This article illustrates how to configure StoreFront 3.9 and Active Directory Federation Services for Windows Server 2016. This will demonstrate how to configure both StoreFront and ADFS using SAML metadata exchange.
Getting Started
This article assumes that you have already deployed ADFS and StoreFront, and created a StoreFront store. For the purposes of this article we will assume the following:
- The store is called: Store, and has a virtual path /Citrix/Store
- The associated authentication service has a virtual path: /Citrix/StoreAuth
- ADFS is hosted at Url: https://idp.example.com
- StoreFront is hosted at Url: https://storefront.example.com
As the configuration will be utilizing SAML metadata exchange, the two metadata endpoints will be required:
- ADFS: https://idp.example.com/FederationMetadata/2007-06/FederationMetadata.xml
- StoreFront: https://storefront.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata
Step 1: Configure StoreFront
First ensure that the SAML Authentication method is enabled, by opening the StoreFront management console, select the store that you wish to use SAML with, and then select “Manage Authentication Methods”
Ensure that “SAML Authentication” is enabled:
Next open a PowerShell window, running as Administrator and type the following:
Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module
# Remember to change this with the virtual path of your Store.
$StoreVirtualPath = "/Citrix/Store"
$store = Get-STFStoreService -VirtualPath $StoreVirtualPath
$auth = Get-STFAuthenticationService -StoreService $store
Update-STFSamlIdPFromMetadata -AuthenticationService $auth -Url https://idp.example.com/FederationMetadata/2007-06/FederationMetadata.xml
The Store is now configured to trust assertions from ADFS.
Step 2: Configure ADFS
On the ADFS server open the “AD FS Management” administration tool, and select to “Add a Relying Party Trust…”
This brings up the following:
Accept the default of “Claims aware” and select “Start”.
The trust is configured from the StoreFront metadata, so select “Import data about the relying party published online or on a local network” and enter the StoreFront metadata endpoint, then select “Next”.
Accept the suggested display name, or overwrite with a more meaningful name, and the select “Next”
This dialog allows the configuration of access control policies for ADFS. This configuration is outside the scope of this article, so accept the default of “Permit everyone” and select “Next”
This dialog allows the review of the information imported from the StoreFront metadata, you can review the values and then select “Next”
Accept the default to “Configure claims issuance policy for this application” and select “Close”
The following dialog should open automatically, if not then in the AD FS Management console, select the Relying Party Trust just created and then select “Edit Claim Issuance Policy…”
Select “Add Rule”, and select “Send LDAP Attributes as Claims”, as follows, then select “Next”
Fill in the resulting dialog, as follows, then select “Finish”
Select “OK” to complete the ADFS configuration
Step 3: Test
The solution should now be configured, which you can verify by pointing a browser at the test page, the Url of which can be obtained using the PowerShell described here: http://docs.citrix.com/en-us/storefront/3-9/sdk-overview.html#par_anchortitle_a8db. After authenticating to ADFS, the test page will display information like the following:
Note that by default, the returned SAML assertion is both signed and encrypted.
Configuration of Artifact Resolution
SAML can be configured so that the assertion is not returned to the client, instead an artifact is returned that the Service Provider can redeem for the assertion directly from the IdP.
As a pre-requisite, the artifact resolution endpoint must have been enabled in ADFS, which can be verified in the AD FS Management console
Note: If you have to enable the artifact resolution endpoint here, then at the end of this procedure you will have to use the PowerShell to update the StoreFront configuration from the IdP metadata.
To configure StoreFront for artifact resolution, first open a PowerShell window running as Administrator, then enter:
Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module
# Remember to change this with the virtual path of your Store.
$StoreVirtualPath = "/Citrix/Store"
$store = Get-STFStoreService -VirtualPath $StoreVirtualPath
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFSamlRequireArtifactResolution -AuthenticationService $auth -Required $true
Next in the AD FS Management console, select the StoreFront Relying Party trust and select “Update from Federation Metadata…”
In the resulting dialog, select “Update”
Finally use the test page to verify the solution
More Information
Further information can be found on the Citrix Documentation site:
- Overview: http://docs.citrix.com/en-us/storefront/3-9/plan/user-authentication.html#par_anchortitle_904a
- PowerShell SDK Documentation: https://citrix.github.io/storefront-sdk/Citrix.StoreFront.Authentication.Saml/Citrix.StoreFront.Authentication.Saml/
- Metadata Exchange PowerShell sample: http://docs.citrix.com/en-us/storefront/3-9/sdk-overview.html#par_anchortitle_78af
- Service Provider information: http://docs.citrix.com/en-us/storefront/3-9/sdk-overview.html#par_anchortitle_a8db
