Access, authentication and the launch path
A useful access design separates authentication, resource enumeration, brokering and the eventual HDX connection. They are related stages with different components and failure modes. In an on-premises deployment, StoreFront presents resources obtained through the delivery infrastructure, a Delivery Controller brokers a suitable registered VDA, and Workspace app establishes the session connection using the returned launch information. External access can use NetScaler Gateway to secure the connection path. In a cloud-managed design, identify which Workspace and Gateway services are actually used.
Draw the control and session paths
The Controller is not a permanent relay for every screen update. Once established, the HDX data path depends on the selected internal, Gateway or cloud-service architecture. StoreFront and Controllers remain important for enumeration and brokering, but they are not interchangeable with the VDA that runs the application. Cloud Connectors provide communication between the Citrix cloud service and resources; do not assume they always render or relay the user's desktop. Rendezvous is one supported design in which the VDA connects directly to the Gateway service for session traffic.
Identity is not a single checkbox
Choose authentication according to the required identity source, trust, MFA, user population and supported integration. A successful SAML authentication does not itself hand a Windows password to the VDA. FAS can provide certificate-based VDA single sign-on in a supported design when those credentials are unavailable. Its trust, certificate services, authorization and participating components need deliberate configuration and protection. It is not a general grant of unlimited access or a substitute for deciding which resources the user may launch.
Secure authorization and traffic
Use least-privilege resource assignments and delegated administrative roles/scopes. Directory group changes must be interpreted with token refresh, application authorization and existing-session behaviour in mind; removing membership does not guarantee instantaneous termination of every active session. Restrict administrative and resource traffic according to documented dependencies, without assuming that encrypting one hop secures all other hops. Verify certificates, names and trust for the selected connections.
Diagnose the stage that failed
If authentication succeeds but enumeration is empty, examine entitlement, resource configuration and the enumeration path. If a VDA is unregistered, investigate its discovery, name resolution, authentication, services and communication with Controllers. A StoreFront XML transport setting is not the same thing as VDA registration configuration. Correlate timestamps and component evidence, scope diagnostic collection to the affected case and protect sensitive logs. Changes should follow a tested design rather than broad unverified production adjustments.