# APM SAML CITRIX Stroefront **URL:** \ **Category:** Technical Forums\ **Tags:** big-ip-access-policy-manager-apm, application-delivery\ **Created:** [September 30, 2020, 6:14pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778 "2020-09-30T18:14:01Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [September 30, 2020, 6:14pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/1 "2020-09-30T18:14:01Z")
Using APM as SAML SP with external Idp connector ADFS. Followed this article [https://devcentral.f5.com/s/articles/citrix-federated-authentication-service-integration-with-apm-24489:](https://devcentral.f5.com/s/articles/citrix-federated-authentication-service-integration-with-apm-24489:) F5 is passing the logonpage to ADFS but not able to pass SSO to Storefront. APM logs show " Could not find SSO username, check SSO credential mapping agent. ---
**Author:** ![boneyard](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/boneyard/32/20419_2.png) [@boneyard](https://community.f5.com/u/boneyard)\ **Post date:** [October 4, 2020, 12:38pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/2 "2020-10-04T12:38:41Z")
can you confirm session.saml.last.nameIDValue i assigned the correct value? ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [October 6, 2020, 5:21pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/3 "2020-10-06T17:21:28Z")
yes it does. Its the the username I used to login. ---
**Author:** ![boneyard](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/boneyard/32/20419_2.png) [@boneyard](https://community.f5.com/u/boneyard)\ **Post date:** [October 10, 2020, 9:26am UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/4 "2020-10-10T09:26:33Z")
weird, does the storefront side show something useful, like the username or a hint on a bad password? ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [October 12, 2020, 4:22pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/5 "2020-10-12T16:22:19Z")
It does not go that far. After authenticating at ADFS page , the next page it lands is the storefront logon page with the username in the username field and empty password. It seems as if , its waiting on use to enter the pwd and click LOGON. ---
**Author:** ![boneyard](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/boneyard/32/20419_2.png) [@boneyard](https://community.f5.com/u/boneyard)\ **Post date:** [October 19, 2020, 12:11pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/6 "2020-10-19T12:11:39Z")
most likely because it doesnt appear to the have the username ready, but that is difficult to check via a questions section like this, i would engage F5 support by now. easier to check things for them in a live enviroment. ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [October 19, 2020, 12:37pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/7 "2020-10-19T12:37:34Z")
Thank you yes , I support is involved but they are unable to determine where the problem is. I am not a SAML expert but from what I know, SAML just passes or should pass a token to the citrix storefront. I cannot see where the disconnect is. ---
**Author:** ![boneyard](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/boneyard/32/20419_2.png) [@boneyard](https://community.f5.com/u/boneyard)\ **Post date:** [October 19, 2020, 12:46pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/8 "2020-10-19T12:46:50Z")
i saw another question which triggered something. which SSO method are you using currently? because if you get a username and password login that will logically fail i believe. you dont pass on the SAML assertion, that gets accepted by big-ip which then has to do passwordless SSO i believe, so Kerberos for example. ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [October 19, 2020, 12:50pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/9 "2020-10-19T12:50:36Z")
the goal is to use SAML and my APM looks like this. ![image_248107.png](https://d20hrnpixdzcsd.cloudfront.net/original/3X/9/f/9fd66c295c36057d0f488bac612eac0ba8c2a18f.png) ---
**Author:** ![boneyard](https://d1p9zq3aats0t8.cloudfront.net/user_avatar/community.f5.com/boneyard/32/20419_2.png) [@boneyard](https://community.f5.com/u/boneyard)\ **Post date:** [October 19, 2020, 1:04pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/10 "2020-10-19T13:04:44Z")
yeah, sorry got confused, you did configure your Citrix Federated Authentication Service (FAS) as described at the start of the article you link at the start? ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [October 19, 2020, 1:07pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/11 "2020-10-19T13:07:49Z")
Yes, its configured. But it only comes into picture when the user attempts to launch an app after successful SSO’ing to storefront. In my case, the SSOing is not happening from F5 APM to Storefront. ---
**Author:** ![dromerot](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dromerot](https://community.f5.com/u/dromerot)\ **Post date:** [December 15, 2020, 10:49am UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/12 "2020-12-15T10:49:24Z")
Hi Dathi, Have you able to pass SSO to Storefront? I don’t see any traffic from APM to Storefront. Only health check traffic. I see the log “Following rule ‘fallback’ from item ‘Session Variable Assign’ to ending ‘Allow’” but I don’t see any packet from APM to Storefront. However, I can see the right SAML Assertion and the right username got from IdP in the APM. Thanks, best regards. ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [December 15, 2020, 12:49pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/13 "2020-12-15T12:49:30Z")
No, actually, it stands as is. F5 tech support was not able to determine the flow or the bottleneck. I am still looking for answers. ---
**Author:** ![dromerot](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dromerot](https://community.f5.com/u/dromerot)\ **Post date:** [December 15, 2020, 3:11pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/14 "2020-12-15T15:11:43Z")
Hi Dathi, Thanks. On the other hand, I see an iRule in the Virtual Server, which has been added automatically with the iApp and I don’t know if I have to delete it. I’ve read in the link you posted “12/21/2016 - Removed an iRule that is not needed for SSO to function properly in a complete deployment”. Maybe we have to delete this iRule! I don’t know! Thanks, best regards. ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [December 15, 2020, 3:14pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/15 "2020-12-15T15:14:24Z")
There wasn’t any irule set automatically. ---
**Author:** ![dromerot](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dromerot](https://community.f5.com/u/dromerot)\ **Post date:** [December 16, 2020, 11:14am UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/16 "2020-12-16T11:14:38Z")
OK Dathi, I’ve deployed the iApp Citrix VDI 2.4.6 and it set an iRule automatically to the Virtual Server. It is this one: ![image_248114.png](https://d20hrnpixdzcsd.cloudfront.net/original/1X/64535e2509e5a2e91ad97d318ca048d589c246d7.png) ---
**Author:** ![Dathi](https://avatars.discourse-cdn.com/v4/letter/d/3e96dc/32.png) [@Dathi](https://community.f5.com/u/Dathi)\ **Post date:** [December 22, 2020, 2:03pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/17 "2020-12-22T14:03:42Z")
Yes, I see this as well but removing this has also not helped. ---
**Author:** ![dromerot](https://avatars.discourse-cdn.com/v4/letter/d/a698b9/32.png) [@dromerot](https://community.f5.com/u/dromerot)\ **Post date:** [May 17, 2021, 12:52pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/18 "2021-05-17T12:52:49Z")
Hi Dathi, Did you manage to pass SSO to Storefront? I think, we have to send “session.saml.last.nameIDValue” to STF but I don’t know if we have to send it via HTTP Header or POST. Thanks, best regards. ---
**Author:** ![Tinkerer](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tinkerer](https://community.f5.com/u/Tinkerer)\ **Post date:** [September 25, 2021, 12:57am UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/19 "2021-09-25T00:57:53Z")
I was wondering the same thing. We’ve run into the same issue. Thanks. ---
**Author:** ![Tinkerer](https://avatars.discourse-cdn.com/v4/letter/t/f14d63/32.png) [@Tinkerer](https://community.f5.com/u/Tinkerer)\ **Post date:** [October 19, 2021, 5:30pm UTC](https://community.f5.com/t/apm-saml-citrix-stroefront/55778/20 "2021-10-19T17:30:26Z")
We are having the same issue. [Next page](https://community.f5.com/t/apm-saml-citrix-stroefront/55778.md?page=2)