Federated Authentication Service 编辑

The Citrix Federated Authentication Service is a privileged component designed to integrate with Active Directory Certificate Services. It dynamically issues certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card. This allows StoreFront to use a broader range of authentication options, such as SAML (Security Assertion Markup Language) assertions. SAML is commonly used as an alternative to traditional Windows user accounts on the Internet.

The following diagram shows the Federated Authentication Service integrating with a Microsoft Certification Authority and providing support services to StoreFront and XenApp and XenDesktop Virtual Delivery Agents (VDAs).

Trusted StoreFront servers contact the Federated Authentication Service (FAS) as users request access to the Citrix environment. The FAS grants a ticket that allows a single XenApp or XenDesktop session to authenticate with a certificate for that session. When a VDA needs to authenticate a user, it connects to the FAS and redeems the ticket. Only the FAS has access to the user certificate’s private key; the VDA must send each signing and decryption operation that it needs to perform with the certificate to the FAS.

Requirements

The Federated Authentication Service is supported on Windows servers (Windows Server 2008 R2 or later).

• Citrix recommends installing the FAS on a server that does not contain other Citrix components.
• The Windows Server should be secured. It will have access to a registration authority certificate and private key that allows it to automatically issue certificates for domain users, and it will have access to those user certificates and private keys.
• The FAS PowerShell SDK requires Windows PowerShell 64-bit installed on the FAS server.
• A Microsoft Enterprise Certification Authority is required to issue user certificates.

In the XenApp or XenDesktop Site:

• The Delivery Controllers must be minimum version 7.15.
• The VDAs must be minimum version 7.15. Check that the Federated Authentication Service Group Policy configuration has been applied correctly to the VDAs before creating the Machine Catalog in the usual way; see the Configure Group Policy section for details.
• The StoreFront server must be minimum version 3.12 (this is the version provided with the XenApp and XenDesktop 7.15 ISO).

When planning your deployment of this service, review the Security considerations section.

References:

• Active Directory Certificate Services

https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831740(v=ws.11)?redirectedfrom=MSDN

• Configuring Windows for Certificate Logon

https://support.citrix.com/article/CTX206156

Install and setup sequence

1. Install the Federated Authentication Service
2. Enable the Federated Authentication Service plug-in on StoreFront servers
3. Configure Group Policy
4. Use the Federated Authentication Service administration console to: (a) Deploy the provided templates, (b) Set up certificate authorities, and (c) Authorize the Federated Authentication Service to use your certificate authority
5. Configure user rules

Install the Federated Authentication Service

For security, Citrix recommends that the FAS be installed on a dedicated server that is secured in a similar way to a domain controller or certificate authority. The FAS can be installed from the Federated Authentication Service button on the autorun splash screen when the ISO is inserted.

This will install the following components:

• Federated Authentication Service
• PowerShell snap-in cmdlets to remotely configure the Federated Authentication Service
• Federated Authentication Service administration console
• Federated Authentication Service Group Policy templates (CitrixFederatedAuthenticationService.admx/adml)
• Certificate template files for simple certificate authority configuration
• Performance counters and event logs

Enable the Federated Authentication Service plug-in on a StoreFront store

To enable Federated Authentication Service integration on a StoreFront Store, run the following PowerShell cmdlets as an Administrator account. If you have more than one store, or if the store has a different name, the path text below may differ.

```
Get-Module "Citrix.StoreFront.*" -ListAvailable | Import-Module

$StoreVirtualPath = "/Citrix/Store"

$store = Get-STFStoreService -VirtualPath $StoreVirtualPath

$auth = Get-STFAuthenticationService -StoreService $store

Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"

Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
<!--NeedCopy--> ```