How To: Integrate Citrix Storefront with SecureAuth Connect (SAML)

Version Affected: All Versions

 

Overview

This article explains how to integrate Citrix StoreFront with SecureAuth Connect using SAML.

Prerequisites

• A SecureAuth Connect Workforce workspace with administrative privileges, configured with Microsoft Active Directory as the user store.
• A user account with administrative privileges for Citrix StoreFront.

Get Citrix StoreFront Information

1. On the StoreFront server, open an elevated PowerShell window and run the following command to load the Citrix modules:

   asnp citrix*

   

2. Once the modules are loaded, run the following command to find your StoreFront VirtualPath value:

   Get-STFStoreService | Out-String -Stream | Select-String  "VirtualPath"

3. Run the following commands to fetch the Service Provider information, replacing /Citrix/Store with the value you obtained in the previous step:

   $storeVirtualPath = "/Citrix/Store"
   $auth = Get-STFAuthenticationService -Store (Get-STFStoreService -VirtualPath $storeVirtualPath)
   $spId = $auth.AuthenticationSettings["samlForms"].SamlSettings.ServiceProvider.Uri.AbsoluteUri
   $acs = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/AssertionConsumerService")
   $md = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/ServiceProvider/Metadata")
   $samlTest = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlTest")
   Write-Host "SAML Service Provider information:
   Service Provider ID: $spId
   Assertion Consumer Service: $acs
   Metadata: $md
   Test Page: $samlTest"

   The sample output of the above command looks like this:

   SAML Service Provider information:
   Service Provider ID: https://storefront.example.com/Citrix/StoreAuth
   Assertion Consumer Service: https://storefront.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService
   Metadata: https://storefront.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata
   Test Page: https://storefront.example.com/Citrix/StoreAuth/SamlTest

SecureAuth Connect Configuration

1. Log in to your SecureAuth Connect Workforce workspace with an admin account.
2. In your workspace, select Applications > Clients > Create client.

   

3. Enter a name, provide your StoreFront URL in the Application URL field (optional -- used if you want it to appear in the user portal after login), select SAML Service Provider, and click Create.

   

4. Download the SAML Metadata.

   

5. Scroll down and enable Override SAML Attributes.

   

6. Go to the Attributes tab, choose mail from the predefined attribute list, and click Save to apply the changes.

   

7. On the SAML tab, select Manual and set the following configuration:
   • Entity ID: enter the Issuer/EntityID of your StoreFront instance obtained earlier -- for example, https://storefront.example.com/Citrix/StoreAuth.
   • Assertion Consumer Service (ACS) URL: enter the StoreFront post-back URL obtained earlier -- for example, https://storefront.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService.
   • Enable Override Subject NameID, set Name ID Format to urn:oasis:names:tc:SAML:1.1:nameid-format:emailAddress, and set Name ID Value to mail.

     

8. Click Save.

Citrix StoreFront Configuration

1. In the Citrix StoreFront console, under Manage Authentication Methods, enable SAML Authentication.

   

2. On the StoreFront server, open an elevated PowerShell window and run the following commands, replacing /Citrix/Store with the VirtualPath value obtained earlier and the file path with the metadata file downloaded from SecureAuth Connect:

   Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module
   $StoreVirtualPath = "/Citrix/Store"
   $store = Get-STFStoreService -VirtualPath $StoreVirtualPath
   $auth = Get-STFAuthenticationService -StoreService $store
   Update-STFSamlIdPFromMetadata -AuthenticationService $auth -FilePath "File path of the metadata file you downloaded from SecureAuth Connect"

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.