Hello Everyone and Happy Friday! Just wanted to run an issue through here to get some suggestions: We have a CVAD client on premises using 2203 LTSR - External Authentication is via SAML/Azure AD/FAS which is all working fine. Issue occurs when a User authenticates and launches a desktop externally then using a dedicated Internal Store tries to launch an App through Storefront/Workspace and they get an issue "Username of Password Error" FAS is not in play within the Internal Store but it seems that although Storefront/Workspace is SSO and Apps are configured for domain-pass through it's trying to pass through the Smart-card or FAS sign on from the original authentication? If the user signs into storefront using username and password rather than SSO, the app launches okay? Cheers all and have a good weekend!

You need to enable FAS on the internal and allow in-session on the FAS certificates. You can't use domain pass through from a FAS session as there isn't a username or password to capture.

https://support.citrix.com/s/article/CTX289690-unable-to-start-session-in-double-hop-environment?language=en_US oldie but a goodie on double hop scenarios - gets everyone once in the FAS world