Configuring SSON with Citrix Receiver Enterprise 3.4 and StoreFront 2.6 requires you to make a change on your StoreFront servers to allow SSON to work correctly with the XenApp Services URL / PNAgent Services site.
Enabling Domain Pass-Through Authentication Methods in the Authentication Node and on the Receiver for Web site does not change the default authentication method for XenApp Services URL.
Also only one authentication method can be configured for each XenApp Services URL and the default authentication method is Explicit (Prompt for user name and password).
To configure SSON as the default authentication method for your XenApp Services URL you first need to find the Microsoft IIS Site ID.
Open Command prompt on your StoreFront Server.
Type appcmd list site.
The ID should be returned for the IIS Site as seen below.
Next you will want to make sure all the StoreFront management consoles are closed and then open PowerShell.
The command line you will run is the following-
& "installationlocation\Scripts\EnablePnaForStore.ps1" –SiteId iisid –ResourcesVirtualPath storepath –LogonMethod sson
After the powershell script has run successfully, you will need to propagate the settings to your other StoreFront Servers if you have more than one.
Close your Powershell window and then open StoreFront management console and click Propagate changes. You should be able to use Single Sign on successfully if your endpoint has all the required SSON settings configured that are listed in this Citrix article.