Gateway

Configuring the Secure Ticket Authority on NetScaler Gateway

November 12, 2024

Contributed by:

C H C

The Secure Ticket Authority (STA) is responsible for issuing session tickets in response to connection requests for published applications on Citrix Virtual Apps and published desktops on Citrix Virtual Desktops. These session tickets form the basis of authentication and authorization for access to published resources.

You can bind the STA globally or to virtual servers. You can also add multiple servers running the STA when you configure a virtual server.

If you are securing communications between the NetScaler Gateway and the STA, make sure that a server certificate is installed on the server running the STA.

In a typical NetScaler Gateway GSLB deployment, all gateway virtual servers (in each site) must be configured with the same back-end STA servers to avoid reconnection issues.

Note:

If STA servers are configured to use HTTP protocol (for example, http://staFQDN.com) and the delivery controller (DDC) uses HTTPS, the connection fails. This failure occurs because the DNS resolution or any probe attempting to communicate with the STA server using the incorrect protocol does not succeed. It is essential to ensure that the STA server URLs are updated to use HTTPS to match the DDC configuration.

For more information on when it is appropriate to use HTTP vs HTTPS, when to use FQDN over IP address for different STA use cases, and how to protect STA traffic with SSL, see NetScaler Gateway Secure Ticket Authority.

For cloud connectors to support HTTPS STA configuration, set XmlServicesEnableSsl to 1 on cloud connector and restart the Citrix Remote Broker Provider service and the Citrix High Availability service. For more information, see Secure Ticket Authority (STA) Showing Offline and 503 Error in a Browser.

To bind the STA globally

Navigate to NetScaler Gateway > Global Settings.
In the details pane, under Servers, click Bind/Unbind STA Servers to be used by the Secure Ticket Authority.
In the Bind/Unbind STA Servers dialog box, click Add.
In the Configure STA Server dialog box, enter the URL of the STA server, click Create, and then click OK.
In the STA Server dialog box, in URL, type the IP address or fully qualified domain name (FQDN) of the server running the STA and then click Create.

Note: You can add more than one server running the STA to the list. The STAs that are listed in StoreFront must match the STAs that are configured on NetScaler Gateway. If you are configuring multiple STAs, do not use load balancing between NetScaler Gateway and the servers running the STA.

To bind a STA to the virtual server

Navigate to NetScaler Gateway > Virtual Servers.
In the details pane, select a virtual server and then click Edit.
On the Published Applications tab under Secure Ticket Authority, click Add.
In the Configure STA Server dialog box, enter the URL of the STA server and then click Create.
Repeat Step 4 to add additional STA servers and then click OK.

References

For details about STA, see the article NetScaler Gateway Secure Ticket Authority.
For details on configuring your NetScaler Gateway to use a Cloud Connector as the Secure Ticket Authority (STA) server, see How do I configure NetScaler Gateway to use a Cloud Connector as a STA.

The official version of this content is in English. Some of the Cloud Software Group documentation content is machine translated for your convenience only. Cloud Software Group has no control over machine-translated content, which may contain errors, inaccuracies or unsuitable language. No warranty of any kind, either expressed or implied, is made as to the accuracy, reliability, suitability, or correctness of any translations made from the English original into any other language, or that your Cloud Software Group product or service conforms to any machine translated content, and any warranty provided under the applicable end user license agreement or terms of service, or any other agreement with Cloud Software Group, that the product or service conforms with any documentation shall not apply to the extent that such documentation has been machine translated. Cloud Software Group will not be held responsible for any damage or issues that may arise from using machine-translated content.

Was this helpful

Configuring the Secure Ticket Authority on NetScaler Gateway

November 12, 2024

Contributed by:

C H C

November 12, 2024

Contributed by:

C H C

Configuring the Secure Ticket Authority on NetScaler Gateway

To bind the STA globally

To bind a STA to the virtual server

References

In this article