Extension of the existing article with further troubleshooting cases.
As a result of increasing projects, here is a little how-to with the summary of my previous articles. The main points are:
- Azure AD Seamless Single Sign-On (PTA / PHS)
- SAML Authentication (Azure AD as IdP & Citrix Gateway as SP)
- Citrix Federated Authentication Service (FAS)
- Microsoft Azure Multi-Factor-Authentication with Conditional Access
Continue reading “SAML Authentication between Citrix & Microsoft with Azure MFA”
- Fully working Citrix Virtual Apps and Desktop Environment (StoreFront & DDC Minimum Version 7.9)
- Citrix ADC with successful base configuration & activated Enterprise or Platinum license (Minimum Version 12.1 Build 50+ for native workspace app, for browser Minimum Version 11.1)
- Configured Unified Gateway vServer
- Internal and external DNS entries for Unified Gateway vServer (e.g. citrix.deyda.net)
- Certificates for DNS entries (wildcard certificates are the easiest)
- Existing Azure Tenant with Azure-AD base configuration (Domain, AAD Sync) & activated Azure AD Premium license
- AD Connect version installed and configured (Minimum Version 1.1.644.0)
- Firewall release for *.msappproxy.net on port 443
- Domain administrator credentials for the domains that connected to Azure AD via AD Connect
- Installed Authenticator App on Test User Mobile Phone
What is Hybrid Azure AD Join ?
Let’s just start with the official definition from the Microsoft documentation:
Hybrid Azure AD Join: Joined to on-premises AD and Azure AD requiring organizational account to sign in to the device.
This means that after the device is Hybrid Azure AD joined, it behaves the same as any other computer connected to Active Directory.
Sign in with an Active Directory account is required.
User credentials are verified against an Active Directory domain controller.
Group Policy objects for users & computers read from the domain controller are applied automatically.
After the Active Directory connection process is complete, additional steps are performed asynchronously in the background to register the device in Azure AD as well.
Continue reading “Why a Windows Server 2019 VDI should be Hybrid Azure AD joined”
For quite some time (Beginning of 2017) it is now possible to solve SSO scenarios with Azure even without ADFS infrastructure. However, it is only recently that companies has started to not insist on ADFS. Now one may finally also point out the alternative solutions of Microsoft.
The possible scenarios for Seamless SSO are:
- Pass-through authentication (PTA)
- Password Hash Sync (PHS)
Pass-through authentication (PTA)
- No automatic detection of leaked login data
- Azure AD DS requires enabled Password Hash Synchronization feature in tenant to work
- Is not part of Azure AD Connect Health
Password Hash Sync (PHS)
Continue reading “Activation of Azure AD Seamless Single Sign-On”
- Password is synchronized to the cloud (as hash value)
Since Citrix XenApp / XenDesktop 7.9 the Federated Authentication Service (FAS) is available. Via Citrix FAS it is possible to authenticate a user via SAML and thus connect Citrix as a service provider to existing identity providers, such as Azure-AD.
Sequence of SAML authentication
Continue reading “SAML Authentication with Azure AD as IdP and Citrix as SP”
- The user browse the FQDN (e.g. citrix.deyda.net) of the Citrix Gateway vServer (Service Provider) to start his VA / VD resources
- The Citrix Gateway vServer directs the unauthenticated user directly to the Identity Provider (Azure-AD) to authenticate itself (saml: authnRequest)
- The Identity Provider points to its SingleSignOnService URL (e.g. login.microsoftonline.com) and the user must authenticate
- The user enters his AD credentials and these are checked by the Identity Provider against the user database
- Upon successful verification in the user database, the IdP is informed
- The IdP issues a token (SAML assertion) and sends it to the Citrix Gateway (saml: response)
- Citrix Gateway checks the token (assertion signature) and extracts the UPN from the assertion token. This allows access via SSO to the VA / VD farm via FAS (The SP does not have access to the user’s credentials)