'Cannot start app' when StoreFront is configured for FAS/SAML authentication

Launching an application or desktop fails with error ‘Cannot start app’ when StoreFront is configured for FAS/SAML authentication. On the Storefront servers, we see ‘Access Denied’ for AssertIdentity from FAS server. On the FAS server, we could see that CA failed to issue certificate for UPN...