Which two components directly communicate with each other during the process of resource launch, when Federated Authentication Service (FAS) is used?…

During a resource launch using the Federated Authentication Service (FAS), two critical and direct communication paths are established. First, the Delivery Controller contacts the FAS server to request a user certificate and receives a logon ticket (a handle to the certificate). This ticket is then passed to the Virtual Delivery Agent (VDA) during session brokering. Second, the VDA directly communicates with the FAS server, presenting the logon ticket to retrieve the user's certificate and private key. The VDA then uses these credentials to log the user into the Windows session, completing the single sign-on process.

A. Certificate Authority and Domain Controller: While the Certificate Authority queries the Domain Controller during certificate issuance, this is an underlying infrastructure process initiated by the FAS server, not a direct communication between primary Citrix components in the launch sequence.

C. FAS Server and Citrix ADC: The Citrix ADC handles the initial user authentication and communicates with StoreFront. It does not communicate directly with the FAS server; this interaction is brokered by StoreFront and the Delivery Controller.

1. Citrix Product Documentation, Federated Authentication Service, Architecture overview.

The "Detailed overview" section and accompanying diagram illustrate the communication flow. Step 6 describes the Delivery Controller (acting as a proxy for StoreFront) contacting the FAS server. Step 8 explicitly states, "The VDA contacts the FAS server to redeem the ticket and get the certificate." This confirms the direct communication paths between Controller-FAS and VDA-FAS.

Source: https://docs.citrix.com/en-us/federated-authentication-service/current-release/fas-architecture-overview.html

2. Citrix Tech Zone, Reference Architectures, Citrix Federated Authentication Service.

The "How FAS Works" section provides a sequence diagram and explanation. It states, "The Citrix Virtual Apps and Desktops Delivery Controller... authorizes the FAS server to generate a certificate for the user..." and "The VDA communicates with the FAS server to retrieve the certificate and private key and log the user on to the session." This directly supports the selection of both B and D as correct answers.

Source: https://docs.citrix.com/en-us/tech-zone/learn/reference-architectures/fas.html