StoreFront Basic Configuration – Carl Stalhood (2024)

Navigation

This article applies to StoreFront 3.0.9000 and older. For newer versions, see the newer article.

Change Log
Installation / Upgrade to 3.0.9000
Rename Default Store
EditHOSTS Fileto resolve Gateway and StoreFront FQDNs
SSL Certificateon StoreFront servers
SSL Encryption of Delivery Controllers
StoreFront Base URL
Authentication Configuration
RemoveCitrix OnlineIcons
Receiver for HTML5 – Enable and Upgrade
Receiver for Web – Timeout
Receiver for Web – Pass-through Authentication
Unified Receiver Experience
Customize Receiver Appearance
Default Tab
Propagate Changesto other StoreFront servers in Server Group
Default Web Pagein IIS to redirect to Receiver for Web
Receiver Deployment:
- Deploy Citrix Receivers (Windows and Mac) from StoreFront
Auto-favorite Published Apps

💡 = Recently Updated

Change Log

2020 Nov 20 – updated article for StoreFront 3.0.9000
2020 Sep 8 – updated article for StoreFront 3.0.8001to fix a security vulnerability
2019 Aug 21 – updated article for StoreFront 3.0.8000 to fix a security vulnerability
2019 Feb 8 – updated article for StoreFront 3.0.7000
2018 Sep 18 – updated article for StoreFront 3.0.6000

Installation / Upgrade

StoreFront Versions –The following StoreFront versions have very similar configurations:

XenApp/XenDesktop 7.6.9000 (LTSR CU9) comes with StoreFront 3.0.9000.
StoreFront 3.0.8001. – fixes a security vulnerability
XenApp/XenDesktop 7.6.8000 (LTSR CU8) comes with StoreFront 3.0.8000. – 3.0.8000 was released early to fix a security vulnerability
XenApp/XenDesktop 7.6.7000 (LTSR CU7) comes with StoreFront 3.0.7000.
XenApp/XenDesktop 7.6.6000 (LTSR CU6) comes with StoreFront 3.0.6000.
XenApp/XenDesktop 7.6.5000 (LTSR CU5) comes with StoreFront 3.0.5000.
XenApp/XenDesktop 7.6.4000 (LTSR CU4) comes with StoreFront 3.0.4000.
XenApp/XenDesktop 7.6.3000 (LTSR CU3) comes with StoreFront 3.0.3000.
XenApp/XenDesktop 7.6.2000 (LTSR CU2) comes with StoreFront 3.0.2000.
XenApp/XenDesktop 7.6.1000 (LTSR CU1) comes with StoreFront 3.0.1000.
XenApp/XenDesktop 7.7 ISO comes with StoreFront 3.0.1. You can upgrade it from the 7.6 LTSR CU3 media.
The XenApp/XenDesktop 7.6.0 ISO comes with StoreFront 2.6. If you installed StoreFront on your Delivery Controllers, then it is version 2.6, and you can upgrade it to 3.0.8000.

Server Selection – StoreFront can be installed directly on your Delivery Controllers. When installing Delivery Controller, simply leave the box checked to install StoreFront. If you let Delivery Controller install StoreFront, it will create a default store named /Citrix/Store. See belowto rename this store.

Or you can install StoreFront 3.0.9000 on separate servers. You can even install StoreFront on your existing Web Interface servers (make sure Web Interface is installed first).

Citrix Blog Post StoreFront 3.0 Scalability recommends StoreFront servers to be sized with 4 vCPU and 8 GB RAM.

After installation, NT SERVICE\CitrixConfigurationReplication and NT SERVICE\CitrixClusterService must remain in the Administrators group on both StoreFront servers or propagation will fail.

Install / Upgrade StoreFront 3.0.9000

Download StoreFront 3.0.9000.

For new installs, there’s no need to install prerequisites (e.g. IIS) since the StoreFront installer will do it for you.
If upgrading from older StoreFront:
1. Other Users – Use Task Manager > Users tab to logoff any other user currently logged into the machine.
2. Close all MMC and PowerShell consoles.
3. Stop the World Wide Web Publishing Service.
4. Stop all StoreFront services.
Go to the downloaded and extracted RcvrSF_3_0_8001 folder and run CitrixStoreFront-x64.exe.
In the License Agreement page, check the box next to I accept the terms, and click Next.
In the Review prerequisites page, click Next.
In the Ready to install page, click Install.
In the Successfully installed StoreFront page, click Finish.
If this is a new install, skip to the next section (Initial Configuration).
After upgrading, in StoreFront Console, go to Receiver for Web and Disable Classic Receiver Experience.
Click Disable.
Go to Stores and on the right, click Set Unified Experience as Default.
Check the box next to Set the unified Receiver experience as the default for this store and click OK.
Go back to Receiver for Web and use the Configure Receiver Appearance and Manage Featured App Groups links to customize the webpage.

Initial Configuration

If this is a new install of StoreFront, do the following:

In PowerShell, run Set-ExecutionPolicy Unrestricted.
The management console should launch automatically. If not, launch Citrix StoreFront from the Start Menu.
In the middle, click Create a new deployment.
In the Base URL page, if you installed an SSL certificate on the StoreFront server, then the Hostname should already be filled in. If SSL is not configured yet then you can leave it set to the server name and change it later once you setup SSL and load balancing. Click Next.
In the Store Name page, enter a name for the store and click Next. The Store name entered here is part of the URL path. And users see this name in their local Receiver Accounts list.
In the Delivery Controllers page, you can one set of Delivery Controllers per XenApp farm or XenDesktop site. Click Add.
Change the Type to XenDesktop.
Enter a descriptive name for the XenApp/XenDesktop 7.6 or newer site/farm. This name does not need to match the actual site/farm name. And users don’t see this name.
Add the two Controllers. Change the Transport Type to HTTP. Click OK. It’s also possible to set the Transport type toHTTPS if certificates are installed on your Delivery Controllers.
If you have multiple XenDesktop sites/farms feel free to add them now. Or you can add older XenApp farms. Click Next when done.
In the Remote Access page, select None and click Create. You can configure StoreFront to use NetScaler Gatewaylater.
In the Created Successfully page, click Finish.

Second StoreFront Server

After installation of the second server, NT SERVICE\CitrixConfigurationReplication and NT SERVICE\CitrixClusterService must remain in the Administrators group on both StoreFront servers or propagation will fail.

Install StoreFront 3.0.9000on the second server.
On the 2nd server, create/import the SSL certificate and bind it to the Default Web Site.
Login to the first StoreFront server. In the StoreFront management console, right-click Server Group, and click Add Server.
Copy the Authorization code.
Login to the second StoreFront server and launch the StoreFront Console. In the middle, click Join existing server group.
In the Join Server Group page, enter the name of the first StoreFront server and enter the Authorization code copied earlier. Click Join.
Then click OK.
Go back to the first server. Click OK.
All changes made on one StoreFront server must be propagated to the other StoreFront server. When changing StoreFrontweb.config files, change them on one StoreFront server use the StoreFront Console to Propagate Changes to the other StoreFront servers.

Store Name – Rename

When you install XenDesktop Delivery Controller, you are given the option of installing StoreFront on the same server. If you let the Delivery Controller installer also install StoreFront then the StoreFront on the Controller will havea default store name of /Citrix/Store. If you don’t like the default Store Name then you will need to remove the store and re-add it.

In the StoreFront console, on the left click Stores.
Highlight the store and on the bottom right click Remove Store.
Click Remove.
On the left, right-click Stores and click Create Store.
In the Store Name page, enter a name. This name becomes part of the path (/Citrix/StoreName) and is displayed in Receiver. Click Next.
In the Delivery Controllers page, add farms and click Next.
In the Remote Access page, leave it set to None and click Create.
In the Created Successfully page, click Finish.

HOSTS File

StoreFront 3.0 is smart enough to do a loopback connection to the local StoreFront server instead of sending traffic through the load balancer. For more information seeNo More Editing of Hosts File at Citrix Blog PostWhat’s New in StoreFront 3.0.

However, if you have StoreFront servers in multiple datacenters then you are probably using GSLB-enabled DNS names and StoreFront needs to resolve these names to VIPs in the local datacenter. Edit the HOSTS file (C:\Windows\System32\Drivers\Etc\HOSTS) on each StoreFront server with the following entries:

StoreFront Load Balancing FQDN (e.g. Citrix.corp.com) = Load Balancing VIP in the local datacenter.
NetScaler Gateway Callback FQDN (e.g. CitrixCB.corp.com) = NetScaler Gateway VIP in the local datacenter.

SSL Certificate

StoreFront requires SSL. You will save yourself much heartache if you install valid, trusted certificates. There are two options for StoreFront SSL:

Delivery Controllers – SSL

Delivery Controllers can be SSL enabled by using one of two methods:

If IIS is installed on the Delivery Controller, simply install/create a certificate, and bind it to the Default Web Site.
If IIS is not installed on the Delivery Controller, then you need to run a command line program as described at CTX200415 Secure XML traffic between StoreFront and Delivery Controller 7.x. Or use Ray Kareer’s script at Binding your SSL Server Certificate to the Citrix Broker Service at CUGC.

Once SSL certificates are installed on the Delivery Controller servers, then you can configure the Store to use SSL when communicating with the Delivery Controllers.

In the StoreFront Console, on the left click Stores.
On the bottom-right, click Manage Delivery Controllers.
Highlight the deployment and click Edit.
Change the Transport type to HTTPS.
Make sure the Delivery Controller servers are entered using their FQDNs. These FQDNs must match the certificates installed on those servers.
Click OK twice.

Base URL – Change

The StoreFront Base URL should point to a URL with a FQDN that resolves to a load balancing VIP that load balances the StoreFront servers. Receiver uses this Base URL to connect to StoreFront. If remote, Receiver will first connect to NetScaler Gateway and then use Gateway to proxy a connection to the Base URL.

Ifyou are not following the Single FQDN procedurethen the FQDN used for load balancing of StoreFront (Base URL) must be different than the FQDN used for NetScaler Gateway.

The StoreFront Base URL must be https. Receivers will not accept clear-text http URLs. This is true even for remote connections that are proxied through NetScaler Gateway.

Configure load balancing of the StoreFront servers, including SSL certificate.
In the Citrix StoreFront console, right-click Server Group and click Change Base URL.
Enter the new Base URL in https://citrix.corp.comformat. This must be https. Receivers will not accept http URLs.
If the Base URL is https but you don’t have certificates installed on your StoreFront servers (aka SSL Offload) then you’ll need to run the following commands on the StoreFront servers. See No More Editing of Hosts File at Citrix Blog Post What’s New in StoreFront 3.0.
```
& "C:\Program Files\Citrix\Receiver StoreFront\Scripts\ImportModules.ps1"Set-DSLoopback -SiteId 1 -VirtualPath /Citrix/StoreWeb -Loopback OnUsingHttp
```

Authentication Configuration

If StoreFront is not in the same domain (or trusted domain) as the users, then you can configure StoreFront 3.0 to push authentication to the Delivery Controllers. See XML service-based authentication at docs.citrix.com. Note: StoreFront must still be a member of domain but the particular domain doesn’t matter.

In the Citrix StoreFront console, on the left, right-click Authentication and click Add/Remove Methods.
Check the boxes next to Domain pass-through and Pass-through from NetScaler Gateway. Click OK.
If you intend to enable pass-through authentication from Receiver Self-Service or from Receiver for Web, run the command
Set-BrokerSite -TrustRequestsSentToTheXmlServicePort $True from a Windows PowerShell command prompt on a Controller.
In XenApp 6.5, this is a Citrix Policy > Computer > Trust XML Requests.
With User name and password highlighted in the middle, click Configure Trusted Domains on the bottom-right.
Select Trusted domains only, click Add, and enter the domain names (NetBIOS and DNS). The DNS suffix is needed if doing userPrincipalName authentication.
Select one of the domains as the default.
If desired, check the box next to Show domains list in logon page. Click OK.
With User name and password highlighted in the middle, click Manage Password Options in the bottom right.
Make your selection and click OK.
From Feng Huang at discussions.citrix.com: you can change the password expiration warning period by editing/Citrix/Authentication/web.config. SetshowPasswordExpiryWarning toCustom and setpasswordExpiryWarningPeriod to your desired number of days.
Be careful with password changes. Any time somebody changes their password through StoreFront, a profile will be created for that user on the StoreFront server. Use a tool like delprof2.exe to periodically delete these local profiles.

Citrix Online Integration

StoreFront might be configured to add the Citrix Online icons to Receiver. To remove them, on the left click Stores and on the right click Integrate with Citrix Online.
Uncheck all three boxes and click OK.

Receiver for HTML5 – Enable and Upgrade

By default, Receiver for HTML5 is not enabled.

Receiver for Web Timeout

On the left, click Receiver for Web.
On the right, click Set Session Timeout
Set the timeout as desired and click OK.
The session timeout in StoreFront 3.0 is not being reset correctly when a user launches an application. See Michael Bednarek’s code at discussions.citrix.com that fixes the problem.
If you are using a NetScaler, you will need to change the Global Session Timeout located at NetScaler Gateway > Global Settings > Change Global Settings > Client Experience > Session Time-out (mins).

Receiver for Web Pass-through Authentication

If you enabled Pass-through auth in the Authentication node it does not enable it from Receiver for Web. If you enable it inReceiver for Web, additional configuration is required on the Receiver side to fully enable pass-through auth.

On the left, click Receiver for Web
On the right, click Choose Authentication Methods.
If desired, check the box next to Domain pass-through. Click OK.
If the StoreFront URL is in the browser’s Local Intranet zone then you’ll see a prompt to automatically Log On. This only appears once.
If you try to launch an icon it will ask you to login to Windows. To fix this, you must also enable pass-through authentication on the client side(Receiver).

Unified Receiver Experience

If you did a clean install of StoreFront 3.0 or newer then the newer Receiver UI will already be enabled and you can skip this section.

If you upgraded from an older StoreFront then you can disable the Classic UI to enable the newer UI.

On the left, click Receiver for Web.
On the right, click Disable Classic Receiver Experience.
Click Disable.
On the left, click Stores. On the right, click Set Unified Experience as Default.
Check the box next to Set the unified Receiver experience as the default for this store and click OK.

Customize Receiver Appearance

If the Unified Receiver appearance is enabled, you can go to Receiver for Web > Customize Receiver Appearance to change logos and colors. Additional customization can be performed using the SDK.

You can also Manage Featured App Groups.

These Featured App Groups are displayed at the top of the Apps > All page.

By default, Featured App Groups are displayed with continual horizontal scrolling. This is OK if you have several Featured App Groups but doesn’t look right if you only have one Featured App Group.

Michael Bednarek has posted some code at Citrix Discussions to disable the continuous horizontal scrolling. Also seeCTX202415StoreFront Featured Apps Group Appears More Than Once.

Additional StoreFront and Receiver customizationsare available through the StoreFront APIs.

Default Tab

By default, when a user logs in to StoreFront, the Favorites tab is selected. Users can go to other tabs to add icons to the list of Favorites.
You can change the default tab to something other than Favorites by editing C:\inetpub\wwwroot\Citrix\StoreWeb\web.config in an elevated text editor.
Search for defaultView or scroll to line 61. Change the defaultView to apps or desktops, or leave it set to the default of auto. Auto will select a tab in the following priority order depending on which tabs (views) are enabled: Favorites > Apps > Desktops.
If you change it to default to the Apps view, then you might also want to default to the Categories view instead of the Allview.

You can do this by adding the following code to C:\Inetpub\wwwroot\Citrix\StoreWeb\custom\script.js. More details at discussions.citrix.com.

CTXS.Extensions.afterDisplayHomeScreen = function (callback) { CTXS.ExtensionAPI.navigateToFolder('/');};CTXS.Extensions.onViewChange = function (viewName) { if (viewName == 'store') { window.setTimeout(function () { CTXS.ExtensionAPI.navigateToFolder('\\'); }, 0); }};

Then when you login to StoreFront you’ll see Apps > Categories as the default view. This works in Receiver too.
To completely remove the Favorites tab, in the StoreFront Console, go to Stores > Disable User Subscriptions.
When publishing applications in Studio, specify a Category so the applications are organized into folders.

Propagate Changes

Any time you make a change on one StoreFront server, you must propagate the changes to the other StoreFront server.

In the StoreFront console, on the left, right-click Server Group and click Propagate Changes.
You might see a message saying that you made changes on the wrong server.
Click OK when asked to propagate changes.
Click OK when done.

IIS Default Web Page

Citrix CTX133903How to Make Storefront the Default Page within the IIS Site. To make a Storefront Web site the default page within the IIS site, complete the following procedure:

Open Notepad and paste the following text:
```
<script type="text/javascript"></script>
```
Note: Replace /Citrix/StoreWeb to the correct path to your Store’s Web site, if required. You can also put https://StoreFrontFQDN in the location field.
SelectFile>SaveAsand browse to the IIS folder, by default the C:\inetpub\wwwroot is the IIS folder.
Select the Save as type toAlltypes.
Type a file name with an html extension, and selectSave.
Open IIS Manager.
Select the SERVERNAME node (top-level) and double-click Default Document, as shown in the following screen shot:
SelectAdd…,
And enter the file name of the .html file provided in Step4.
Ensure the .html file is located at the top of the list, as shown in the following screen shot:
Repeat these steps on every StoreFront server.

Deploy Citrix Receiver from StoreFront

If you performed a standalone install of StoreFront, then it is configured to tell users to pull Receivers from Citrix’s website. Follow this section to configure StoreFrontto download Receivers directly from the StoreFront server.

Or if you installed StoreFront 2.6 using the XenApp/XenDesktop 7.6 autoselect.exe and later upgraded it to StoreFront 3.0.9000, then StoreFront will probably have local Receiver clients that need to be upgraded. Both procedures are covered in this section.

Go to C:\Program Files\Citrix\Receiver StoreFront\Receiver Clients\. Create a Windows folder if it doesn’t exist.
In the Windows folder, paste the downloadedReceiver 4.9.9002 LTSR for Windows, overwriting the existing file if one exists. Rename the file the CitrixReceiver.exe if it isn’t already.Do this on both StoreFront servers.
Go back up to the Receiver Clients folder and create a Mac folder if one doesn’t exist.
Copy the downloadedReceiver for Mac 12.9.1to C:\Program Files\Citrix\Receiver StoreFront\Receiver Clients\Mac. Overwrite the existing file if one exists. Rename the file to CitrixReceiver.dmg.
Go to C:\inetpub\wwwroot\Citrix\StoreWeb and edit the file Web.config. If UAC is enabled you’ll need to run your text editor elevated.
Scroll down to the pluginAssistant section (line 52). If desired, change upgradeAtLogin to true. This will enable StoreFront to check the installed version of Receiver and offer to upgrade.
If the win32 and macOS paths point to downloadplugins.citrix.com, you can change the paths to a local folder so that the Receiver is downloaded directly from StoreFront instead of from Citrix.com. Simply change http://downloadplugins.citrix.com to clients. Also, change the file names so they match the ones on your StoreFront servers.
Close and save the file.
Propagate Changes to the other StoreFront servers.
When users connect to Receiver for Web, they will be prompted to install or upgrade. Note: this only applies to Receiver for Web. Receiver Self-Service will not receive this prompt.

Auto-Favorite

To force a published application to be favorited (subscribed), use one of the following keywords in the published application description:

KEYWORDS: Auto = the application is automatically subscribed. But users can remove the favorite.
KEYWORDS: Mandatory = the application is automatically subscribed and users cannot remove the favorite.

With Mandatory applications there is no option to remove the application from Favorites.