domain-joined devices. Users can log on to Citrix Gateway using either their smart cards and PINs, or with explicit credentials. This enables you to provide users with bimodal authentication for Citrix Gateway logons. Configure pass-through authentication from Citrix Gateway to StoreFront and delegate credential validation to Citrix Gateway for smart card users so that users are silently authenticated to StoreFront.
Multiple Active Directory forest considerations
In a Citrix environment, smart cards are supported within a single forest. Smart card logons across forests require a direct two-way forest trust to all user accounts. More complex multi-forest deployments involving smart cards (that is, where trusts are only one-way or of different types) are not supported.
You can use smart cards in a Citrix environment that includes remote desktops. This feature can be installed locally (on the user device that the smart card is connected to) or remotely (on the remote desktop that the user device connects to).
Smart card removal policy
The smart card removal policy set on the product determines what happens if you remove the smart card from the reader during a session. The smart card removal policy is configured through and handled by the Windows operating system.
| Policy setting | Desktop behavior |
|---|---|
| No action | No action. |
| Lock workstation | The desktop session is disconnected and the virtual desktop is locked. |
| Force logoff | The user is forced to log off. If the network connection is lost and this setting is enabled, the session may be logged off and the user may lose data. |
| Disconnect if a remote Terminal Services session | The session is disconnected and the virtual desktop is locked. |
Certificate revocation checking
If certificate revocation checking is enabled and a user inserts a smart card with an invalid certificate into a card reader, the user cannot authenticate or access the desktop or application related to the certificate. For example, if the invalid certificate is used for email decryption, the email remains encrypted. If other certificates on the card, such as ones used for authentication, are still valid, those functions remain active.
Deployment example: domain-joined computers
This deployment involves domain-joined user devices that run the Desktop Viewer and connect directly to StoreFront.
A user logs on to a device using a smart card and PIN. Receiver authenticates the user to a Storefront server using Integrated Windows Authentication (IWA). StoreFront passes the user security identifiers (SIDs) to Citrix Virtual Apps or Citrix Virtual Desktops. When the user starts a virtual desktop or application, the user is not prompted for a PIN again because the single sign-on feature is configured on Receiver.
This deployment can be extended to a double-hop with the addition of a second StoreFront server and a server hosting applications. A Receiver from the virtual desktop authenticates to the second StoreFront server. Any authentication method can be used for this second connection. The configuration shown for the first hop can be reused in the second hop or used in the second hop only.
Deployment example: remote access from domain-joined computers
This deployment involves domain-joined user devices that run the Desktop Viewer and connect to StoreFront through Citrix Gateway/Access Gateway.
A user logs on to a device using a smart card and PIN, and then logs on again to Citrix Gateway/Access Gateway. This second logon can be with either the smart card and PIN or a user name and password because Receiver allows bimodal authentication in this deployment.
The user is automatically logged on to StoreFront, which passes the user security identifiers (SIDs) to Citrix Virtual Apps or Citrix Virtual Desktops. When the user starts a virtual desktop or application, the user is not prompted again for a PIN because the single sign-on feature is configured on Receiver.
This deployment can be extended to a double-hop with the addition of a second StoreFront server and a server hosting applications. A Receiver from the virtual desktop authenticates to the second StoreFront server. Any authentication method can be used for this second connection. The configuration shown for the first hop can be reused in the second hop or used in the second hop only.
Deployment example: non-domain-joined computers
This deployment involves non-domain-joined user devices that run the Desktop Viewer and connect directly to StoreFront.
A user logs on to a device. Typically, the user enters a user name and password but, since the device is not joined to a domain, credentials for this logon are optional. Because bimodal authentication is possible in this deployment, Receiver prompts the user either for a smart card and PIN or a user name and password. Receiver then authenticates to Storefront.
StoreFront passes the user security identifiers (SIDs) to Citrix Virtual Apps or Citrix Virtual Desktops. When the user starts a virtual desktop or application, the user is prompted for a PIN again because the single sign-on feature is not available in this deployment.
This deployment can be extended to a double-hop with the addition of a second StoreFront server and a server hosting applications. A Receiver from the virtual desktop authenticates to the second StoreFront server. Any authentication method can be used for this second connection. The configuration shown for the first hop can be reused in the second hop or used in the second hop only.
Deployment example: remote access from non-domain-joined computers
This deployment involves non-domain-joined user devices that run the Desktop Viewer and connect directly to StoreFront.
A user logs on to a device. Typically, the user enters a user name and password but, since the device is not joined to a domain, credentials for this logon are optional. Because bimodal authentication is possible in this deployment, Receiver prompts the user either for a smart card and PIN or a user name and password. Receiver then authenticates to Storefront.
StoreFront passes the user security identifiers (SIDs) to Citrix Virtual Apps or Citrix Virtual Desktops. When the user starts a virtual desktop or application, the user is prompted for a PIN again because the single sign-on feature is not available in this deployment.
This deployment can be extended to a double-hop with the addition of a second StoreFront server and a server hosting applications. A Receiver from the virtual desktop authenticates to the second StoreFront server. Any authentication method can be used for this second connection. The configuration shown for the first hop can be reused in the second hop or used in the second hop only.
Deployment example: non-domain-joined computers and thin clients accessing the Desktop Appliance site
This deployment involves non-domain-joined user devices that may run the Desktop Lock and connect to StoreFront through Desktop Appliance sites.
The Desktop Lock is a separate component that is released with Citrix Virtual Apps, Citrix Virtual Desktops, and VDI-in-a-Box. It is an alternative to the Desktop Viewer and is designed mainly for repurposed Windows computers and Windows thin clients. The Desktop Lock replaces the Windows shell and Task Manager in these user devices, preventing users from accessing the underlying devices. With the Desktop Lock, users can access Windows Server Machine desktops and Windows Desktop Machine desktops. Installation of Desktop Lock is optional.
A user logs on to a device with a smart card. If Desktop Lock is running on the device, the device is configured to launch a Desktop Appliance site through Internet Explorer running in Kiosk Mode. An ActiveX control on the site prompts the user for a PIN, and sends it to StoreFront. StoreFront passes the user security identifiers (SIDs) to Citrix Virtual Apps or Citrix Virtual Desktops. The first available desktop in the alphabetical list in an assigned Desktop Group starts.
This deployment can be extended to a double-hop with the addition of a second StoreFront server and a server hosting applications. A Receiver from the virtual desktop authenticates to the second StoreFront server. Any authentication method can be used for this second connection. The configuration shown for the first hop can be reused in the second hop or used in the second hop only.
Deployment example: domain-joined computers and thin clients accessing StoreFront through the XenApp Services URL
This deployment involves domain-joined user devices that run the Desktop Lock and connect to StoreFront through XenApp Services URLs.
The Desktop Lock is a separate component that is released with Citrix Virtual Apps, Citrix Virtual Desktops, and VDI-in-a-Box. It is an alternative to the Desktop Viewer and is designed mainly for repurposed Windows computers and Windows thin clients. The Desktop Lock replaces the Windows shell and Task Manager in these user devices, preventing users from accessing the underlying devices. With the Desktop Lock, users can access Windows Server Machine desktops and Windows Desktop Machine desktops. Installation of Desktop Lock is optional.
A user logs on to a device using a smart card and PIN. If Desktop Lock is running on the device, it authenticates the user to a Storefront server using Integrated Windows Authentication (IWA). StoreFront passes the user security identifiers (SIDs) to Citrix Virtual Apps or Citrix Virtual Desktops. When the user starts a virtual desktop, the user is not prompted for a PIN again because the single sign-on feature is configured on Receiver.
This deployment can be extended to a double-hop with the addition of a second StoreFront server and a server hosting applications. A Receiver from the virtual desktop authenticates to the second StoreFront server. Any authentication method can be used for this second connection. The configuration shown for the first hop can be reused in the second hop or used in the second hop only.
In this article
- Bimodal authentication
- Multiple Active Directory forest considerations
- Smart card removal policy
- Certificate revocation checking
- Deployment example: domain-joined computers
- Deployment example: remote access from domain-joined computers
- Deployment example: non-domain-joined computers
- Deployment example: remote access from non-domain-joined computers
- Deployment example: non-domain-joined computers and thin clients accessing the Desktop Appliance site
- Deployment example: domain-joined computers and thin clients accessing StoreFront through the XenApp Services URL