Hello, any comments on this? https://support.citrix.com/support-home/kbsearch/article?articleNumber=CTX695088&artic[…]MadeYouReset_vulnerability_on_Cloud_Software_Group_Products

StoreFront 2507 LTSR has been released! Not much functionality since 2503 but there have been a lot of bug fixes. See release notes.

In 2507, Workspace App detection has been removed for App Protection for hybrid launch. Can anyone explain this change? It seems to me, that Citrix is lowering security, by doing this.

Anyone have "Modern Experience" StoreFront modification recipes? I'm looking to embed a hyperlink on the StoreFront web login page.

We have StoreFront setup behind GSLB running v2402 CU1. When we do GSLB failover, launching apps from CWA doesn't work until we reset CWA or restart SF servers in non-active datacenter. Launching apps from browser is no problem. We don't know when the issue started but this was working earlier, we noticed few months back when we did DR failover testing. Error when launching apps - Unable to start Anyone seen this issue?

anyone knows what these signify in infrastructure monitoring for storefront ? storefront shows no https errors in console and cert is bound in iis under bindings

I`m lost, any clue on where to change the Name and Description globally? Either on NetScaler or StoreFront, this is OnPrem and not Citrix Cloud, which do have that option. #CKHRXATV2 I know that this can be done via GPO, but my device is BYOD.

We are trying to automate creation of SF Stores using powershell. But after creation app enumeration through CWA is not working, web access works fine. Version - LTSR 2507. An error occurred during authentication. Citrix.DeliveryServices.Security.Tokens.Exceptions.RelyingPartyNotFoundException, Citrix.DeliveryServices.Security, Version=3.32.0.0, Culture=neutral, PublicKeyToken=e8b77d454fa2a856 Relying party 3db6a0dd-86ad-49cc-b965-2d480eea3d93 was not found for token service 25b21905-e13c-498a-996a-145fbc1698e8 AuthenticationControllerRequestUrl: https://store.company.com/Citrix/StoreWeb/CitrixAuth/Login at Citrix.DeliveryServices.Security.Tokens.Saml11.TokenService.TokenForService(IClaimsPrincipal principal, RequestToken tokenRequest) at Citrix.Web.TokenGenerator.TokenGenerator.CreateToken(ITokenService service, String serviceId, String serviceUrl, TimeSpan tokenLifetime, IClaimsPrincipal principal) at Citrix.Web.AuthControllers.Controllers.FederatedAuthBaseController.Login(IClaimsPrincipal claimsPrincipal)

Hello, I’m running two StoreFront servers in the same Server Group. One of them encountered an issue, so I removed it from the Server Group and now I’d like to reset it. I came across the command "Clear-STFDeployment -Confirm $False", but I’d like to confirm whether this command will reset only the problematic StoreFront server or if it might affect the rest of the deployment. Thanks,

We want to separate internal and external access to separate stores. Laptops that have internal store added using GPO don’t work when remote since remote access is not enabled for the store. To resolve the issue, we have remote access turned on for internal and external store. How to set remote access to external store only?

Hey guys, has anyone had issues with custom top left logo in storefront looks blurry? the file itself is fine when opened separately but in SF portal looks bad.

Hey, I’m going through some settings to try and fix the dreaded “cannot complete your request” prompt window and was wondering why a store might be setup for authentication on receiver for web with ONLY “pass through from Citrix gateway”? Troubleshooting doc from Citrix says it needs both “username and password” and “gateway pass through” enabled. This is a really old store so I’m wondering if it used to be the suggested setting many many years ago or what other reason you may set it to exclusively use citrix gateway pass through for authentication on web

We often have the problem that StoreFront thinks the user is already logged in. This is probably caused by a cookie from the previous day, even though the browser session was closed and the PC was restarted. According to the browser, the cookie should be valid only until the end of the browser session, but it still exists. In this case, StoreFront assumes that the user is logged in. One noticeable symptom is that the user name is missing in the header area where it normally says “Good morning John Doe”. Resources cannot be launched. Only after the user manually deletes the ASP.NET_SessionID cookie does StoreFront prompt for login again, and the user is then able to launch resources successfully.

GACS doesn't control the store user interface.

Anyone using StoreFront 2507 CU1 with 2203 CU4 DDC’s with success?

Question for discussion: StoreFront 2507 + NetScaler Gateway + SNAT issue Hi all, I’m facing an issue with NetScaler Gateway → StoreFront integration that appeared after upgrading StoreFront to 2507 LTSR. Topology: • User logs in to NetScaler Gateway • Gateway forwards traffic to Load Balancer • LB goes through NAT (StoreFront sees requests coming from a pool of NAT IPs) • All requests for a session eventually reach the same StoreFront server but each packet from pool of NAT IP’s (random) Symptoms: • StoreFront 2203 CU4 works fine with this NAT/SNAT setup • After upgrading to StoreFront 2507, login via Gateway fails with: “Cannot complete your request” My suspicion: I suspect that StoreFront 2507 enforces stricter session/client context validation, and a changing IP within a single session may invalidate the auth session, which did not occur in 2203. I could not find any official confirmation in release notes / Citrix documentation. Questions: 1. Has anyone encountered a similar issue using a NAT pool for Gateway → StoreFront traffic on 2507? 2. Does StoreFront 2507 implement new session/IP validation that could cause SNAT pool traffic to fail authentication? 3. Are there any official Citrix articles (CTX) or docs confirming this behavior? Any pointers, links to CTX articles, or experiences with similar cases would be greatly appreciated.

does anyone know how to modify HTML5 receiver error messages in StoreFront? I have some VDI's that are powered off by default and while user waits for them to boot the Light Client gives them Failed message -

@Barry Browne has left the channel

Anyone got storefront hooked up directly to okta for saml authentication ? (I am ok integrating Netscaler Gateway with OKTA using SAML as done it loads of times) I am just struggling a little with storefront and configuring SAML . While not specifically OKTA i have followed the steps as per https://docs.secureauth.com/arculix/en/citrix-storefront-saml-integration.html and https://support.citrix.com/external/article/CTX237490/implementing-storefront-saml-with-azure.html

StoreFront 2603 has been released. See https://docs.citrix.com/en-us/storefront/current-release/whats-new.

Has anyone dealt with a scenario where when joining a second storefront server the join says successful, propagation fails, and numerous services/features on the second node fail to get setup? E.g. on the second node the credential wallet service is missing and the features folder only has 8 items compared to the primary (or a working instance) that has 38 items? I've gone through a number of checks from the articles re: troubleshooting propagation, but it seems like the fundamental deployment of the necessary services is not addressed in those articles. This is CVAD/SF 2402CU3.

@Christoph Mages joined #citrix-storefront. They’re also new to World of EUC.

Hey friends, what is the best way to move stores from older version of store front to new one? I have a group of server running 2402 on server 2016. Building a new group on 2025 with 2507 LTSR. I dont think export works between versions. I would rather not upgrade current prod installation if possible. If I manually recreate the store I am guessing it would mess with existing user subscriptions or workspace configs?

another issue with SF 2507 CU1 - it does not look like HTML5 workspace is installed? I dont see option to let users use it and when I go to install it from standalone package I get

No session for authentication Still dealing with tons of errors in a complex SF deployment.

An error occurred during authentication.
Citrix.DeliveryServicesClients.Authentication.Exceptions.NoSessionForAuthenticationException, Citrix.DeliveryServicesClients.Authentication, Version=3.34.0.0, Culture=neutral, PublicKeyToken=null
No session for authentication
AuthenticationControllerRequestUrl: <https://SF-BASE-URL/Citrix/StoreWeb/CitrixAuth/Login>
   at Citrix.Web.AuthControllers.Controllers.FederatedAuthBaseController.Login(IClaimsPrincipal claimsPrincipal)

When i browse to this url, i get an 404. https://SF-BASE-URL/Citrix/StoreWeb/CitrixAuth/Login Any troubleshooting step i can do here? I reduced complexity a bit, so we got: citrix.domain.net => External NSGW citrix.domain.com => Internal LB for SF Servers citrix.domain.com:8444 => Internal GW all users should use for hdx, so all traffic passed either through external or internal GW. • Due to security reasons citrix.domain.net cannot be resolved internal, singlefqdn is not possible. • Users move from inside to outside and back • Workspace app and browser access needs to work I configured Storefront to use internal GW as HDX Proxy, therefore all ica file contain citrix.domain.com:8444 as SSLProxyHost SF writes this in EVERY ica file, so also to these, that are opend via the external gateway. Therefore i have an rewrite policy at the external gw in place, that rewrites SSLProxyhost=citrix.domain.com:8444 to SSLProxyhost=citrix.domain.net This works for 95% of all users.

I’m working on a Citrix migration to the cloud. Customer uses on‑prem StoreFront and wants to keep the same servers and URL while we move to Citrix Cloud. In one StoreFront store I added two sites: – On‑prem CVAD (current prod) – Citrix Cloud/DaaS via Cloud Connectors In a Cloud‑only test store, the user sees the Cloud apps. In the mixed store (on‑prem + Cloud) they only see the on‑prem icons, and it looks like StoreFront is just using the first site in the list. The customer wants one URL and doesn’t want new AD groups or separate pilot URLs. My plan was to keep both sites in the same store, then disable the on‑prem app and enable the Cloud app as users migrate, but right now Cloud icons don’t show at all in that mixed store. I’ve looked at the “Manage sites / Map users to site” doc: docs.citrix.com/en-us/…/manage-controllers.html#… but user mapping seems to assume AD groups, which the customer doesn’t want to create. Has anyone done “on‑prem + Citrix Cloud, same StoreFront URL, minimal AD changes” and gotten both sites to enumerate in one store? Any tips on StoreFront settings or patterns would be appreciated.

We want to use the Open Intune Baseline and get rid of NTLM. See: github.com/SkipToTheEndpoint/OpenIntuneBaseline/blob/…/SETTINGSOUTPUT.md#… When we import and enable the policy, this breaks SSO of the CWA. Now I wondered if we can switch Storefront from NTLM to Kerberos, by using a gMSA and setting a SPN, but I can't find any guide, nor I can get it to work. Has somebody done something like this, are there any guides?

Anyone try the new detailed desktop tile in SF 2607? I can't seem to get it working; I've enabled it in store: docs.citrix.com/en-us/storefront/current-release/whats-new#…

hi Guys, any working setups where workspace app could SSO - authenticate to storefront (just storefront , not AG) when users logging into their windows laptops using Windows Hello for business (via Cloud Kerberos)? all worked when logging with username /password but now testing WHfB and logs from authmanager service say that Windows Integrated auth failed and it is switching to forms. amLogonResult=LogonResult_UnsuitableProtocol Wed Sep 9 020556 2026 < T:00001D9C . . . . . . . . . . } Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . CProtocolSelector::MoveNextOrThrow Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . { Wed Sep 9 020556 2026 T:00001D9C . . . . . . . . . . . ‘IntegratedWindows’ allows fallback for ‘UnsuitableProtocol’. Wed Sep 9 020556 2026 T:00001D9C . . . . . . . . . . . Next choice is ‘ExplicitForms’. Wed Sep 9 020556 2026 < T:00001D9C . . . . . . . . . . } Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . CProtocolSelector::Current Wed Sep 9 020556 2026 > T:00001D9C . . . . . . . . . . { Wed Sep 9 020556 2026 T:00001D9C . . . . . . . . . . . Current protocol choice for authentication is ‘ExplicitForms’

Has anyone patched their storefront servers with the new dot net runtime 8.x/10.x version, that addresses the latest CVE? Just confirming there are no issues.