What’s a Double-Hop, and why use it?

A double-hop scenario is when you start a published app from other resources within your published desktop. An example:

You have an app that doesn’t support the OS you would like all users to have. In most situations, this will be Windows Server 2019 for multi-session purposes. The one app that you would like users to open is a legacy app and only supports Windows 2012 R2 as the latest supported OS. As your organization states that you only work with supported configurations, you can’t install this app on Windows 2019. To ensure the user can access the app, you create a dedicated delivery group based on Windows 2012R2 VM’s and use this delivery group to give users access to the app. Those users start this app within their published desktop as a seamless app and don’t notice if they are local or remote.

The above scenario is called a double-hop. As a company, you could have many reasons to use this scenario. Think about:

The app is for archive only;

The app doesn’t support the same OS as the desktop (mentioned in the example);

The app has conflicts with other apps;

The app can only be used by some users, and licenses don’t allow us to install it on the same image as the desktop.

Challenges when using double-hop with Azure AD as IdP

When you sign on to Citrix Cloud with your Azure and open your published desktop, your on-premises environment uses Federated Authentication Services (FAS) to sign on to the VDA. Look at the below diagram to see how FAS is working (thanks to Daniel Feller (https://virtualfeller.com/)).

When you would like to have SSO from your published desktop to Citrix cloud, it’s only possible to use Azure Active Directory Seamless Single Sign-On or using an on-premises StoreFront environment that supports FAS authentication. Azure seamless SSO requires the use of Pass-through Authentication (PTA) or password hash synchronization. The customer where I’m currently implementing CVAD services is transitioning to Azure AD, and they don’t have seamless SSO enabled. That’s the reason we need to use another option to create the double-hop scenario. The only other option, as mentioned, is to install an on-premises StoreFront that supports FAS authentication.

Configuring StoreFront and FAS

In this example, I only have one StoreFront server and one FAS server to keep this guide simple. Below you could see how the authentication is working using a double-hop scenario.

StoreFront & FAS

After you installed and configured StoreFront, we configure it to allow FAS as an authentication method.

First, enable FAS support on your Store, change “/Citrix/Store” to your store name:
Get-Module “Citrix.StoreFront.*” -ListAvailable | Import-Module
$StoreVirtualPath = “/Citrix/Store”
$store = Get-STFStoreService -VirtualPath $StoreVirtualPath
$auth = Get-STFAuthenticationService -StoreService $store
Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName “FASClaimsFactory”
Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider “FASLogonDataProvider”
Secondly configuring the Delivery Controllers
Click Manage Delivery Controllers
Usually, you would add your On-Premises Delivery Controller here, but now you need to add the Cloud Connectors here. You need to use port 80 (HTTP) and can’t use 443 (HTTPS) as a transport type.
Set Authentication Methods
Click Manage Authentication Methods
Enable Domain Pass-Through
Set the GPO Federated Authentication Service
As FAS is already working, the ADMX files are probably in the PolicyDefinitions central Store, so I skip the step to copy these ADMX files. For the StoreFront server, configure a GPO, so it knows which servers are FAS servers.Open the GPO and navigate to Computer Configuration/Policies/Administrative Templates/Citrix Components/Authentication
Edit the Federated Authentication Service
configure the DNS addresses of your FAS servers
Perform a gpupdate /force to make sure the GPO is applied.
As FAS is configured to access your VDA, we only need to change the rule you use for FAS.
Open the FAS Administration Console and go to the tab rules
I only have 1 rule named “Default” click on the Pencil to edit the rule.
Go to Access Control
Click Manage StoreFront access permissions
Here you add the Computer account of your StoreFront server.
Make sure you remove the default “Domain Computers” as that one denies access.
Click OK
Now click Apply, and your FAS configuration is ready for testing.

Testing

After you configured all the settings as described above, It’s time to test the configuration.

When you sign in to your published desktop, your Citrix workspace app (when configured correctly) is signing in to the StoreFront site, and you could start an app that’s published from your start menu. Please try, and let me know if this is working.