Configure Microsoft Entra ID for SAML authentication
This article describes how to configure Microsoft Entra ID as a SAML identity provider for StoreFront.
For general SAML configuration information, see SAML authentication.
Prerequisites
- Users must have a hybrid identity. The on-premises Active Directory UPN must be synchronized to Entra ID (either to the Entra ID UPN or the on-premises UPN attribute).
- StoreFront must be accessible via HTTPS with a valid certificate.
- You must have administrator access to your Entra ID tenant.
Create an enterprise application
-
Sign in to the Microsoft Entra admin center.
-
Navigate to Identity > Applications > Enterprise applications.
-
Click New application.
-
Click Create your own application.
-
Enter a name such as Citrix StoreFront.
-
Select Integrate any other application you don’t find in the gallery (Non-gallery).
-
Click Create.
Configure enterprise application for SAML authentication
-
In the enterprise application you created, navigate to Manage > Single sign-on.
-
Select SAML as the single sign-on method.
-
In the Basic SAML Configuration section, click Edit.
-
Configure the following values:
-
Identifier (Entity ID):
https://[storefront-host]/Citrix/[StoreName]Auth -
Reply URL (Assertion Consumer Service URL):
https://[storefront-host]/Citrix/[StoreName]Auth/SamlForms/AssertionConsumerService
Replace
[storefront-host]with your StoreFront server’s fully qualified domain name and[StoreName]with your store name (for example,Store).Tip
To find the exact URLs for your store, see StoreFront SAML Endpoints.
-
Identifier (Entity ID):
-
Click Save.
Configure attributes and claims
StoreFront requires the user’s Active Directory UPN in the SAML Name ID claim to look up the user.
If on-premises UPN matches Entra ID UPN
-
In the Attributes & Claims section, click Edit.
-
Click on the Unique User Identifier (Name ID) claim.
-
If the Active Directory UPN is the same as the Entra ID UPN then confirm that the Source attribute is set to
user.userprincipalname. If the Active Directory UPN is different to the Entra ID UPN then change the Source attribute touser.onpremisesuserprincipalname. -
Click Save.
If on-premises UPN differs from Entra ID UPN
When users have different UPNs in Active Directory and Entra ID, you must configure the Name ID to use the on-premises UPN.
-
In the Attributes & Claims section, click Edit.
-
Click on the Unique User Identifier (Name ID) claim.
-
Change the Source attribute to
user.onpremisesuserprincipalname. -
Click Save.
-
Click Add new claim.
-
Configure the claim with the following values:
-
Name:
sso_upn - Source: Attribute
-
Source attribute:
user.userprincipalname
-
Name:
-
Click Save.
Important
The UPN sent in the Name ID claim must match the user’s UPN in Active Directory. StoreFront looks up this UPN in Active Directory to authenticate the user. The sso_upn claim allows you to specify the Entra UPN to use for SSO to entra joined VDAs.
Assign users
-
Navigate to Manage > Users and groups.
-
Click Add user/group.
-
Select the users or groups that need access to StoreFront.
-
Click Assign.
Configure StoreFront
You can configure StoreFront to use Entra ID as the identity provider using metadata exchange or manual configuration.
Option 1: Metadata exchange (recommended)
-
In the Entra ID enterprise application, navigate to Manage > Single sign-on.
-
In the SAML Certificates section, copy the App Federation Metadata Url.
-
On the StoreFront server, open PowerShell as administrator and run:
Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module $StoreVirtualPath = "/Citrix/Store" $store = Get-STFStoreService -VirtualPath $StoreVirtualPath $auth = Get-STFAuthenticationService -StoreService $store Update-STFSamlIdPFromMetadata -AuthenticationService $auth -Url "https://login.microsoftonline.com/[tenant-id]/federationmetadata/2007-06/federationmetadata.xml" <!--NeedCopy-->Replace
[tenant-id]with your Entra ID tenant ID or use the App Federation Metadata Url you copied.
Option 2: Manual configuration
-
In the Entra ID enterprise application, navigate to Manage > Single sign-on.
-
Note the Login URL from the Set up section.
-
Download the Certificate (Base64) from the SAML Certificates section.
-
On the StoreFront server, import the certificate and configure the identity provider. See Configure Identity Provider.
Test the configuration
-
Navigate to
https://[storefront-host]/Citrix/[StoreName]Auth/SamlTest - You are redirected to the Entra ID sign-in page. Sign in with a user account that:
- Is assigned to the enterprise application
- Has a hybrid identity with a UPN synchronized from Active Directory
-
After successful authentication, you are redirected back to the test page showing the identity claims.
- Verify that the NameID claim contains the user’s Active Directory UPN.
Troubleshooting
Authentication fails with “User not found”
This error occurs when StoreFront cannot find the user in Active Directory. Verify that:
- The user has a hybrid identity with their UPN synchronized from Active Directory to Entra ID.
- The Name ID claim is configured correctly:
- If on-premises UPN matches Entra ID UPN: Name ID should use
user.userprincipalname - If on-premises UPN differs from Entra ID UPN: Name ID should use
user.onpremisesuserprincipalname
- If on-premises UPN matches Entra ID UPN: Name ID should use
- The StoreFront server can communicate with the domain controllers.
Redirection loop
If users experience a redirection loop between StoreFront and Entra ID:
- Verify that the Reply URL in Entra ID matches the Assertion Consumer Service URL exactly.
- Check for conflicting authentication methods enabled on the store.
- Review IIS logs on the StoreFront server for error details.
Certificate errors
If you see certificate validation errors:
- Verify that the signing certificate from Entra ID is correctly imported into StoreFront.
- Check that the certificate has not expired.
- Ensure the certificate is trusted by the StoreFront server.