This message was deleted.

If you don’t have a fas Server, you can still see the storefront Apps and desktops after the authentication.

Ok, thanks. That is what I got out of reading the documentation, but I haven't made it that far yet .. ha.

Thanks for that blog post it has definitely helped! Right now I am stuck at upon logging in, Storefront is telling me it cannot complete request... i'll go through it again.

if you have any further questions. just write me a dm

yeah, "Cannot complete request" generally means your first stop should be the event logs on storefront. You should see two event logs, one generic "logon failed" error and then another entry immediately before it that should tell you what actually went wrong.

Without FAS it should pass you through to Storefront, just when you go to launch an app you'll be prompted to logon again as the XA resource won't be passed the correct creds

So I see this one first, CitrixAGBasic single sign-on failed because the credentials failed verification with reason: Failed. and below that it lists my UPN account that tried to logon

Have you cleared the single sign on Domain in the netscaler Session Profiles ?!

The remote server returned an error: (403) Forbidden. Url: https://127.0.0.1/Citrix/MainAuth/CitrixAGBasic/Authenticate ExceptionStatus: ProtocolError

I have cleared that out

That doesn't seem right, it's not using the hostname for local requests? the TLS cert common name would definitely mismatch in that case

Callback URL within storefront = the FQDN of the AG and the vServer IP address I have as the IP address of the AG.. and within the local hosts file on the storefront server I have the FQDN going to the AG IP

Yes. Only the netscaler can read the SAML token. The Windows Server can’t do anything with it 😇

ok, good I have that checked

How do u unset the sso domain in the session profiles ? Try to set the global session profile to blank.

Ok, ill try to set it as clear

Do you have Trusted Domains configured on the StoreFront side? That should be blank as well

So I've seen published apps twice so far, I got this far by telling Azure to send over SamAccountName and not the UPN. I also and then set the SSON domain in the NetScaler policy and then within Storefront trusted domains... but it doesn't work consistently.. go figure...

I had this exact error. It turned out that the client AD was hardened (multitenant on prem clients in same AD) - the issue was because there is no LDAP being passed back to storefront, the storefront server needed to read the AD UPN so that it could get the samaccountname of the same shadow account for xml lookup for application brokerage, but the storefront had no permission to get this info. the fix was to create an AD group with read rights to the clients OU and then drop the storefront's computer accounts into that group