This message was deleted.

This guide is better: https://www.carlstalhood.com/citrix-director-1912-ltsr/#directorsson Worked for me like a charm

I am not doubting that for a second :D

Carl’s instructions are correct, but Director seems to have a bug with SSO, when using anything other than hostname to access it from another computer. If you do get it working using a different FQDN, from another computer, please advise? The Citrix instructions leave out the SPN (even though they correctly advise enabling delegation on the machine account when using the default of kernel-mode auth). Their advice to enabled credential forwarding for all of Trusted Zone is also awful - that’s what we have Intranet Zone for.

@Nathan Shaw did you create the SPN on that DNS record like director.company.com instead of server.company.com?

Oh yes, symptoms are not those of an incorrect SPN. Do you have a working config you could share?

I cannot get SSO to work with Carl's instructions. I am currently testing on 1912, and no matter what I do, I end up on the "default" user/password/domain page. I also see this warning in IIS:

Warning can be ignored. You’ll need an SPN that matches the hostname you are browsing to. The SPN goes against the computer account in AD unless you are using a separate user account in the app pool AND have kernel mode authentication disabled, in which case it does against that user account. Whichever account hosts the SPN needs delegation enabled in the AD object. That tab only visible against a user once an SPN added to it.

I am testing with a load-balanced scenario, where I am accessing Director on a https://director.domain/director I have configured the service account in IIS as per the instructions in Carl's article. Kerberos delegation has also been configured on the director service account

That is the bug that Carl refers to - it just doesn’t seem to work from another machine. I have seen (brief) claims of people making it work, am yet to see a working config. I’ve spent many years doing SPNs, have tried all sort of weird and wacky things to try to get this scenario working. No luck yet :-(. Only thing that works off-host for me, is using the computer’s FQDN. Not much help if load-balancing Director, but does it really need it?

Hmm..how about using another browser than IE?

@Rody Kossen sounds like might have a working system - you using vanity URL / load balancing?

Yes load balancing via ADC. Let me check the differences

@Kasper Johansen absolutely, just slightly more involved in getting credential pass through.

Yay, it works with the director server hostname now, via IE

Yes. Even if I cut out the LB, and just try any URL that isn’t the server name, from a different computer. Fails.

Well that's just great. Most setups I have encountered have load-balanced Directors, it's fairly easy to setup via Citrix NetScaler

I could see this working if a LB can do the auth. Like the old ISA/TMG, then it connects to each node using FQDN thus the SPNs are correct.

Is that possible with Netscaler?

I suspect so, never done it (my NS not used for internal).

i got a blog on it all you need https://c4rm0.wordpress.com/2019/02/14/load-balance-citrix-director-on-netscaler-and-configure-sso/

Nice Article