Citrix StoreFront SAML integration

On the StoreFront™ server, open an elevated PowerShell™ and run the command asnp citrix* to load the Citrix modules.

Once the modules are loaded, run this command to find your StoreFront VirtualPath value:

Get-STFStoreService | Out-String -Stream | Select-String  "VirtualPath"

Run the below commands to fetch the Service Provider Information. Remember to change the value of “/Citrix/Store” with the value you obtained in the previous step.

$storeVirtualPath = "/Citrix/Store"
$auth = Get-STFAuthenticationService -Store (Get-STFStoreService -VirtualPath $storeVirtualPath)
$spId = $auth.AuthenticationSettings["samlForms"].SamlSettings.ServiceProvider.Uri.AbsoluteUri
$acs = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/AssertionConsumerService")
$md = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlForms/ServiceProvider/Metadata")
$samlTest = New-Object System.Uri $auth.Routing.HostbaseUrl, ($auth.VirtualPath + "/SamlTest")
Write-Host "SAML Service Provider information:
Service Provider ID: $spId 
Assertion Consumer Service: $acs
Metadata: $md
Test Page: $samlTest"

The sample output of the above command looks like this:

SAML Service Provider information: 
Service Provider ID: https://StoreFront™.example.com/Citrix/StoreAuth 
Assertion Consumer Service: https://StoreFront™.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService 
Metadata: https://StoreFront™.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata 
Test Page: https://StoreFront™.example.com/Citrix/StoreAuth/SamlTest

Login to the Acceptto Dashboard with an administrative account and go to Applications.

Create a new application by selecting the Create New Application.

In the New Application form, enter the following values under the General tab:

Name - The application name displayed in the admin panel and application portal and used for push notifications and audit logs. (e.g. Citrix)

Type - Select "SAML Service Provider [saml_sp]" from the options.

Out of Band Methods - Select the allowed methods for approving MFA requests

Message for MFA Requests - Enter the user-facing message for Push, SMS, and e-mail MFA requests (optional)

Under the SAML Service Provider Configuration tab, enter the following values:

Issuer or Entity ID - The Issuer/EntityID of your StoreFront instance you got from the previous section. For example, https://StoreFront™.example.com/Citrix/StoreAuth

Sign in URL - The link used by your users to access the StoreFront. Like, https://StoreFront.example.com/

Metadata URL - The URL containing metadata about your StoreFront instance you got from the previous section. For example, https://StoreFront.example.com/Citrix/StoreAuth/SamlForms/ServiceProvider/Metadata

NameID Format - Select "Email Address" from the dropdown menu

Name Identifier - Select "userPrincipalName" from the dropdown menu

ACS URL - The StoreFront post-back URL you got from the previous section. For example, https://StoreFront.example.com/Citrix/StoreAuth/SamlForms/AssertionConsumerService

Click Save to create the Application.

Download your SAML IdP metadata information at http://sso.acceptto.com/[organization identifier]/saml/download/metadata.

On the StoreFront™ console, enable the SAML Authentication under the Manage Authentication Methods.

Open an elevated PowerShell on StoreFront™ server and run the below commands (Remember to change the value of “/Citrix/Store” with the virtual path of your Store).

Get-Module "Citrix.StoreFront*" -ListAvailable | Import-Module  
$StoreVirtualPath = "/Citrix/Store" 
$store = Get-STFStoreService -VirtualPath $StoreVirtualPath 
$auth = Get-STFAuthenticationService -StoreService $store 
Update-STFSamlIdPFromMetadata -AuthenticationService $auth -FilePath "File path of the metadata file you downloaded from Acceptto”

Go to your Citrix StoreFront URL. You will be redirected to the Acceptto SAML page.

After successful authentication, you’ll see the Acceptto MFA options. Select your desired method. Then, approve the authentication request on your It’sMe mobile app.

Finally, you will be redirected to your Citrix StoreFront landing page.