Storefront Smartcard authentication error "Cannot log on using smart card"

[Pavel Rykin1709152805]

Hello!

We're trying to enable smartcard authentication using the article https://docs.citrix.com/en-us/storefront/downloads/smart-card-configuration-for-citrix-environments.pdf but at the end of configuration we have an error "Cannot log on using smart card".

Our environment:

• XD 1811
• No Netscaler
• Thin client (HP) running Win10. Non domain joined.
• Drivers installed on VDA and thin client
• StoreFront sees user certificate and asks for PIN. Then we've got this error  "Cannot log on using smart card"
• StoreFront installed on Win2019 with IIS 10

When we enable StoreFront verbose logging this error catches:

00001620	16:35:39	[5984] Attempting Kerberos authentication with a certificate, and domain hint: <null> 	
00001621	16:35:39	[5984] Citrix.DeliveryServices.Kerberos Information: 0 : 	
00001622	16:35:39	[5984] Kerberos authentication: Failed. Authentication Status: C000006D Sub-status: 0000 [The attempted logon is invalid. This is either due to a bad username or authentication information.] 	
00001623	16:35:39	[5984] Citrix.DeliveryServices.Kerberos Verbose: 0 : 	
00001624	16:35:39	[5984] Authentication Result was: Failed 	
00001625	16:35:39	[5984] Citrix.DeliveryServices.Kerberos Information: 0 : 	
00001626	16:35:39	[5984] An authentication attempt was made for user: E=PupkinS@XXXX.ru, CN=PupkinS  with realm context <unknown> resulting in: Failed -1073741715 

In Windows EventLog we see audit failure with same text, and something like "Network service cannot logon" (I can specify this later)

Thanks in advance!

[Shalini Pradhan]

Hi,

There is a Citrix article : https://support.citrix.com/article/CTX219920. Please have a look .

Hope this helps.

 

Regards

Shalini

[Pavel Rykin1709152805]

11 hours ago, Shalini Pradhan said:

Hi,

There is a Citrix article : https://support.citrix.com/article/CTX219920. Please have a look .

Hope this helps.

 

Regards

Shalini

Thanks, Shalini for the clue.

What helped me is adding storefront machine account into windows domain group named Windows Authorization Access Group. Now all works.