Citrix Workspace App || Enhanced Domain Pass-through is not working through Load Balanced URL

book

Article ID: CTX696772

calendar_today

Updated On:

Description

On checking the System event logs from the Client machine, we can see Security-Kerberos error Event-ID 4

image.png

 

SPN configuration looks ok, no duplicates are found.

IIS Application Pool is running as a Service account

  • IIS > Application Pools > Citrix Delivery Services Resources
  • Check the "Identity" field

 

Query SPN for load balanced URL from Storefront Server:

  • SetSPN -Q HTTP/<Load-balancer URL>
  • Check the CN field for the service account name.
  • All looks good.

 

Cause

https://techcommunity.microsoft.com/blog/iis-support-blog/setting-up-kerberos-authentication-for-a-website-in-iis/347882

If we have both useAppPoolCredentials and kernel mode set to true useAppPoolCredentials takes precedence and application pool account is used for decryption of the ticket. Usekernelmode setting was introduced from IIS 7 and higher versions. In IIS 6 and lower version always the application pool identity was used for decryption of the token/ticket.

Resolution

On both Storefront Servers, validate following configuration is in place.

Replace the "StoreName" field with your own Storefront Store name:

 

    1. Check current value (at the app root):
      %windir%\system32\inetsrv\appcmd.exe list config "Default Web Site/Citrix/StoreName"
      /section:system.webServer/security/authentication/windowsAuthentication /text:*
      Look for useAppPoolCredentials — expect it missing or false.

    2. Set it at the app root:
      %windir%\system32\inetsrv\appcmd.exe set config "Default Web Site/Citrix/Storename"
      /section:system.webServer/security/authentication/windowsAuthentication /useAppPoolCredentials:true /commit:apphost

    3. Full restart of the web service (an app-pool recycle alone was found insufficient):
      net stop W3SVC && net start W3SVC
      (or iisreset /restart).

Issue/Introduction

Enhanced Domain Pass-through SSO (Kerberos) not working in CVAD 2402 LTSR.
All configurations are in place as per - https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/domain-passthrough-for-single-sign-on.html

While browsing directly to Storefront server FQDN, this works successfully. 

However, a Netscaler is used for Load balancing only, with no gateway configuration.  When using this URL the SSO is not working.

Powered by Wolken Software