Citrix Federated Authentication Server (CFAS) Monitoring
The Citrix Federated Authentication Service is a privileged component designed to integrate with Active Directory Certificate Services. It dynamically issues certificates for users, allowing them to log on to an Active Directory environment as if they had a smart card. This allows StoreFront to use a broader range of authentication options, such as SAML (Security Assertion Markup Language) assertions. SAML is commonly used as an alternative to traditional Windows user accounts on the Internet.
The following diagram shows the Federated Authentication Service integrating with a Microsoft Certification Authority and providing support services to StoreFront and XenApp and XenDesktop Virtual Delivery Agents (VDAs).
Figure 1 : How CFAS integrates with Microsoft Certification Authority
Trusted StoreFront servers contact the Federated Authentication Service (FAS) as users request access to the Citrix environment. The FAS, in conjunction with Microsoft Certification Authority, grants a ticket that allows a single XenApp or XenDesktop session to authenticate with a certificate for that session. When a VDA needs to authenticate a user, it connects to the FAS and redeems the ticket. Only the FAS has access to the user certificate’s private key; the VDA must send each signing and decryption operation that it needs to perform with the certificate to the FAS.
If the Certification Authority (CA) is inaccessible, then Citrix FAS will not be able to acquire the Authorization Certificate from the CA for issuing user certificates. This can result in user logon failures, which may cause users to be denied access to critical resources in the Citrix environment. Likewise, if Citrix FAS consistently takes too long to sign certificate requests, it is bound to delay user authentication; this can permanently damage user experience with Citrix. To avoid such unpleasant outcomes, administrators should closely track the availability of and the load on CFAS, the status of certificates it manages, and its interactions with the Certification Authorities, and proactively detect abnormalities. This is where eG Enterprise helps!
eG Enterprise supports monitoring of CFAS. With the help of eG Enterprise, you can continuously monitor the availability state and operational health of CFAS. You can thus keep an eye out for deviations in the status and operational health of the CFAS and be alerted to such deviations before end-users notice.
This
