StoreFront can perform single-sign-on to the VDA only when it possesses a user credential that Windows accepts.

• Domain A users sign in to StoreFront through SAML. Without Citrix Federated Authentication Service, StoreFront cannot translate the SAML assertion into a Windows logon certificate, so they are prompted again inside the VDA—SSO fails.

• Domain B users continue to authenticate with Active Directory user name/password (LDAP). StoreFront can forward those credentials through Kerberos pass-through, so they obtain seamless access—SSO succeeds.

A. SAML users (Domain A) lack FAS, so SSO fails for them; option reverses reality.

C. SSO cannot succeed for Domain A without FAS, so it cannot work for both domains.

D. Kerberos pass-through still works for Domain B, so SSO does not fail for everyone.

1. Citrix Virtual Apps and Desktops 2203 LTSR – Federated Authentication Service, “Why FAS is required with SAML,” para 1-2 (docs.citrix.com, Product Documentation).

2. Citrix StoreFront 1912 – Authentication methods, section “Pass-through Authentication with Kerberos,” second paragraph (docs.citrix.com).

3. Citrix Federated Authentication Service Technical Overview, p.4-5: “Without FAS, users who log on with SAML are prompted again at VDA logon.”

4. Citrix Tech Insight “Integrating SAML with StoreFront,” slide 7: “LDAP/Kerberos users continue to get SSO; SAML users need FAS.”

5. University of Maryland Cybersecurity Program lecture notes “Kerberos in Enterprise SSO,” Week 4, p.3: explains credential forwarding prerequisite for Windows logon.