Product documentation
StoreFront
Current release (2511) 2507 LTSR 2402 LTSR 2203 LTSR
View PDF

Federated Authentication Service Configuration

December 19, 2025
Contributed by: 
C

Federated Authentication Service (FAS) provides single sign-on to VDAs using certificate authentication. This approach is useful when you have enabled authentication methods such as SAML, where StoreFront does not have the user’s Active Directory credentials. Once you enable FAS, it always handles single sign-on, even when using authentication methods where StoreFront has the Active Directory username password.

Configure FAS using management console

Note:

From StoreFront you can configure FAS using the management console. For versions earlier than 2511, the management console does not expose these settings, so you must must configure FAS using PowerShell.

To configure FAS:

  1. Configure the list of FAS servers using Group policy. For more details see FAS documentation.

  2. Select the Stores node in the left pane of the Citrix StoreFront management console, select a store in the center pane.

  3. In the Action pane, select Configure Store Settings.

  4. On the Configure Store Settings page, select the Federated Authentication Service tab.

  5. To enable single sign-on using FAS, select Enable Federated Authentication Service for this store.

  6. If the FAS server is unavailable the launch fails by default. However, you can configure StoreFront such that if the FAS server is unavailable, users can sign on to the VDA by entering their credentials. To enable this, tick Fallback to username/password if no FAS servers are available.

  7. By default, StoreFront selects the FAS server at launch. You can change FAS server selection to Select at logon. This is not normally required but you can enable this if FAS selection is slow to avoid delays at launch. This setting affects all stores sharing the same authentication service.

    FAS configuration screen

  8. Click OK to save your changes.

Configure FAS using PowerShell

To enable FAS using PowerShell, run the cmdlet Set-STFStoreLaunchOptions to set the VDA logon data logon provider to FASLogonDataProvider.

For example to enable FAS for a store:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
<!--NeedCopy-->

To disable FAS for a store:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider ""
<!--NeedCopy-->

Substitute [VirtualPath] for the appropriate virtual path, e.g. /Citrix/Store.

By default the FAS server is selected at log-in. To configure this, run cmdlet Set-STFClaimsFactoryNames with parameter ClaimsFactoryName. To choose the FAS server at login, set it to FASClaimsFactory. To restore the default behavior and choose a FAS server at launch, set it to standardClaimsFactory.

For example to choose a FAS server at log in:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"
<!--NeedCopy-->

To enable fallback to username and password authentication, run cmdlet Set-STFStoreLaunchOptions with parameter FederatedAuthenticationServiceFailover. For example:

$storeService = Get-STFStoreService -VirtualPath [VirtualPath]
Set-STFStoreLaunchOptions $storeService -FederatedAuthenticationServiceFailover $True
<!--NeedCopy-->
Federated Authentication Service Configuration
December 19, 2025
Contributed by: 
C
December 19, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.