SAML authentication

SAML (Security Assertion Markup Language) is an open standard used by identity and authentication products. Using SAML, you can configure StoreFront to redirect users to an external identity provider for authentication.


Configure StoreFront with SAML authentication for internal access. For external access configure Citrix Gateway with SAML authentication then configure StoreFront with Gateway pass-through authentication.

StoreFront requires a SAML 2.0-compliant identity provider (IdP) such as:

  • Microsoft AD Federation Services using SAML bindings (not WS-Federation bindings). For more information, see AD FS Deployment and AD FS Operations.
  • Citrix Gateway (configured as an IdP).
  • Microsoft Entra ID. For more information, see CTX237490.

The SAML assertion must contain a saml:Subject attribute containing the user’s UPN.

To enable or disable SAML authentication for a store when connecting through Workspace apps, in the Authentication Methods window select SAML Authentication. Enabling SAML authentication for a store by default also enables it for all websites for that store. You can independently configure SAML for a particular website on the Authentication methods tab.

StoreFront SAML Endpoints

To configure SAML, your identity provider may require the following endpoints:

  • The URL of the Entity ID. This is the path to the auth service of the store, normally https://[storefront host]/Citrix/[StoreName]Auth
  • The URL of the Assertion Consumer Service, normally https://[storefront host]/Citrix/[StoreName]Auth/SamlForms/AssertionConsumerService
  • The Metadata service, normally https://[storefront host]/Citrix/[StoreName]Auth/SamlForms/ServiceProvider/Metadata

In addition there is a test endpoint, normally https://[storefront host]/Citrix/[StoreName]Auth/SamlTest

You can use the following PowerShell script to list out the endpoints for a specified store.

# Change this value for your Store
$storeVirtualPath = "/Citrix/Store"

$auth = Get-STFAuthenticationService -Store (Get-STFStoreService -VirtualPath $storeVirtualPath)
$spId = $auth.AuthenticationSettings["samlForms"].SamlSettings.ServiceProvider.Uri.AbsoluteUri
$acs = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/AssertionConsumerService")
$md = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/ServiceProvider/Metadata")
$samlTest = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlTest")
Write-Host "SAML Service Provider information:
Entity ID: $spId
Assertion Consumer Service: $acs
Metadata: $md
Test Page: $samlTest

Example of the output:

SAML Service Provider information:
Entity ID:
Assertion Consumer Service:
Test Page:

Configure using Metadata exchange

To simplify configuration, you can exchange metadata (identifiers, certificates, endpoints and other configuration) between the Identity Provider and the Service Provider, which is StoreFront in this case.

If your Identity Provider supports metadata import, then you can point it at the StoreFront MetaData endpoint. Note:: This must be done over HTTPS.

To configure StoreFront using the metadata from an Identity Provider, use the Update-STFSamlIdPFromMetadata cmdlet, for example:

Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module

# Remember to change this with the virtual path of your Store.
$StoreVirtualPath = "/Citrix/Store"

$store = Get-STFStoreService -VirtualPath $StoreVirtualPath
$auth = Get-STFAuthenticationService -StoreService $store

# To read the metadata directly from the Identity Provider, use the following:
# Note again this is only allowed for https endpoints
Update-STFSamlIdPFromMetadata -AuthenticationService $auth -Url

# If the metadata has already been download, use the following:
# Note: Ensure that the file is encoded as UTF-8
Update-STFSamlIdPFromMetadata -AuthenticationService $auth -FilePath "C:\Users\exampleusername\Downloads\FederationMetadata.xml"

Configure Identity Provider

  1. Click the settings drop down in the SAML Authentication row and click Identity Provider.

    Screenshot of SAML settings menu

    Screenshot of Identity Provider window

  2. Choose SAML Binding of Post or Redirect.

  3. Enter the Address of the Identity Provider.

  4. Import the certificate used to sign the SAML tokens.

  5. Press OK to save changes.

Configure Service Provider

  1. Click the settings drop down in the SAML Authentication row and click Service Provider.

    Screenshot of Identity Provider window

  2. Optionally, choose an Export Signing Certificate, used to sign messages to the identity provider.

  3. Optionally, choose an Export Encryption Certificate, used to decrypt messages received from the identity provider.

  4. The Service Provider Identifier is pre-filled with the authentication service for the store.

  5. Press OK to save changes.

PowerShell SDK

Using the PowerShell SDK:


To test the SAML integration:

  1. Go to the SAML test page, see StoreFront SAML Endpoints.
  2. This redirects you to the identity provider. Enter your credentials.
  3. You are redirected back to the test page that displays the identity claims and assertions.

Single sign-on using Federated Authentication Service

When using SAML authentication, StoreFront does not have access to the user’s credentials so single sign-on is not available by default. You can use Federated Authentication Service to provide single sign-on.

SAML authentication