Citrix StoreFront

Federated Authentication Service Configuration

August 1, 2025

Contributed by:

C N

Federated Authentication Service (FAS) provide single sign-on to VDAs using certificate authentication. This is useful when using authentication methods such as SAML, where StoreFront does not have access to the Active Directory credentials.

Enable FAS for a Store

Before enabling FAS for a store, you must configure the list of FAS servers using Group policy. For more details see FAS documentation.

To enable FAS for a store, you must use the PowerShell cmdlet Set-STFStoreLaunchOptions to set the VDA logon data logon provider to FASLogonDataProvider.

By default, StoreFront selects the FAS server at launch. You can change this so that StoreFront selects the FAS server at login. This has the advantage that it avoid delays that can occur at launch, particularly if a FAS server is unavailable so it has to try multiple FAS servers. However it has the disadvantage that if the FAS server becomes unavailable between login and launch then the launch fails. To configure the behavior, run PowerShell cmdlet Set-STFClaimsFactoryNames with parameter ClaimsFactoryName. To choose the FAS server at login, set it to FASClaimsFactory. To restore the default behavior and choose a FAS server at launch, set it to standardClaimsFactory.

For example to enable FAS for a store and select the server at login:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory"
<!--NeedCopy-->

To disable FAS for a store:

$store = Get-STFStoreService -VirtualPath [VirtualPath]
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider ""
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "standardClaimsFactory"
<!--NeedCopy-->

Substitute [VirtualPath] for the appropriate virtual path, e.g. /Citrix/Store.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Federated Authentication Service Configuration

August 1, 2025

Contributed by:

C N

August 1, 2025

Contributed by:

C N

Federated Authentication Service Configuration

Enable FAS for a Store

In this article