Federated Authentication Service 1912
Federated Authentication Service (FAS) is a privileged component designed to integrate with Active Directory Certificate Services. It dynamically issues certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card. This allows StoreFront to use a broader range of authentication options, such as SAML (Security Assertion Markup Language) assertions. SAML is commonly used as an alternative to traditional Windows user accounts on the Internet.
The following diagram shows FAS integrating with a Microsoft Certification Authority and providing support services to StoreFront and Citrix Virtual Apps and Desktops Virtual Delivery Agents (VDAs).
Trusted StoreFront servers contact FAS as users request access to the Citrix environment. FAS grants a ticket that allows a single Citrix Virtual Apps or Citrix Virtual Desktops session to authenticate with a certificate for that session. When a VDA needs to authenticate a user, it connects to FAS and redeems the ticket. Only FAS has access to the user certificate’s private key; the VDA must send each signing and decryption operation that it needs to perform with the certificate to FAS.
Federated Authentication Service 1912 is the latest Current Release version of FAS. This documentation reflects features and configurations in this latest release.
For documentation on previous FAS releases, see:
- Federated Authentication Service 1909
- Citrix Virtual Apps and Desktops 7 1906
- Citrix Virtual Apps and Desktops 7 1903
- Citrix Virtual Apps and Desktops 7 1811
- Citrix Virtual Apps and Desktops 7 1808
- XenApp and XenDesktop 7.15 Long Term Service Release
The product lifecycle strategy for Current Releases (CR) and Long Term Service Releases (LTSR) is described in Lifecycle Milestones.
- Active Directory Certificate Services https://technet.microsoft.com/en-us/library/hh831740.aspx
- Configuring Windows for Certificate Logon http://support.citrix.com/article/CTX206156