The article is going provide you step by step information on configuring Hardware Security Module to store Federated Authentication Service certificate key pair.

Instructions

1. Edit the configuration file on the FAS server located in C:\Program Files\Citrix\Federated Authentication Service\Citrix.Authentication.FederatedAuthenticationService.exe.config to change the default Microsoft KSP to the SafeNet KSP.

1. Restart the Citrix Federated Authentication service from services.msc console.
2. From the SafeNet Luna 5.4 installation media, install the Luna client on the FAS server.
3. Once Luna is installed go to C:\Program Files\SafeNet\LunaClient\KSP and open Kspconfig.exe file.
4. In the SafeNet KSP config wizard, select Register or View Security Library on left pane.
5. On the right pane browse to C:\Program Files\SafeNet\LunaClient\cryptoki.dll and click on register to register the SafeNet Crypto.dll.

              

1. Once the Config file is edited, we need to Register the Network Service to the SafeNet KSP in the HSM Partition by opening the KSPConfig.exe.
2. On the left pane click on Register HSM Slots.
3. On the right pane, drop down the Register For User and select Network Service. Once the Network Service is selected, select one of the available slots and type in the Slot password.
4. Once the Slot Password is entered, click on register slot to register the Network Service with the SafeNet KSP.

             

1. Open an administrative command prompt and run the command certutil –csplist. You should see the SafeNet KSP in the output.

              

• Citrix_RegistrationAuthority_ManualAuthorization -> This is issued to the FAS server in the later configuration to make the FAS server the requestor of the certificate on behalf of the user.
• Citrix_RegistrationAuthority -> This also serves the same purpose as the above template.
• Citrix_SmartcardLogon -> This is the certificate issued by the Subordinate CA to the user UPN for authentication.

• After installing the Citrix certificate templates, they must be published on one or more Microsoft Certification Authority servers.
• If the templates are not published on at least one server, the Setup certificate authority tool offers to publish them.  You must run this tool as a user that has permissions to administer the certificate authority.

• The final setup step in the console initiates the authorization of the Federated Authentication Service.  The administration console uses the Citrix_RegistrationAuthority_ManualAuthorization template to generate a certificate request, and then sends it to one of the certificate authorities that publish that template.
• After the request is sent, it appears in the “Pending Requests” list of the Microsoft Certification Authority console.  The certificate authority administrator must choose to “Issue” or “Deny” the request before configuration of the Federated Authentication Service can continue.  Note that the authorization request appears as a “Pending Request” from the FAS machine account. 
• Right-click All Tasks and then select Issue or Deny for the certificate request.  The Federated Authentication Service administration console automatically detects when this process completes.  This can take a couple of minutes.

1. On the FAS server, we need to edit the config file located in C:\Program Files\Citrix\Federated Authentication Service\Citrix.Authentication.FederatedAuthenticationService.exe.config back to the default Microsoft Software Key Storage Provider.

1. Restart the Citrix Federated Authentication Service.
2. This will make sure the User Key Pairs are not stored on the HSM and it will get stored on the Local Server.

1. Certificate Authority and Certificate Template: The certificate template and certificate authority that will be used to issue user certificates.  This should be the Citrix_SmartcardLogon template, or a modified copy of it, on one of the certificate authorities that the template is published to.
   1. The Federated Authentication Service supports adding multiple certificate authorities for failover and load balancing, using PowerShell commands.  Similarly, more advanced certificate generation options can be configured using the command line and configuration files. 
2. In-Session Certificates: The Available after logon check box controls whether a certificate can also be used as an in-session certificate.  If this check box is not selected, the certificate will be used only for logon or reconnection, and the user will not have access to the certificate after authenticating.
3. List of StoreFront servers that can use this role:  The list of trusted StoreFront server machines that are authorized to request certificates for logon or reconnection of users.  Note that this setting is security critical, and must be managed carefully.
4. List of VDA desktops and servers that can be logged into by this role: The list of VDA machines that can log users on using the Federated Authentication Service system.
5. List of users that StoreFront can log in using this role: The list of users who can be issued certificates through the Federated Authentication Service.