This post is from the Mobility Experts team, providing you with technical how to’s, tips, and guides around specific use-cases. Please be sure to share any feedback in the comments and share this post to anyone who might benefit!

This blog is not only intended for Artemis 9.0 release but is also applicable to the earlier releases.

When it comes to Storefront integration in XenMobile Enterprise Edition, there is a confusion as to determine whether StoreFront has to front end AppController or AppController should be enumerating the Windows apps.

It is recommended for AppController to front end the StoreFront for windows apps. If you want more details on which one should front end please refer to this blog post.

This post will focus on when we have one NetScaler Gateway VIP and there is no cert based authentication. If you want to implement or already using cert based authentication, you need to have two NetScaler Gateway VIPs, and how the configuration has to be done can be referred to in this article.

I am not going to go through the installation of StoreFront and AppController, this blog will help if you have StoreFront and AppController already installed and are now integrating Windows apps to existing WorxStore.

Typical architecture of such deployment would be:

Following are the required configurations to be done on XenMobile components for XenApps and Virtual Desktop integration into WorxStore:

StoreFront Configuration in AppController

1. Login to the Control Point.
2. Go to Apps & Docs tab.
3. Under XenApp/XenDesktop on the left panel,Select Windows Apps
4. Click on Edit in Win Apps configuration
5. Host: Host Name of StoreFront
6. Port: 443
7. Relative Path: This path should be the relative path of Config.xml file. This file resides in the StoreFront server.

8. If you are not sure what the relative path should be, you can log in to the StoreFront server select Store and on the right hand side under <Storename> select Configure Legacy Support. Pop up window (see the screen shot below) contains the full path of the config.xml file, use only the relative path as shown in the Relative Path section of the previous screen print.

Note: Do not configure anything for StoreFront in the Deployment under Settings in Control Point admin portal of AppController.

This is how your configuration should look like in Deployment section:

Allow StoreFront to aggregate App Controller apps: No
Authentication Server: No

Here is a small check list which will clear the air as to what happens when StoreFront is configured at multiple places in AppController.

With the above validation, it is clear that we need to have only the Apps & Docs section of AppController configured with the StoreFront details.

NetScaler Configuration for Storefront Integration

Since AppController will be in the path of StoreFront, there is very little you have to do in NetScaler for StoreFront.

If you have ran NetScaler Gateway Wizard and have selected AppController, NetScaler Gateway profiles will automatically be configured with the AppController’s information.

So let’s review the profile assuming that NetScaler Gateway is configured using the wizard. Remember we are not making any changes, just do a comparison of the below settings with the one which you have in your  NetScaler Gateway Session Profiles settings.

First set of configuration is for Web Browser session profiles or for the below policies if they are manually configured:

REQ.HTTP.HEADER User-Agent NOTCONTAINS CitrixReceiver &&


Make sure that the Home Page is set to AppController’s store in Client Experience as shown in the below screen shot.

You can navigate to this screen by going into NetScaler Gateway–>Virtual Server–>double click on you Virtual Server–>Profiles

For Ex: https://ac1.citrix.lab/Demo/StoreWeb

  • ClientExperience

  • Security 

Leave the Default Authorization Action to Allows, which is the default configuration.

Web Interface Address in Published Applications should be set to AppController’s Store as shown in the below screen shot.

  • Published Applications

For Native Receivers or below OS level Polices

REQ.HTTP.HEADER User-Agent CONTAINS CitrixReceiver &&



You need to configure the Session Profiles as shown below in the screen shots; this would the Polices when using WorxHome on a Mobile device.

  • ClientExperience

  •  Security

  •  Published Applications

Other then the above settings in NetScaler Access Gateway we also need to add couple of more infos.

Allow Domains should contains the host entry of StoreFront and AppController as shown below. This setting is under NetScaler Gateway→Global Settings→Clientless Access→Configure Domains for Clientless Access.

AppController should be added as STA server along with XenApp and XenDesktop STA servers and the status should be UP and Green.

These XenApp / XenDesktop STA servers should be the same as configured in StoreFront.

This can be found under Published Applications tab in NetScaler Gateway Virtual Server window.

StoreFront server side configurations

If you have StoreFront already configured and can access the StoreFront apps via Receiver you don’r really need to do anything at Storefront.

I have seen in few of the deployments where AppController is added as Delivery Controller in Storefront, which is not required. Make sure that you remove AppController as Delivery Controller if already added.

Troubleshooting Tips

If you have followed the blog and are still not able to integrate Web& SaaS apps with Windows app, try these troubleshooting tips:

  1. Make sure nothing is configured for StoreFront in Deployment section of Control Point of AppController as mentioned above.
  2. Do not add AppController as Delivery Controller in StoreFront.
  3. XenApp/XenDesktop is/are added as STA in StoreFront.
  4. StoreFront should be able to reach XenApp and XenDesktop on http or https based on what have you configured in StroeFront as STA
  5. Use same XenApp and XenDesktop STA servers in NetScaler, what is being configured in StoreFront.
  6. AppController should be added as STA in NetScaler Gateway.
  7. AppController should trust the StoreFront server certs.If not import the root and intermed of StoreFront server CA cert.
  8. Make sure before you launch any Windows app you have Receiver installed on your device or System.