Been doing research on FAS setup. On the Techzone Docs it states this "When using Citrix Gateway, configure StoreFront with the details of the Citrix Gateway and Callback URL, because logon evidence is transmitted via the Callback. Configuring Logon type as "Smart card" helps native clients perform SAML authentication." I wanted to confirm, that others do this? I was curious because I was following some guides online, and it did not state this. Just curious

I haven't done this in any of my deployments.

I have not either. Hmmm, It makes sense, but never had to do this before myself.

Okay, thanks. I guess for now, I will ignore it and and just try to remember it if I need to troubleshoot later.

the actual auth is from gateway and smartcards are not used to auth to storefront something called AGBasic is which allows passthrough from NetScaler Gateway. Should be Domain there. In the actual auth settings for the store make sure you have passthrough from Citrix Gateway and in advanced settings fully delegate credentials to Citrix Gateway

Thanks Rob, yea we have that set. I was just reading the TechZone link here. But I wonder if article is incorrect or perhaps for a different use case? Maybe they can for more context around it? IDK. "When using Citrix Gateway, configure StoreFront with the details of the Citrix Gateway and Callback URL, because logon evidence is transmitted via the Callback. Configuring Logon type as "Smart card" helps native clients perform SAML authentication. The setting "Fully delegate credential validation to Gateway" enables the StoreFront servers to delegate user authentication to the Gateway, which allows pass-through SAML authentication from the Citrix Gateway. IT admin has created the FAS Group Policy Object that containing the trusted FAS servers list and applied to the OU where the FAS Servers, VDAs, and StoreFront Servers reside in the AD domain." https://community.citrix.com/tech-zone/design/reference-architectures/federated-authentication-service

yea that is just a mistake

Okay, thank you.

I wonder if maybe that setting is for people that were doing Storefront direct connections to a Smartcard connection, that then get delegated to the Gateway? Leftovers?

Maybe, but I wish they would break it down a little better for different situations.

Cleaning up old legacy stuff in your code is always the last thing done for fear of breaking things. For example see legacy IIS requirements still needed for LTSR 2402 EAR.

Authentication is very complicated no matter how much we document it would never be enough.

it is for sure