Federated Authentication Service 1912 LTSR
Note:
This documentation supports Federated Authentication Service 1912, which is a baseline component for Citrix Virtual Apps and Desktops 7 1912 LTSR. For the most recently updated content, see the Federated Authentication Service current release documentation. The product lifecycle strategy for Current Releases (CR) and Long Term Service Releases (LTSR) is described in Lifecycle Milestones.
Federated Authentication Service (FAS) is a privileged component designed to integrate with Active Directory Certificate Services. It dynamically issues certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card. This allows StoreFront to use a broader range of authentication options, such as SAML (Security Assertion Markup Language) assertions. SAML is commonly used as an alternative to traditional Windows user accounts on the Internet.
The following diagram shows FAS integrating with a Microsoft Certification Authority and providing support services to StoreFront and Citrix Virtual Apps and Desktops Virtual Delivery Agents (VDAs).
Trusted StoreFront servers contact FAS as users request access to the Citrix environment. FAS grants a ticket that allows a single Citrix Virtual Apps or Citrix Virtual Desktops session to authenticate with a certificate for that session. When a VDA needs to authenticate a user, it connects to FAS and redeems the ticket. Only FAS has access to the user certificate’s private key; the VDA must send each signing and decryption operation that it needs to perform with the certificate to FAS.
References
- Active Directory Certificate Services https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-R2-and-2012/hh831740(v=ws.11)
- Configuring Windows for Certificate Logon http://support.citrix.com/article/CTX206156