Citrix StoreFront

Authentication methods

June 11, 2025

Contributed by:

To configure the authentication methods available for a store, see Configure Authentication. You can override some of these settings for a particular website. These overrides only apply when users open the store in a web browser. Locally installed Citrix Workspace app uses the settings from the store rather than the website.

Warning:

Any time you change the authentication methods for a store, this overrides the settings for all websites for that store so any changes must be re-applied.

To modify authentication methods when using a web browser, go to Edit store website and select the Authentication methods tab.

Screenshot of Authentication methods screen

Select the Active Directory username and password check box to all users to authenticate by entering their username and password. See Username and password authentication. This option is only available if it’s enabled for the store.
Select the SAML Authentication check box to enable integration with a SAML Identity Provider. See SAML authentication. This option is only available if it’s been enabled for the store.
Select Domain pass-through to enable pass-through of Active Directory domain credentials from users’ devices. See Domain pass-through authentication. This option is only available if it has been enabled for the store.
Select Smart card to enable smart card authentication. See Smart card authentication.
Select Pass-through from Citrix Gateway to enable pass-through authentication from Citrix Gateway. Enable this if users connect to StoreFront through a Citrix Gateway with authentication enabled, to avoid users needing to authenticate a second time at StoreFront. See Pass-through from Citrix Gateway.

If you select multiple authentication methods then the default authentication method for users logging in directly to StoreFront is determined according to the following order of precedence:

Domain pass-through
Smart card
SAML
Username and password

The user can choose to switch to a different authentication method. An exception is that if you configure both SAML and username and password authentication then users are not able to switch to Username and password authentication.

When users log out, they can choose whether to remember the authentication method for next time.

Configure using PowerShell

To configure the available authentication methods using the PowerShell, run the cmdlet Set-STFWebReceiverAuthenticationMethods.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Authentication methods

June 11, 2025

Contributed by:

June 11, 2025

Contributed by:

Authentication methods

Configure using PowerShell

In this article