This message was deleted.

https://www.deyda.net/index.php/de/2021/12/21/saml-authentifizierung-zwischen-citrix-microsoft-mit-azure-mfa/#Troubleshooting Maybe this helps

So we saw this error before, but honestly I THINK it was a red herring we chased for no reason. We had some persistent desktops that would log a user off and you would see this event. We investigated FAS, the GPOs, SF, VDA side--and couldn't find any correlation. in a nutshell, we weren't having issues with any other xendesktops, so we noticed the error (VDA side) came right after the session was terminated. So I wonder if that error is a bug / not meaningful.

Could it be something like this. The error implies that the VDA cannot talk to the FAS serverhttps://rakhesh.com/citrix/s104-identity-assertion-logon-failed/

Is the vda and the storefront in the right groups on the fas. Do u test it with set the groups to domain computers. So no machine are excluded ?

Yes, I checked that. It's Domain Computers and Domain Users. And StoreFront seems to correctly authenticate with FAS.

Are u define the gpo and set it to the vda and sf server ?

Yes, GPO is applied to both the VDA's and the SF servers.

Is the vda trying to connect to the FAS server you expect. The GPOs are just to tell the different systems which servers to connect to. FAS does keep an index of the servers and if the index is nto the same between the vda and storedront you can get errors but not this one.

Yes, the event shows one of the FAS servers I specified in the GPO.

Do you have a firewall between the VDAs and FAS servers?

No, but the FAS servers are in a different subnet so the traffic is routed. I asked them to check with the networking department. Thanks for the link you sent earlier by the way.

Do a tracert from the VDA to FAS to see how far it goes. But if Port 80 is open, that is strange its through a Access Denied error. Nothing in the FAS event Logs?

That's the annoying thing. If it's an access denied, you would expect an error on the FAS side. But there isn't.

You can do it from the VDA if you have access

If the VDAs cant get to the FAS sever there woudnt be an error on teh FAs servers

He said Port 80 is open from FAS to the VDA right? I see it above. I assume he checked that and verified it's open. The Error message above is because the VDA can't fetch the Cert from FAS. Which I know you know the Rob, because you're the man at Citrix. 🙂

But if it's an access denied, where do I need to provide access? And if there was a firewall or routing problem you would expect the 'no endpoint listening' error (https://support.citrix.com/article/CTX269399).

I've fixed this when adding the VDAs and Cloud Connectors, Storefront Servers Computer AD Account to the Windows Authorization Group in Active Directory

You mean the VDA group defined in FAS?

No. In Active Directory you can find this ad group

It seems a colleague of mine solved it. The Delivery Controllers and the VDA's had the same FAS servers in registry, but in a different order. Even though they both receive the same GPO. When correcting the order it worked again.

No, the client had 2 policy's in place. In one, address1 corresponded to server1 and Address2 to server 2. In the other policy it had address1 to server 2 and vice versa.