How to configure ADFS Claim Rules and StoreFront with multiple domains?

Instructions

Symptoms or Errors:

Authenticating:
Error: There was a failure with the mapped account



Or

Launching:
Event 28: Failed to launch the resource "Application Name" using the Citrix XML service at address"??". The user principal name could not be found.




Requirements:

The following requirements will be broken down into two parts, service provider domain and identity provider domain.

Service Provider Domain (Domain 1)

• StoreFront 3.9
• ADFS (Identity Provider for local domain)
  • Claim Provider Trust configured for Domain 2
  • Relying Party Trust configured for StoreFront 3.9
• XenApp / XenDesktop 7.9 or higher
• FAS server
• Resource Account for the user in Domain 2
• UPN Suffix with the

Identity Provider Domain (Domain 2)

• ADFS (Identity Provider)
  • Relying Party Trust configured for Domain 1

Note: This article assumes that you have all the requirements installed and configured. For installation and configuration see the resources section.

Solution:

1. Go to the ADFS of the Service Provider Domain >  Trust Relationships > Claims Provider Trusts > Select the trust configured for Domain 2 > Edit Claim Rules.
2. Click on Add Rule > Select "Pass Through or Filter an Incoming Claim" template > Click Next > Give it a name > select Incoming Claim Type as UPN > Select Pass through all claim values > Click OK.

3. Add another rule > Select "Transform an Incoming Claim" template > Click Next > Give it a name > select Incoming claim type as UPN > Select Outgoing claim type as Name ID > Select Outgoing name ID format as Unspecified > Select Pass through all claim values > click OK.

4. Once done, the rules should look something similar to this:

5. Go to the ADFS of the Identity Provider Domain >  Trust Relationships > Relying Party Trusts > Select the trust configured for Domain 1 > Edit Claim Rules
6. Under the Issuance Transform Rules click on Add Rule > Select "Send LDAP Attributes as Claims" Template > Click Next > Give it a name > Select Active Directory  as the Attribute Store > Under the LDAP Attribute select User-Principal-Name > Under the Outgoing Claim Type select UPN > Click OK.

7. Once done, the rules should look something similar to this:

8. Go to the ADFS of the Service Provider Domain >  Trust Relationships > Relying Party Trusts > Select the trust configured for StoreFront > Edit Claim Rules  
9. Under the Issuance Transform Rules click on Add Rule > Select "Send LDAP Attributes as Claims" Template > Click Next > Give it a name > Select Active Directory  as the Attribute Store > Under the LDAP Attribute select User-Principal-Name > Under the Outgoing Claim Type select Name ID > Click OK.

10. Add another rule > Select "Pass Through or Filter an Incoming Claim" template > Click Next > Give it a name > select Incoming Claim Type as Name ID > Select incoming name ID format as Unspecified >  Select Pass through all claim values > Click OK.

11. Once done, the rules should look something similar to this:

• StoreFront 3.9:
  • https://docs.citrix.com/en-us/storefront/3-9.html
• ADFS:
  • https://technet.microsoft.com/en-us/library/gg188612.aspx
• FAS server:
  • https://docs.citrix.com/en-us/xenapp-and-xendesktop/7-9/secure/federated-authentication-service.html
• Resource Accounts:
  • https://technet.microsoft.com/en-us/library/cc771972(v=ws.10).aspx