This message was deleted.

Okta has a way to i integrate with the ADC to pass credentials to Storefront so you can not have to use FAS. But if you want to use Storefront directly you will need FAS. If you are interested in the Okta approach I can post their doc. Of course FAS is the Citrix way to do it.

tnx, interested in the doc indeed (only access we consider at this stage is OKTA-Netscaler -> storefront -> VDA)

Here you go. For the Citrix way just look up FAS documentation using generic SAML

You can do it without FAS, it does have some quirks though.

@Mike Streetz (O_P) those "quirks", is that supported (suppose you refer also to the saml & ldap binding) as mentioned in the pdf from @Rob Zylowski?

Yes the password is passed through to storefront by the netscaler so there us no prompt

FWIW, FAS as not as... scary/fragile as it has been in the past.

the quirks are around trying to support more than 1 domain, UPN stuff, use of cookies to set up some of the pasthrough auth and those cokkies not getting removed when they should

Yes... stale cookies is definitely a quirk that requires add'l Help Desk training (training them to selectively delete cookies vs nuking a user's browser cookie storage all at once).

It doesn’t hep that if you’re using workspace app not even a reinstall will clear those cookies

so, the way-to-go would be FAS anyway ?

Yes, it will be a better experience all round.