Hello, we are deploying citrix cloud with saml integration. From the login end, everything works as expected. When we open citrix cloud url it redirects to our saml url, we can login and see the apps. But when we launch the apps, it says username or password incorrect. This is multi domain envioronment with root and intermediate CAs. Domain trusts are two way trusts validated completely. On the vda I have enabled kerberos logging. I see kdc_err_client_not_trusted, kdc_err_preauth_required, kdc_err_wrong_realm, errors on the VDA. I've extracted the cert given by fas for a user, exported to text file. It says validated for cdp (ldap and http) urls. On the two domain controllers, I have certs with smart card logon, server authentication and client authentication policies in certs. on the CA server, I've republished revoked certs which will generate crl file. Copied it to pki folder in iis. I can access http://pki.domain.com/intermediatecert.crl file on all machines (vda, fas, ca). restarted ca services as well. Copied intermediate cert and root cert to both dcs, ca, vda and fas servers Still we are getting that error. can someone please help?

Are there vdas in all the domains and does FAS work for some? IN a multidomain config both the dcs and the vdas must trust the CA used across domains. The ca has to be added into the enterprise ca container on both as well. This has a decent writeup on how to et up the multi domain CA trusts https://community.citrix.com/tech-zone/build/deployment-guides/multi-domain-fas/

All servers are in servers domain and all users are in users domain( no servers except AD and cloud connectors). Going through the article now.

Did the new certificate hardening get deployed? That does not yet work correctly with FAS if you disable usesubjectaltname.

no, certificate hardening was not deployed. In the cert issued by FAS, under subject alternative name, I see other name: principal name=userid@userdomain.com.

On the VDA, issue certutil -viewstore -ent NTAuth from admin command window. Does it present the Root CA that is issuing the FAS User Cert?

Not the root but the intermediate cert. It is selected already.

anything in vda's system event log? event ID 9?

I see kerberos errors: kdc_err_client_not_trusted, kdc_err_preauth_required, kdc_err_wrong_realm, errors on the VDA

Do all the domain controllers have a cert from that CA for Server Auth, Kerberos, and client auth?

yes from that intermediate ca

How many AD controllers? can you check their logs for any KDC errors? FAS 24.11?

Could it be something like this? "need to add the VDA’s to the domain group “Windows Authorization Access Group” (this group have access to the computed tokenGroupsGlobalAndUniversal attribute on User objects). Additionally, we also had to re-issue the certificate request from the FAS servers, and then it all worked."

@Corey Tracey we have 1 dc in each domain.

is that the entire message? What log and what eventid?

it is kerberos kdc warning on users dc. it says client certificate for the user is not valid and resulted in a failed smartcard logon. please contact the user for more info about the cert theyre attempting to use for smartcard logon. The chain status was revocation function was unable to check revocation for the certificate.

try to bypass on VDA, as a test: To isolate the problem to the Certificate Revocation Check, create the following registry key on the VDA. Note: This key should be deleted once the actual issue is resolved HKEY_Local_Machine\System\CurrentControlSet\Control\LSA\Kerberos\Parameters Value Name: UseCachedCRLOnlyAndIgnoreRevocationUnknownErrors Value Type: DWORD Value Data: 1

I tried this already. Not even a single time CRLs are accepted. so on the VDA there are no cached CRLs. Tried it again now, still it fails

that's tough; all i have is this article to review: Troubleshoot Windows Logon issues | Federated Authentication Service