What was that new Citrix preview feature again, that let you boot up machines ahead of time and log them in automatically for the users? I'm thinking about how I could leverage this when I deploy a new master image (as there are lots of customization features that run at first logon to an updated image that often take quite a while, and it would be cool to get them done automatically).

This? https://community.citrix.com/tech-zone/learn/poc-guides/citrix-session-remote-start/

Anyone know how it handles the storing of the usernames and passwords? Now that the CTP program is gone haven't gone anyone on the inside to ask 😞

dont believe creds are actually entered, just the UPN. The 3rd party system (Badge Reader, Mobile App, Windows script) sends an API call to the Session Remote Start role server, and that servers talks to FAS/Storefront to "prelaunch" the requested resource.

I thought it logged the damned thing in and then disconnected the session? So the user already has a disconnected session ready to connect to? Surely for that it must need creds?

So it has to know the password for the user then somehow, surely?

one would think...or is it some kind of FAS/Smart Card black magic 😉

Hmmm.

would def like to see more of a deep dive on the internal workings

Agreed. Let's raise that up in the next CTA/CTP meeting or ask in Citrix Slack............oh

Hey @James Rankin, you still have my contact details.. feel free to reach out to me if you have any questions

So how does SRS authenticate? Does it have access to user's details or can it simply kind of run a session and "assign" it to the user?

It relies on the FAS to authenticate on behalf of the users

So treat me like an idiot here - there's no need for it to know any usernames or passwords, it can effectively start a session for a user without knowing their creds? (And then potentially have access to their stuff?)

In a sense, yes. You just tell SRS "this user must launch this resource at that time" and it will do it on his behalf at said time. It will talk to the FAS to open the session on target VDA and then disconnect the session. Technically, they could impersonate the user and "steal" the session yes.

How much grief did you get from infosec getting that into production then?

Technically, you can already do that without SRS by getting access to the FAS, which we already have because of DaaS. Then SRS, for now, is not a cloud feature. You need a storefront (no matter you're a DaaS customer or not). It's all about hardening that server well enough to please the sec guys.