Hey everyone - strange FAS issue. DaaS with Cloud Connector's, FAS and VDA OnPrem. Getting that error on the VDA, SSO is failing. I know that error and checked the three articles from Citrix, no changes. It is sill not working and I'm just wondering how can I check that deeper to see WHAT is causing the Access Denied? What I did: • telnet from VDA to FAS to check all needed Ports -> OK • FAS Policy is default, all User's and VDA's are allowed -> OK • Adding VDA's computer account to the FAS local network policy, like here -> OK • No eventlogs on FAS, because FAS didn't even ask the PKI, because the first step (requesting a user-cert from the VDA to the FAS) is directly failing • No OnPrem SF, Cloud Workspace only. One forest, one domain, no trusts, nothing special • Wireshark trace which shows the successful communication from VDA to FAS during the logon, nothing blocked or dropped -> OK • Windows firewall off on both sides, no AV-software installed • Citrix Smartcard template, both FAS are allowed to issue Certs The Access denied should mean the computer-account of the VDA is not allowed to remotley logon to FAS and requesting some certs. But I have no idea on which point this could be blocked? Thanks for any tips.

Hey Julian did you check the kerberos auth certificates on the domain controllers to make sure they are still valid.

FAS servers list GPO or registry configured on the VDA and the FAS servers themselves? FAS configured properly in the Citrix Cloud Console?

to Steven's point, ensuring that the fas servers are configured in a consistent order in all of the policies and settings.

Ah sorry, yeah the "basics" are also checked, FAS all green, connected to Cloud, GPO with FAS-Server List on all VDA's an FAS itself, verified the regkey where the FQDN's are listed, too. Thanks Rob, will verify that

Have you defined different rules? I always specify the rulename via GPO and double check the registry if the policy has been applied on all components.

But I think Shane and Steven are thikning of the right thing normally that error is a missmatch in the indexing but could be not being able to talk to the fas server for any reason. I think cdf traces would provide more info. Does index 0 seem like the correct server

Are you getting any Kerberos error on the VDA? Do you get a "username or password incorrect" error message?

When i have seen access denied errors its typically the cert on the domain controllers you need to make sure it is issued using the kerberos authentication or domain controller authentication template which has smart card logon in intended purposes/Enhanced key usage. I would also take a look at pkiview and check for any issues with CRL's/AIA locations you can also download your Citrix_smartcardlogon user cert from the FAS server and run Certutil -verify -urlfetch "name of the user certificate.cer" on it and check for any AIA/CRL errors in the output

@Julian Jakob you mentioned you're not getting any certificate. Do you have an existing cert which you could use for troubleshooting? execute certutil -URL usercert.cer

Thanks guys. Rule is Default and I've also checked that the rule is applied. FAS is also enabled in workspace auth in DaaS. I can create certs from both FAS servers via PS by manual. So the communication between FAS and PKI looks correct. If there's an issue with the Kerberos auth certs on DCs, I think it would not be possible to get a fas-usercert from the FAS-Servers directly? I'm also getting no "username or password incorrect" it's just doing no SSO inside the published Desktop. I will check for kerberos errors on the VDA

Any timeouts you are noticing or is the failure immediate? We had one where a random DC wouldn't reply in time and I'm pretty sure the error in the logs showed as 'access denied'

Same domain as the FAS servers? Had same error today trying to stand up a POC and had to add domain computers for the new domain to the default policy authorization rule.

is the user seeing access denied when the pub desktop/app opens? or is this before that?

Thanks guys, I've found the issue. There is a VDI environment (Xen Cluster) and a RDS environment (vSphere) with dedicated CC's and FAS's. All in the same DaaS Tenant. The goal was to point Xen Workload only to Xen FAS and vSphere Workload only to vSphere FAS (because of some infrastructure guidelines), that's what we did regarding FAS Policy and FAS GPO. BUT it's ignored because of the "Primary" and "Secondary" config in DaaS 😄 I've recognized that during testing, there were some logs generated on FAS vSphere, coming from the Xen Workload... So now all four FAS can be requested from the whole workload, that was the solution at the moment.

Good Job Julian.. but I told you to check the Cloud config :P