This message was deleted.

In this case you need to expose the Gateway VIP and authenticate from there with SSO to SF.

I don't understand. your purpose. Actually i only expose Netscaler Gateway VIP. I would like to have same authentication experience as domain passtrough with storefront.

StoreFront is a domain-joined Windows Server and NetScaler on the other hand is a non-domain joined (FreeBSD with a twist) appliance. I think there is or was an option to store ones credentials for GW auth, but that's more or less the same as storing your credentials in web browser. If you want 1:1 experience I would expose the SF VIP and allow clients to authenticate with it and use Optimal HDX routing in StoreFront to pipe the HDX traffic via Gateway. This ofc is just for internal network. If you need a more modern SSO experience with (or without) GW, I would urge you to look in to federated authentication (SAML/OIC). Are the users accessing the environment from an internal network or from the internet? If internal network, what is the reason not to expose the SF VIP?

Lol, i deployed more than 100 netscalers during 20 years. I know exactly what it is and what storefront is. As I said, Hdx routing approach with exposing sf vip is not possible (security reason). In citrix doc, Its seems possible but i use sf auth for ease multidomain auth https://docs.citrix.com/en-us/citrix-workspace-app-for-windows/domain-passthrough-matrix.html

Didn't mean to insult you, just trying to help and understand the reqs. That's a good docs, will bookmark it

I had a client do this with double hop OGR to storefront, it seemed pretty complicated but it worked

@Kari Ruissalo (WyW) The non-native english guy i am doesn't help in this situation. But you just rewrite what i says with different words, so this why i had a defensive "lol" position. On this platform, there is also AAA pre-check EPA policies, so the challenge to keep everything in the loop is important. There is also a method where i can disable auth on netscaler and storefront will receive every request. But this solution disable some features. I will dig on the kerberos way.