After a Citrix Engineer configured FAS and SAML in a Citrix Virtual Apps and Desktops site, the Virtual Delivery Agent (VDA) machine requests the…

In a Citrix environment using Federated Authentication Service (FAS), the Virtual Delivery Agent (VDA) is responsible for logging the user into the Windows session. After the user authenticates to StoreFront/Gateway via SAML, the VDA contacts the FAS server to retrieve a short-lived user certificate. The FAS server, having previously obtained this certificate from Active Directory Certificate Services on the user's behalf, provides it to the VDA. The VDA then uses this certificate and its corresponding private key to perform a smart card-based authentication, seamlessly logging the user into their Windows session without requiring them to re-enter credentials.

A. The VDA requires a user certificate for logon, not a server certificate, and it retrieves it from the FAS server, not directly from Active Directory Certification Services.

C. The VDA requires a user certificate, not a server certificate. The Delivery Controller brokers the connection but does not issue or store the logon certificate.

D. The VDA communicates with the FAS server to obtain the logon certificate. The FAS server is the component that interacts with Active Directory Certificate Services, not the VDA.

1. Citrix Product Documentation. (2023). Federated Authentication Service (FAS) - Technical overview. Citrix Docs. Retrieved from https://docs.citrix.com/en-us/federated-authentication-service/current-release/technical-overview.html

Reference Point: In the "Architecture" section, the diagram and accompanying text (specifically steps 7 and 8) state: "When the user connects to the VDA, the VDA contacts the FAS server... The FAS server provides the VDA with a certificate that can be used to log on the user." This directly confirms the VDA requests the user's certificate from the FAS server.