Federated Authentication Service 2012

Federated Authentication Service (FAS) is a privileged component designed to integrate with Active Directory Certificate Services. It dynamically issues certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card. This allows StoreFront to use a broader range of authentication options, such as SAML (Security Assertion Markup Language) assertions. SAML is commonly used as an alternative to traditional Windows user accounts on the Internet.

The following diagram shows FAS integrating with a Microsoft Certification Authority and providing support services to StoreFront and Citrix Virtual Apps and Desktops Virtual Delivery Agents (VDAs).

localized image

Trusted StoreFront servers contact FAS as users request access to the Citrix environment. FAS grants a ticket that allows a single Citrix Virtual Apps or Citrix Virtual Desktops session to authenticate with a certificate for that session. When a VDA needs to authenticate a user, it connects to FAS and redeems the ticket. Only FAS has access to the user certificate’s private key; the VDA must send each signing and decryption operation that it needs to perform with the certificate to FAS.

Federated Authentication Service 2012 is the latest Current Release version of FAS. This documentation reflects features and configurations in this latest release.

Earlier releases

For documentation on previous FAS releases, see:

The product lifecycle strategy for Current Releases (CR) and Long Term Service Releases (LTSR) is described in Lifecycle Milestones.


Federated Authentication Service 2012