I85PREP
⌘ K
Citrix CC-VAD-CC study materials
Citrix CC-VAD-CC study resources

Citrix CC-VAD-CC: Citrix Workspace and StoreFront Configuration

Citrix CC-VAD-CC · Work through your exam, one topic at a time.

All guide sections

Citrix Workspace and StoreFront Configuration

What StoreFront actually does

StoreFront authenticates users, enumerates their desktops and applications from the controllers' XML service, and produces the ICA file. After launch, ICA traffic no longer passes through StoreFront-it goes directly to the VDA internally, or through Citrix Gateway externally. That single fact explains most troubleshooting questions in this domain.

A store is the container users connect to: https://sf.corp.local/Citrix/Store for the native Citrix Workspace app and /Citrix/StoreWeb for Receiver for Web. Each store has an authentication service, beacons, a controller farm and optional gateways.

Configuration elements

  • Authentication: explicit username/password, domain pass-through (domain-joined devices), pass-through from Citrix Gateway, SAML, or certificate via Citrix Federated Authentication Service.
  • Farms: one entry per controller group with transport HTTP, HTTPS or SSL; list every controller.
  • Gateways: added per store with the Gateway URL, STA URLs pointing at the controllers, and the callback URL. Wrong or missing STAs produce "Cannot complete your request" at launch.
  • Beacons: the internal beacon is a URL reachable only inside the network; the external beacon (often a public site) confirms reachability. StoreFront decides internal versus external from beacon reachability, not from the URL the user typed.

PowerShell is fair game: Add-STFStoreFarm, Add-STFStoreGateway, Get-STFStoreService.

Workspace app

Users add an account with the base URL https://sf.corp.local; the client appends the discovery path. Email-based account discovery relies on DNS records published for the user's email domain plus a certificate the client trusts; without them, users must type the full store URL.

Worked example. Internal users work, external users fail at launch. StoreFront authentication succeeds, so the store URL, certificate and farm are healthy; the break is in the Gateway leg. Verify the STA list points at live controllers on port 80/443, that the callback URL matches the Gateway, and that the Gateway certificate is trusted.

Traps

  • Believing StoreFront proxies ICA traffic after launch.
  • A certificate whose name does not match the typed URL; clients reject it before authentication.
  • Configuring the Gateway on the appliance but not in the store, so external users never receive Gateway-routed ICA files.
  • Assuming pass-through from Gateway works without matching authentication settings on both sides.