citrix-storefront-deployment

This skill provides guidance for planning, deploying, and configuring Citrix StoreFront infrastructure, including store configuration, authentication setup, high availability, and security hardening.

Deployment Models

Single Server

• Suitable for small environments (<500 users)
• No built-in redundancy
• Simple management

Server Group

• 2-5 servers recommended for HA
• Servers must be within 40ms latency
• Configuration synchronized automatically
• Load balanced via NetScaler or NLB

Multi-Site

• Separate server groups per location
• Optimal aggregation and roaming
• Global Server Load Balancing (GSLB)

Sizing Guidelines

| Users | Servers | CPU | Memory |

|-------|---------|-----|--------|

| <500 | 1 | 4 vCPU | 4 GB |

| 500-2000 | 2 | 4 vCPU | 8 GB |

| 2000-5000 | 3 | 8 vCPU | 8 GB |

| 5000+ | 4-5 | 8 vCPU | 16 GB |

Prerequisites

1. Server Requirements

- Windows Server 2016/2019/2022

- .NET Framework 4.7.2+

- IIS with required role services

- Domain joined (recommended)

1. Network Requirements

- Static IP address

- DNS records (A and optionally SRV)

- Firewall rules for ports 80/443

- Access to Delivery Controllers

1. Certificates

- SSL certificate from trusted CA

- Include all DNS names (SAN)

- Proper certificate chain installed

Installation Steps

1. Install StoreFront

```powershell

# Mount Citrix ISO and run installer

# Select StoreFront role

# Default installation path: C:\Program Files\Citrix\Receiver StoreFront

```

1. Initial Configuration

- Launch StoreFront Console

- Create new deployment

- Specify base URL (HTTPS recommended)

- Configure store

1. Add Delivery Controllers

```powershell

# PowerShell configuration

$storeService = Get-STFStoreService -VirtualPath "/Citrix/Store"

Add-STFStoreFarm -StoreService $storeService `

-FarmName "Production" `

-FarmType XenDesktop `

-Servers @("DDC1.domain.com", "DDC2.domain.com") `

-LoadBalance $true `

-Port 443 `

-TransportType HTTPS

```

Store Configuration

```powershell

# Get store service

$store = Get-STFStoreService -VirtualPath "/Citrix/Store"

# Configure store settings

Set-STFStoreService -StoreService $store `

-LockedDown $true `

-AllowSessionReconnect $true

# Configure subscription store (favorites)

Enable-STFStorePna -StoreService $store `

-AllowUserPasswordChange $true

```

Authentication Configuration

```powershell

# Get authentication service

$auth = Get-STFAuthenticationService -VirtualPath "/Citrix/StoreAuth"

# Enable authentication methods

Enable-STFAuthenticationServiceProtocol -AuthenticationService $auth `

-Name "ExplicitForms"

# For pass-through authentication

Enable-STFAuthenticationServiceProtocol -AuthenticationService $auth `

-Name "IntegratedWindows"

# Configure two-factor (requires Gateway)

Enable-STFAuthenticationServiceProtocol -AuthenticationService $auth `

-Name "CitrixAGBasic"

```

Server Group Configuration

```powershell

# On primary server - get cluster configuration

$cluster = Get-STFClusterConfiguration

# On secondary server - join group

Start-STFServerGroupJoin -AuthorizerHostName "PRIMARY-SF.domain.com" `

-Confirm:$false

# Verify group membership

Get-STFServerGroup

# Propagate configuration changes

Publish-STFServerGroupConfiguration -Confirm:$false

```

Load Balancing Options

NetScaler ADC (Recommended)

• Layer 7 load balancing
• Health monitoring
• SSL offloading
• Session persistence

Windows NLB

• Built-in Windows feature
• Layer 4 load balancing
• Simpler setup
• Limited health checks

NetScaler Configuration

```

# StoreFront Service Group

add serviceGroup sg_storefront SSL

bind serviceGroup sg_storefront SF1.domain.com 443

bind serviceGroup sg_storefront SF2.domain.com 443

# Monitor

add lb monitor mon_storefront STOREFRONT -storename "Store"

bind serviceGroup sg_storefront -monitorName mon_storefront

# Virtual Server

add lb vserver vs_storefront SSL 10.0.0.100 443

bind lb vserver vs_storefront sg_storefront

set lb vserver vs_storefront -persistenceType COOKIEINSERT

```

SSL/TLS Configuration

```powershell

# Require HTTPS

Set-STFWebReceiverCommunication -WebReceiverService $receiver `

-RequiredLaunchProtocol "HTTPS"

# Configure strong ciphers via IIS/Registry

# Disable TLS 1.0, 1.1

# Enable TLS 1.2, 1.3

```

IIS Hardening

• Remove default IIS headers
• Configure custom error pages
• Enable request filtering
• Set appropriate timeouts
• Enable logging

Access Control

```powershell

# Configure allowed access methods

Set-STFStoreService -StoreService $store `

-LockedDown $true

# Restrict to specific user groups

# Configure via Delivery Controller

```

Common Issues

1. Store not accessible

- Check IIS application pool running

- Verify DNS resolution

- Check SSL certificate binding

- Review firewall rules

1. Applications not enumerating

- Verify Delivery Controller connectivity

- Check farm configuration

- Review StoreFront event logs

- Test XML service on controllers

1. Authentication failures

- Verify AD connectivity

- Check time synchronization

- Review auth service configuration

- Check event logs for errors

Log Locations

• Admin logs: C:\Program Files\Citrix\Receiver StoreFront\admin\Trace
• Store logs: C:\Program Files\Citrix\Receiver StoreFront\services\Trace
• Event Viewer: Applications > Citrix Delivery Services

Diagnostic Commands

```powershell

# Export configuration

Export-STFConfiguration -Path "C:\Backup\sf-config.zip"

# Test farm connectivity

Test-STFStoreFarm -StoreService $store

# Check service status

Get-STFDeployment | Format-List *

```

For detailed StoreFront information, see:

• citrix-knowledge/domain-knowledge/comprehensive-citrix-knowledge.md
• citrix-knowledge/runbooks/ for operational procedures