https://worldofeuc.com logo
Join Slack
Powered by
Super dumb question, but is there another way to d...
# citrix-vad
n
Super dumb question, but is there another way to disable Citrix FAS from a VDA directly? Disabling FAS via GPO seems to work, but we're seeing weird results trying to set a default logon domain that is only resolved when we rename or delete the Citrix credential provider helper.
r
Removing the registry setting?
n
Removing HKLM:\SOFTWARE\Policies\Citrix\Authentication doesn't resolve it, unless there is another registry key.
h
Why not disable it at the source? StoreFront.
n
Need to only target specific VDAs because of this awful use case we're implementing. Can't do it from SF.
j
put the specific VDAs in a sub OU, and configure a FAS GPO with no servers in the setting (if previously configured replace with a space to the main index.). If the VDA fails FAS lookup it should fall back to username/password.
👍🏼 1
n
Testing that now. FWIW, the default domain is listed just fine if you check the local console in VMware, so it's definitely only the Citrix desktop launches that are affected.
No luck, same result even with a blank FAS server listed
j
hmmm, what version of FAS are you on?
h
Otherwise new store and fas disable that one?
n
Legit have no idea. Trying to get the team that manages that in IMs but having no luck. I don't have access to it myself.
New store was an earlier suggestion but they're not interested in entertaining it. I know...
If this is how it'll work until the users' identities are migrated, so be it. Just driving me nuts that this worked last week and now it doesn't, with no changes on my end of things.
j
after blanking out the GPO, can you confirm that this path is empty on the VDA? HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Citrix\Authentication\UserCredentialService\Addresses
n
Yep, that key is empty
h
AFAIK if FAS is enabled on the store and the gpo isn't landing you'll get the awful not supported message or the username password box
It's still a smartcard logon it's expecting so it’s really yuck
n
We're definitely getting the username/password box, which is intended for this instance. It's just causing an issue where the default domain is showing "Sign in to:" (blank) instead of "Sign in to: DOMAIN" (where DOMAIN is the configured domain in the 'Assign a default domain for logon' GPO)
h
Got it, and if you try it with FAS disabled on the store it works?
Or is that also not allowed?
n
Haven't tried that because they don't want to go that route. This is really only a temporary thing
h
Okay, I think it's expected when it’s enabled tbh
✅ 1
The policy for the vda is more the these are my trusted fas servers to use, believe there is some flow chart for this
n
The flow chart for this current config leads directly to an unflushed toilet
🔥 1
j
they also made a change on FAS 25511 that changed the ticket type from v1 to v2, and v2 doesn't even use the registry list anymore.
h
Exactly
n
I'm waiting for the FAS guy to reply to my chain to get that info.
j
I think you are stuck with.... if FAS it enabled on the store, then it will leverage FAS, and attempt smart card logon, if the logon fails because the list isn't approved, then it will fail the logon window and leave it at a username/password prompt but not identify the domain.
h
And another exactly
j
I believe Citrix would say... to isolate VDAs from FAS, you need to have them accessible from a non-FAS enabled Storefront Store.
n
I just don't get how this worked all of last week. I even have screenshots proving I'm not crazy
j
I'd wager your user smartcard certs are set for a 7 day expire
h
Where my thoughts as wel what is the validity for the certs and crl/ocsp
✅ 1
n
Definitely adding all of this to the list of stuff to check, and appreciate all of the info!
h
It's a triangle of KCD and VDA in flow with the I'm not really a user with a password but getting transformed to a ticket
CITRIX FAS LOGON FLOW A. Store authentication a. User opens Workspace app or browser (optionally via Citrix Gateway) to the StoreFront store. b. User signs in at the IdP (SAML / Entra ID / Okta / smart card). No AD password is collected. c. StoreFront (FASClaimsFactory + FASLogonDataProvider) asserts the user's UPN to FAS over Kerberos. FAIL: store not FAS-enabled -> logon box a. FAS checks its rule: StoreFront server and user permitted. FAIL: rule denies / FAS unreachable -> logon box a. FAS (enrollment agent) requests a smart card logon cert from the Microsoft CA. Private key stays on FAS. FAIL: authorization cert expired, template or CA issue -> logon box B. Resource launch a. StoreFront sends the launch to the Delivery Controller including the FAS ticket. b. ICA file returned: LaunchReference, LogonTicket (CTXS1), STA ticket. No credentials. c. Workspace app connects HDX to the VDA (1494/2598 or Gateway 443). C. Windows logon on the VDA a. VDA pulls launch data from the Broker and reads FAS servers from the GPO. FAIL: GPO missing or server order differs from StoreFront -> logon box 1. VDA retrieves the user certificate from FAS (Kerberos, VDA machine account). FAIL: VDA not in rule, port 80, SPN or time skew -> logon box 1. Citrix virtual smart card presented to Windows. 2. Kerberos PKINIT to a DC: chain in NTAuth, valid DC cert, UPN match -> TGT. FAIL: DC rejects certificate -> logon box 1. Profile loads, desktop ready. No logon box shown. FALLBACK Any failure leaves the VDA with no password and no certificate. Windows shows the standard prompt: user name + password, with no domain / NetBIOS "Sign in to" line, because a FAS store only knows the user's UPN. Treat this as a FAS fault, not a password problem.
👍 2
s
If it helps you can set this to force password prompts: fPromptForPassword -> HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services -> 1
j
I wonder if flipping the Delivery Group to the Entra ID SSO would work, since that disables FAS. Would have to have a dedicated delivery group for it.
n
Oddball question, but any chance trying to run this config where FAS is enabled with servers listed in one GPO and disabled in a higher priority one and it causes something in Citrix to restart the VDA? We're seeing weird behavior where a restart command is being sent to these VDAs and can't figure out where it's coming from. Preceding these events is a FAS error (which we also see numerous times).
I'm sure it's just a coincidence but figured it was worth asking.
3 Views
Open in Slack
PreviousNext
Powered by