citrix-storefront-deployment

name	citrix-storefront-deployment
description	StoreFront deployment planning, configuration, and security hardening. Use when planning StoreFront infrastructure, configuring stores and authentication, setting up server groups, implementing SSL/TLS, or troubleshooting StoreFront connectivity issues. Covers architecture patterns, high availability, and operational procedures.

Citrix StoreFront Deployment

Overview

This skill provides guidance for planning, deploying, and configuring Citrix StoreFront infrastructure, including store configuration, authentication setup, high availability, and security hardening.

Architecture Considerations

Deployment Models

Single Server

• Suitable for small environments (<500 users)
• No built-in redundancy
• Simple management

Server Group

• 2-5 servers recommended for HA
• Servers must be within 40ms latency
• Configuration synchronized automatically
• Load balanced via NetScaler or NLB

Multi-Site

• Separate server groups per location
• Optimal aggregation and roaming
• Global Server Load Balancing (GSLB)

Sizing Guidelines

Users	Servers	CPU	Memory
<500	1	4 vCPU	4 GB
500-2000	2	4 vCPU	8 GB
2000-5000	3	8 vCPU	8 GB
5000+	4-5	8 vCPU	16 GB

Deployment Instructions

Prerequisites

1. Server Requirements

   • Windows Server 2016/2019/2022
   • .NET Framework 4.7.2+
   • IIS with required role services
   • Domain joined (recommended)

2. Network Requirements

   • Static IP address
   • DNS records (A and optionally SRV)
   • Firewall rules for ports 80/443
   • Access to Delivery Controllers

3. Certificates

   • SSL certificate from trusted CA
   • Include all DNS names (SAN)
   • Proper certificate chain installed

Installation Steps

1. Install StoreFront

   # Mount Citrix ISO and run installer
   # Select StoreFront role
   # Default installation path: C:\Program Files\Citrix\Receiver StoreFront
   

2. Initial Configuration

   • Launch StoreFront Console
   • Create new deployment
   • Specify base URL (HTTPS recommended)
   • Configure store

3. Add Delivery Controllers

   # PowerShell configuration
   $storeService = Get-STFStoreService -VirtualPath "/Citrix/Store"
   Add-STFStoreFarm -StoreService $storeService `
       -FarmName "Production" `
       -FarmType XenDesktop `
       -Servers @("DDC1.domain.com", "DDC2.domain.com") `
       -LoadBalance $true `
       -Port 443 `
       -TransportType HTTPS
   

Store Configuration

# Get store service
$store = Get-STFStoreService -VirtualPath "/Citrix/Store"

# Configure store settings
Set-STFStoreService -StoreService $store `
    -LockedDown $true `
    -AllowSessionReconnect $true

# Configure subscription store (favorites)
Enable-STFStorePna -StoreService $store `
    -AllowUserPasswordChange $true

Authentication Configuration

# Get authentication service
$auth = Get-STFAuthenticationService -VirtualPath "/Citrix/StoreAuth"

# Enable authentication methods
Enable-STFAuthenticationServiceProtocol -AuthenticationService $auth `
    -Name "ExplicitForms"

# For pass-through authentication
Enable-STFAuthenticationServiceProtocol -AuthenticationService $auth `
    -Name "IntegratedWindows"

# Configure two-factor (requires Gateway)
Enable-STFAuthenticationServiceProtocol -AuthenticationService $auth `
    -Name "CitrixAGBasic"

Server Group Configuration

# On primary server - get cluster configuration
$cluster = Get-STFClusterConfiguration

# On secondary server - join group
Start-STFServerGroupJoin -AuthorizerHostName "PRIMARY-SF.domain.com" `
    -Confirm:$false

# Verify group membership
Get-STFServerGroup

# Propagate configuration changes
Publish-STFServerGroupConfiguration -Confirm:$false

High Availability

Load Balancing Options

NetScaler ADC (Recommended)

• Layer 7 load balancing
• Health monitoring
• SSL offloading
• Session persistence

Windows NLB

• Built-in Windows feature
• Layer 4 load balancing
• Simpler setup
• Limited health checks

NetScaler Configuration

# StoreFront Service Group
add serviceGroup sg_storefront SSL
bind serviceGroup sg_storefront SF1.domain.com 443
bind serviceGroup sg_storefront SF2.domain.com 443

# Monitor
add lb monitor mon_storefront STOREFRONT -storename "Store"
bind serviceGroup sg_storefront -monitorName mon_storefront

# Virtual Server
add lb vserver vs_storefront SSL 10.0.0.100 443
bind lb vserver vs_storefront sg_storefront
set lb vserver vs_storefront -persistenceType COOKIEINSERT

Security Hardening

SSL/TLS Configuration

# Require HTTPS
Set-STFWebReceiverCommunication -WebReceiverService $receiver `
    -RequiredLaunchProtocol "HTTPS"

# Configure strong ciphers via IIS/Registry
# Disable TLS 1.0, 1.1
# Enable TLS 1.2, 1.3

IIS Hardening

• Remove default IIS headers
• Configure custom error pages
• Enable request filtering
• Set appropriate timeouts
• Enable logging

Access Control

# Configure allowed access methods
Set-STFStoreService -StoreService $store `
    -LockedDown $true

# Restrict to specific user groups
# Configure via Delivery Controller

Troubleshooting

Common Issues

1. Store not accessible

   • Check IIS application pool running
   • Verify DNS resolution
   • Check SSL certificate binding
   • Review firewall rules

2. Applications not enumerating

   • Verify Delivery Controller connectivity
   • Check farm configuration
   • Review StoreFront event logs
   • Test XML service on controllers

3. Authentication failures

   • Verify AD connectivity
   • Check time synchronization
   • Review auth service configuration
   • Check event logs for errors

Log Locations

• Admin logs: C:\Program Files\Citrix\Receiver StoreFront\admin\Trace
• Store logs: C:\Program Files\Citrix\Receiver StoreFront\services\Trace
• Event Viewer: Applications > Citrix Delivery Services

Diagnostic Commands

# Export configuration
Export-STFConfiguration -Path "C:\Backup\sf-config.zip"

# Test farm connectivity
Test-STFStoreFarm -StoreService $store

# Check service status
Get-STFDeployment | Format-List *

Reference Materials

For detailed StoreFront information, see:

• citrix-knowledge/domain-knowledge/comprehensive-citrix-knowledge.md
• citrix-knowledge/runbooks/ for operational procedures