Skip to main content

Citrix StoreFront

Introduction#

Multi-Factor Authentication (MFA) provides an extra layer of security used when logging into websites or apps. Individuals are authenticated through more than one required security and validation procedure that only they know or have access to.

Citrix StoreFront is an enterprise application store that provides an interface for users to access Citrix desktops and applications remotely. Acceptto is a Citrix Ready Partner that integrates with Citrix StoreFront via its SAML solution. Acceptto delivers single sign-on (SSO) MFA to ensure customers receive the convenience of cloud SSO without its potential security risks.

Pre-Requisites#

  1. An Acceptto account with a configured Identity Provider and LDAP Agent. (See this page for the instruction)
  2. An organization identifier provided by Acceptto (organization slug).
  3. A user with administrative privileges for Citrix StoreFront.
  4. A user with administrative privileges for the Acceptto services.

Getting your Citrix StoreFront™ information#

  1. On the StoreFront™ server, open an elevated PowerShell™ and run the command asnp citrix* to load the Citrix modules.

    Powershell window

  2. Once the modules are loaded, run this command to find your StoreFront VirtualPath value:

    Get-STFStoreService | Out-String -Stream | Select-String  "VirtualPath"

  3. Run the below commands to fetch the Service Provider Information. Remember to change the value of “/Citrix/Store” with the value you obtained in the previous step.

    $storeVirtualPath = "/Citrix/Store"$auth = Get-STFAuthenticationService -Store (Get-STFStoreService -VirtualPath $storeVirtualPath)$spId = $auth.AuthenticationSettings["samlForms"].SamlSettings.ServiceProvider.Uri.AbsoluteUri$acs = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/AssertionConsumerService")$md = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/ServiceProvider/Metadata")$samlTest = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlTest")Write-Host "SAML Service Provider information:Service Provider ID: $spId Assertion Consumer Service: $acsMetadata: $mdTest Page: $samlTest"

    The sample output of the above command looks like this:

    SAML Service Provider information: Service Provider ID: https://StoreFront™.example.com/Citrix/StoreAuth Assertion Consumer Service: https://StoreFront™.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService Metadata: https://StoreFront™.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata Test Page: https://StoreFront™.example.com/Citrix/StoreAuth/SamlTest

Acceptto SAML Configuration as an Identity Provider (IdP)#

  1. Login to the Acceptto Dashboard with an administrative account and go to Applications.

  2. Create a new application by selecting the Create New Application.

    Create new application

  3. In the New Application form, enter the following values under the General tab:

    Name - The application name displayed in the admin panel and application portal and used for push notifications and audit logs. (e.g. Citrix)

    Type - Select "SAML Service Provider [saml_sp]" from the options.

    Out of Band Methods - Select the allowed methods for approving MFA requests

    Message for MFA Requests - Enter the user-facing message for Push, SMS, and e-mail MFA requests (optional)

  4. Under the SAML Service Provider Configuration tab, enter the following values:

    Issuer or Entity ID - The Issuer/EntityID of your StoreFront instance you got from the previous section. For example, https://StoreFront™.example.com/Citrix/StoreAuth

    Sign in URL - The link used by your users to access the StoreFront. Like, https://StoreFront.example.com/

    Metadata URL - The URL containing metadata about your StoreFront instance you got from the previous section. For example, https://StoreFront.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata

    NameID Format - Select "Email Address" from the dropdown menu

    Name Identifier - Select "userPrincipalName" from the dropdown menu

    ACS URL - The StoreFront post-back URL you got from the previous section. For example, https://StoreFront.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService

    SAML configuration

  5. Click Save to create the Application.

  6. Download your SAML IdP metadata information at http://sso.acceptto.com/[organization identifier]/saml/download/metadata.

Configure Citrix StoreFront™ as Service Provider (SP)#

  1. On the StoreFront™ console, enable the SAML Authentication under the Manage Authentication Methods.

    Citrix auth methods

  2. Open an elevated PowerShell on StoreFront™ server and run the below commands (Remember to change the value of “/Citrix/Store” with the virtual path of your Store).

    Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module  $StoreVirtualPath = "/Citrix/Store" $store = Get-STFStoreService -VirtualPath $StoreVirtualPath $auth = Get-STFAuthenticationService -StoreService $store Update-STFSamlIdPFromMetadata -AuthenticationService $auth -FilePath "File path of the metadata file you downloaded from Acceptto”

Test your setup#

  1. Go to your Citrix StoreFront URL. You will be redirected to the Acceptto SAML page.

acceptto sign in page

  1. After successful authentication, you’ll see the Acceptto MFA options. Select your desired method. Then, approve the authentication request on your It’sMe mobile app.

acceptto mfa authenticator

  1. Finally, you will be redirected to your Citrix StoreFront landing page.

Support#

If you require assistance, please email us at support@acceptto.com

Sales#

Want to learn more about our MFA solutions? Contact our Professional Services for a Demo today.

Disclaimer#

All product names, trademarks, and registered trademarks are the property of their respective owners.

All company, product, and service names used in this document are for identification purposes only. Use of these names, trademarks, and brands does not constitute endorsement by the Acceptto Corporation.

Citrix, NetScaler, and ‘Netscaler Gateway’ are either registered trademarks or trademarks of Citrix and/or one or more of its subsidiaries in the United States and/or other countries.

Microsoft and 'Active Directory' are either registered trademarks or trademarks of Microsoft and/or one or more of its subsidiaries in the United States and/or other countries.