This document provides the steps to follow for manually configuring the SAML authentication with Storefront feature.
 

Instructions

1. To enable Federated Authentication Service integration on a StoreFront Store, run the following PowerShell cmdlets as an Administrator account on the StoreFront server. If you have more than one store, or if the store has a different name, the path text highlighted below may differ.
2. Set-ExecutionPolicy Bypass

3. Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"
4. Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
5. In addition, make sure to enable XML Trust on the Delivery Controller(s)
6. Add-PSSnapin Citrix.Broker.Admin.V2
7. Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $true
8. Now that you have configured the FAS plug-in on the StoreFront server and enabled XML Trust:
9. Open The StoreFront Management console, select the store you want to configure and choose Manage Authentication Methods

10. Click the checkbox for SAML to enable the authentication method. (See upgrade section in Introduction and Requirements document if SAML authentication method is not displayed). Click on the down arrow and select Identity Provider.

• SAML Binding – Options Post or Redirect  - Select Post
• Address – The address to the Identity Provider.  See note below for additional information about this field
• Signing Certificates – Import the certificate used to sign the SAML tokens. See note below for additional information about this field

 

11. It should match the Federation Service Name.

12. Next, Select Service Provider Option.

• Service Provider Identifier – The Storefront store that is using SAML.  To configure the store name add Auth to the store name. Example:
• Store name:                                     https://sfserver.domain.com /Citrix/local
• Service Provider Identifier:           https://sfserver.domain.com /Citrix/localAuth

 

1. From the AD FS Console, select Relying Party Trust and in the actions pane select Add Relying Party Trust

2. At the initial screen hit Start
3. At the Data Source screen select Enter Data about the relying party manually and click Next

4. Enter a Display Name and hit Next
5. At the Chose Profile Screen select AD FS  profile

6. Click Next

7. In the Configure URL screen Select Enable support for SAML 2.0 WebSSO protocol. Under the relying party SAML URL enter the StoreFront address with Auth added at the end. See screenshot below

8. In the Configure Identifiers screen, enter the StoreFront base URL and click Add

9. On the multi-factor authentication screen click Next
10. On the Choose Issuance Authorization Rules screen, select Permit all users access to relying party and click Next
11. On the Ready to Add Trust Screen hit Next
12. On the Finish screen, make sure that the Open the Edit Claim checkbox is checked and hit Close

13. Next we need to add a Claims Rule. Make sure to select the Issuance Transform Rules and click on Add Rule

14. Select Send LDAP Attributes as Claims and hit Next

15. Use the information below to complete the fields.

• Claim rule name: UPN to Name ID
• Attribute store: Active Directory
• LDAP Attribute: User-Principal-Name
• Outgoing Claim Type: Name ID

16. Click OK