Hello all, I am implementing FAS for one of our Citrix environments. We have two different domains with trust between them. Users are in domain A , and rest of all the servers are in domain B. When implementing fas, should we create fas, and ca servers in domain A or domain B ?

looks like domain B, which i think is a common setup where the user accounts are in one domain, and everything else is in another. https://www.citrix.com/blogs/2019/11/20/your-guide-to-citrix-fas-multi-forest-selective-authentication/

But as per citrix tech doc: https://community.citrix.com/tech-zone/build/deployment-guides/multi-domain-fas users are in domain A with fas, storefront and ca servers in same domain

Yes do it where FAs is in the VDA domain you can actually do this either way but it will be easier if FAS is with storefront and the VDA

so only users are in domain A, and rest of all servers: fas, ca, storefront, ddc, vda, database are in domain B. Does this work?

Yes but it can be selective auth

We have a 2 way trust, 2 domains, FAS in user domain, CTX Infra in resource domain, VDAs in both. The short of it is, it'll work no matter where resources/users are, just have to cover bases for the associated configs (CA referrals, CA+template security, etc)

FAS uses kerberos which requires a trust the requirments are diffrent ased on what you have where for the example where FAS is in the rsource domain: • Domain R must trust domain A, since we want to log on the VDA in R with a user account in A • FAS (and the FAS component on the VDA) both make authorization decisions by using s4u to look up SIDs corresponding to a UPN • For this to work, domain A must trust domain R ◦ But note: selective authentication is OK with no further configuration ◦ Troubleshoot: on the FAS server (preferable running as network service): New-Object -TypeName System.Security.Principal.WindowsIdentity -ArgumentList "userA@domain-a.local" Other options: domain R may selectively trust domain A (rather than full forest trust) - but then further configuration of the trust is needed. If FAS is in the account domain: • Domain R must trust domain A, since we want to log on the VDA in R with a user account in A • FAS (and the FAS component on the VDA) both make authorization decisions by using s4u to look up SIDs corresponding to a UPN • For this to work, domain A must trust domain R ◦ But note: selective authentication is OK with no further configuration ◦ Troubleshoot: on the FAS server (preferable running as network service): New-Object -TypeName System.Security.Principal.WindowsIdentity -ArgumentList "userA@domain-a.local" Other options: domain R may selectively trust domain A (rather than full forest trust) - but then further configuration of the trust is needed. A Selective trust limits who is allowed to log into the domain and what objects they can log into. So it allows you to create a trust but limit its scope to just the components used by FAS ie VDAs and citrix users. Roger wrote this a long time ago still applies to useing slective auth wiht FAS. https://www.citrix.com/blogs/2019/11/20/your-guide-to-citrix-fas-multi-forest-selective-authentication/

Thanks for the detailed info @Rob Zylowski We are working on creating two way selective trust. Thanks a ton!!

Youre welcome. Good luck.