Citrix Storefront Integration with SecureAuth Connect (SAML)

Prerequisites

• SecureAuth Connect Workforce workspace with administrative privileges, configured with Microsoft Active Directory as the user store.
• User account with administrative privileges for Citrix StoreFront.

Get Citrix StoreFront information

1. On the StoreFront™ server, open an elevated PowerShell™ and run the following command to load the Citrix modules:

   asnp citrix*

2. Once the modules are loaded, run the following command to find your StoreFront VirtualPath value:

   Get-STFStoreService | Out-String -Stream | Select-String  "VirtualPath"
   

3. Run the below commands to fetch the Service Provider Information. Remember to change the value of “/Citrix/Store” with the value you obtained in the previous step.

   $storeVirtualPath = "/Citrix/Store"
   $auth = Get-STFAuthenticationService -Store (Get-STFStoreService -VirtualPath $storeVirtualPath)
   $spId = $auth.AuthenticationSettings["samlForms"].SamlSettings.ServiceProvider.Uri.AbsoluteUri
   $acs = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/AssertionConsumerService")
   $md = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/ServiceProvider/Metadata")
   $samlTest = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlTest")
   Write-Host "SAML Service Provider information:
   Service Provider ID: $spId 
   Assertion Consumer Service: $acs
   Metadata: $md
   Test Page: $samlTest"
   

   The sample output of the above command looks like this:

   SAML Service Provider information: 
   Service Provider ID: https://StoreFront™.example.com/Citrix/StoreAuth 
   Assertion Consumer Service: https://StoreFront™.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService 
   Metadata: https://StoreFront™.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata 
   Test Page: https://StoreFront™.example.com/Citrix/StoreAuth/SamlTest

SecureAuth Connect Configuration

1. Log in to your SecureAuth Connect Workforce workspace with an admin account.

2. In your workspace, select Applications > Clients > Create client.

   

3. Enter a name, provide your StoreFront URL in the Application URL field (optional, used if you want it to appear in the user portal after login), select SAML Service Provider, and click Create.

4.  Download the SAML Metadata.

5. Scroll down and enable Override SAML Attributes.

6. Go to the Attributes tab, choose mail from the predefined attribute list, and click Save to apply the changes.

7. On the SAML tab, select the Manual and set the following configurations:

Entity ID : Enter the Issuer/EntityID of your StoreFront instance obtained in the previous section.

For example, https://StoreFront™.example.com/Citrix/StoreAuth