I85PREP
⌘ K
Citrix CC-VAD-CC study materials
Citrix CC-VAD-CC study resources

Citrix CC-VAD-CC: Security, Authentication, and Access Control

Citrix CC-VAD-CC · Work through your exam, one topic at a time.

All guide sections

Security, Authentication, and Access Control

Layered model

Edge and network: Citrix Gateway (ADC) terminates TLS, runs EPA scans and issues STA tickets to the controllers. Authentication: LDAP/RADIUS, SAML to an identity provider, certificates, or nFactor chains. Authorization: delivery group access policies and SmartAccess filters. Session: TLS at the Gateway, ICA encryption, HDX adaptive transport. Image: hardened master, patched VDA, no local admin for users, antivirus exclusions for write caches and profile containers.

Federated Authentication Service

FAS solves the double-hop problem: StoreFront authenticates the user (for example via SAML to Entra ID), but the VDA still needs a Windows logon. FAS issues a short-lived certificate to the user after federated authentication, so the VDA performs certificate-based logon. It requires a Microsoft Enterprise CA, a FAS server, a certificate template, and trust configured between StoreFront and FAS. Without it, users authenticate twice or fail at the VDA.

SmartAccess

A Gateway session policy applies an EPA scan result; StoreFront forwards it; Studio access policies and Citrix policy Access Control filters consume it. Typical design: allow the contractor delivery group only when Access Control matches the compliant Gateway filter, and do not create an unfiltered allow rule for that group.

Certificates and hardening

SANs must include every name clients type; use TLS 1.2 or later; keep private keys non-exportable; replace default self-signed controller certificates when StoreFront connects over HTTPS to the XML service. Delegate Studio administration rather than handing out domain administrator rights.

Worked example. Contractors access published apps only, from unmanaged devices. Gateway with SAML and MFA; FAS for VDA logon; an access policy on the apps delivery group filtered to the Gateway/SmartAccess condition; no desktop entitlement; clipboard and drive redirection disabled by a filtered Citrix policy. Each control covers a different layer, so removing one leaves a gap.

Traps

  • Assuming StoreFront authentication also logs the user on to the VDA.
  • Publishing ICA or XML ports directly to the internet "because it works".
  • A certificate that omits a name clients use, breaking trust before authentication begins.
  • Granting users local administrator on multi-session hosts to work around an application.