It does not go that far. After authenticating at ADFS page , the next page it lands is the storefront logon page with the username in the username field and empty password. It seems as if , its waiting on use to enter the pwd and click LOGON.
most likely because it doesnt appear to the have the username ready, but that is difficult to check via a questions section like this, i would engage F5 support by now. easier to check things for them in a live enviroment.
Thank you yes , I support is involved but they are unable to determine where the problem is. I am not a SAML expert but from what I know, SAML just passes or should pass a token to the citrix storefront. I cannot see where the disconnect is.
which SSO method are you using currently? because if you get a username and password login that will logically fail i believe. you dont pass on the SAML assertion, that gets accepted by big-ip which then has to do passwordless SSO i believe, so Kerberos for example.
yeah, sorry got confused, you did configure your Citrix Federated Authentication Service (FAS) as described at the start of the article you link at the start?
Yes, its configured. But it only comes into picture when the user attempts to launch an app after successful SSO'ing to storefront. In my case, the SSOing is not happening from F5 APM to Storefront.
Have you able to pass SSO to Storefront? I don't see any traffic from APM to Storefront. Only health check traffic. I see the log "Following rule 'fallback' from item 'Session Variable Assign' to ending 'Allow'" but I don't see any packet from APM to Storefront.
However, I can see the right SAML Assertion and the right username got from IdP in the APM.
Looking for assistance on this as well. We are currently testing AzureAD SAML to our APM (which works) but now we would like to login to our citrix enviornment. doesnt matter if it is f5 webtop or storefront. I have even setup FAS (which works internally). I just cannot figure out how to authenticate to our CItrix environment. Any guidance would be appreciated.
I opened a ticket with Citrix and they claim that F5 as SAML idp will not work with storefront. But I am still not convinced. There may be other people who might have got it working.
