In right sidebar Store Services > Manage Authentication Methods.
In Manage Authentication Methods window check SAML Authentication.
Click Settings > Identity Provider:
Select SAML Binding - Redirect
Add Address - <HES address>/saml/login
Import Signing Certificate, downloaded from IdP (HES)
Click Settings > Service Provider:
Export Signing Certificate
Copy Service Provider Identifier value
Go to Settings -> Parameters -> SAML section
Click Add Service Provider button
Issuer - Service Provider Identifier from Citrix StoreFront http://citrix.lab.hideez.com/Citrix/Authentication
Assertion Consumer Service - AssertionConsumerService from Citrix StoreFront https://citrix.lab.hideez.com/Citrix/Authentication/SamlForms/AssertionConsumerService
Public x509 Certificate - Signing Certificate from Citrix StoreFront
NameID Format - Email
NameID Value - Email