Citrix Workspace app for Linux 2608 - Preview

You can download Citrix Workspace app for Linux 2608 preview version from the Downloads page.

Note:

This is an Early Access Build shared for the purpose of testing or validation with the intent to make organizations ready for the upcoming release and is NOT advised to be deployed in production environments.

What’s new

The following is a list of features that are available in Citrix Workspace app 2608 for:

• Image copy and paste from the client to the session
• Version upgrade for Chromium Embedded Framework
• Web page zoom synchronization for Browser Content Redirection
• Webcam device selection in Preferences
• Restart option on the Boot to virtual desktop screen
• Biometric user verification for security keys in an HDX session
• HDX Direct support for traditional direct connections
• Support for Ubuntu 26.04
• Improved session reconnection experience
• Improved Point of Presence (PoP) selection
• Enhanced virtual apps and desktops launch experience (Technical Preview)
• Dynamic smart card support

Image copy and paste from the client to the session

Starting with Citrix Workspace app 2608 for Linux, you can copy an image on the local Linux device and paste it into the virtual app or desktop session using the clipboard. This enhancement extends clipboard redirection to support images, so you can move image content from the client to the session as easily as text.

This feature supports the following image formats:

• BMP
• JPEG
• PNG

Version upgrade for Chromium Embedded Framework

Starting with Citrix Workspace app 2608 for Linux, the version of the Chromium Embedded Framework (CEF) used by Browser Content Redirection (BCR) is upgraded to 148. This upgraded version incorporates the latest security and stability improvements.

Web page zoom synchronization for Browser Content Redirection

Starting with Citrix Workspace app 2608 for Linux, Browser Content Redirection (BCR) synchronizes the zoom level between the VDA browser and the client-rendered BCR overlay. This synchronization ensures that the web content is scaled consistently across the session.

Webcam device selection in Preferences

Starting with Citrix Workspace app 2608 for Linux, a webcam device drop-down list is available in Preferences. The drop-down list shows all webcams connected to the local Linux device and allows you to select one of the following options:

• System default (default): Redirects all available webcams to the session.
• A specific webcam device: Redirects only the selected webcam to the session.

The selected webcam preference is saved per resource and is automatically applied when you reconnect to the same resource.

Restart option on the Boot to virtual desktop screen

Starting with Citrix Workspace app 2608 for Linux, you can restart an endpoint directly from the Boot to virtual desktop screen using the new Restart button. Earlier, when a device was configured for Boot to virtual desktop (DesktopLock), this screen offered only the Shut down and Network/Wi-Fi settings options. To restart the device, for example, after OS updates, network changes, or troubleshooting, you had to shut it down and then power it on again locally or through a remote power-on command.

The Restart button now appears next to the Shut down button, so you can restart the endpoint in a single step. You can also show or hide each power button (Shut down, Restart, and Network/Wi-Fi settings) independently using the configuration keys.

User experience

On the Boot to virtual desktop screen, the power buttons appear in the following order:

• Shut down: Powers off the endpoint device. This is the existing behavior.
• Restart: Restarts the endpoint device.
• Network / Wi-Fi settings: Opens the network settings. This is the existing behavior.

The Restart button is available on both the idle or lock screen and the error screen.

Configure the power buttons

By default, the Shut down, Restart, and Network/Wi-Fi settings buttons are displayed. To hide any of these buttons, edit the AuthManConfig.xml file:

1. Open the $ICAROOT/config/AuthManConfig.xml file.
2. Set the required keys as shown in the following table.
3. Save the file. The change takes effect the next time the Boot to virtual desktop screen starts.

For example, to hide the Network/Wi-Fi settings button and keep the Shut down and Restart buttons:

<DesktopLockShowShutdownButton>true</DesktopLockShowShutdownButton>
<DesktopLockShowRebootButton>true</DesktopLockShowRebootButton>
<DesktopLockShowWifiButton>false</DesktopLockShowWifiButton>
<!--NeedCopy-->

Note:

• A button is hidden only when its key is set to false. Any other value, or a missing or empty key, keeps the button visible. The values are case-insensitive.
• When all three buttons are hidden, the entire power-button area is removed from the screen.

Default behavior and upgrade impact

• After the upgrade, existing Boot to virtual desktop deployments get the Restart button automatically. No configuration is required.
• This feature is backward compatible. When you don’t change the configuration, the Shut down and Network/Wi-Fi settings buttons appear as before, with the Restart button added alongside.

Biometric user verification for security keys in an HDX session

Starting with Citrix Workspace app 2608 for Linux, you can complete user verification with a fingerprint on FIDO2 biometric (BIO) security keys in an HDX session. When an app or a website in the session requests user verification, you can confirm your identity using the fingerprint sensor on the security key instead of entering the security key PIN.

Earlier, user verification always relied on the security key PIN. A biometric security key that had a fingerprint enrolled but no PIN was rejected, and a key that had both a fingerprint and a PIN always prompted for the PIN, which bypassed the fingerprint sensor.

Your biometric data never leaves the security key. Only the result of the verification is sent to the session.

No additional configuration is required for biometric security keys.

Prerequisites

• A FIDO2 security key that has a fingerprint sensor with at least one fingerprint enrolled.
• FIDO2 redirection enabled on the client. It is enabled by default starting with version 2505. For more information, see Support for authentication using FIDO2 in HDX session.

Note:

The fingerprint sensor is the preferred verification method. If the fingerprint is not recognized or on-device verification is locked out, and the security key also has a PIN, Citrix Workspace app prompts for the PIN and retries the operation.

Limitations

• You can not enroll or manage fingerprints on the security key using Citrix Workspace app. To enroll a fingerprint, use the security key vendor’s tool, for example, Yubico Authenticator.
• Biometric verification applies only when the app or the website requests user verification as required. When user verification is requested as preferred or discouraged, the behavior is unchanged.

HDX Direct support for traditional direct connections

Starting with version 2608, Citrix Workspace app for Linux supports securing traditional direct connections through HDX Direct in both DaaS Local and DaaS Cloud environments. The relevant access scenarios are:

• Citrix Workspace with Direct Workload Connection enabled.
• Citrix Workspace with resource location connectivity set to Internal only.
• Citrix StoreFront accessed from inside the network.

For more information, see Traditional direct connections.

Support for Ubuntu 26.04

Starting with Citrix Workspace app 2608 for Linux, Ubuntu 26.04 (x86_64) is supported, in addition to the previously supported Ubuntu 22.04 and Ubuntu 24.04.

• This support applies to the GCC 11 build of Citrix Workspace app for Linux (.deb or .tar.gz package).

Prerequisites

Some packages that are present by default on earlier Ubuntu releases are not installed by default on Ubuntu 26.04. Install these packages manually:

sudo apt install dbus-x11 gnome-keyring libsecret-1-0 net-tools
<!--NeedCopy-->

The following table lists these packages and the reason each one is required:

Note:

Ubuntu 26.04 ships webkit2gtk-4.1 by default, which the GCC 11 build uses. You don’t have to install a separate WebKitGTK package.

Improved session reconnection experience

Starting with Citrix Workspace app 2608 for Linux, the session reconnection experience is improved with the following enhancements:

• Reconnect during the Auto-Client-Reconnect (ACR) phase. A reconnect option now appears while the ACR countdown is running, so you do not have to wait for the countdown to finish before you reconnect.
• Automatic sign-in when your store session has expired. If your sign-in to the store has expired by the time you reconnect, Citrix Workspace app starts the sign-in automatically. The reconnection screen displays Verifying authentication while sign-in is in progress. After you sign in successfully, the session is relaunched automatically, and you do not have to start the desktop or the app again manually.
• Reconnection for hybrid-launched sessions. You can now reconnect to desktop and app sessions that were started using hybrid launch, on both on-premises and cloud stores, after automatic reconnection fails. In earlier versions, hybrid-launched sessions were not supported. This capability is enabled by default.
• Blurred session background. While reconnection is in progress, or after it fails, the session content behind the reconnection screen is blurred and dimmed. This behavior keeps the reconnection options readable and prevents session content from being viewed while the session is disconnected.

These enhancements are enabled by default.

Note:

The reconnection timeout is paused while you are signing in. A sign-in that takes time, for example, when multifactor authentication is required, does not cause the reconnection to fail. If the sign-in is not completed within 30 minutes, the reconnection attempt fails, and you can select the reconnect option again.

Configure the reconnection options

Administrators can control the reconnection options using the following settings in the $HOME/.ICAClient/wfclient.ini file:

To change a setting:

1. Open the $HOME/.ICAClient/wfclient.ini file.

2. Add the setting under the [WFClient] section. For example:

   [WFClient]
   ManualReconnectEnabled=False
   <!--NeedCopy-->
   

3. Restart the session for the change to take effect.

Improved Point of Presence (PoP) selection

Starting with version 2608, Citrix Workspace app for Linux improves Gateway Service PoP selection for eligible Citrix Gateway Service sessions. When configured and session latency exceeds the defined threshold, the Citrix Workspace app for Linux can evaluate candidate PoPs associated with the Gateway Service FQDN and reconnect through a better-performing PoP. This enhancement helps improve session responsiveness when applicable.

This feature is disabled by default. To enable it, set: AdaptiveGatewaySelectionEnabled=True under the [Network] section of the $HOME/.ICAClient/All_Regions.ini file.

Enhanced virtual apps and desktops launch experience (Technical Preview)

Starting with Citrix Workspace app 2608 for Linux, you can enable a launch status indicator that shows real-time progress for app and desktop launches and for store operations. Progress appears as a stack of status cards in the bottom-right corner of the primary monitor. You can see how a launch is advancing instead of waiting with no feedback after selecting a resource.

The indicator covers the launch from the moment a resource is selected to the point where the session window appears on screen. Adding an account and refreshing apps produce their own cards.

This feature is disabled by default.

Note:

This feature is in Technical Preview. Citrix recommends that you use it in nonproduction or limited production environments.

Configure the launch status indicator

The launch status indicator is disabled by default. To enable it, edit the $ICAROOT/config/AuthManConfig.xml file:

1. Open the $ICAROOT/config/AuthManConfig.xml file.
2. Set the required keys to true, as shown in the following table.
3. Save the file, and then restart Citrix Workspace app for the change to take effect.

For example, to enable both the launch status indicator and the store-operation cards:

<!-- LaunchStatusIndicatorEnabled - true, false -->
<key>LaunchStatusIndicatorEnabled</key>
<value>true</value>
<!-- LaunchStatusIndicatorPreLaunchEnabled - true, false -->
<key>LaunchStatusIndicatorPreLaunchEnabled</key>
<value>true</value>
<!--NeedCopy-->

Note:

LaunchStatusIndicatorEnabled controls the overall feature. When it is set to false, no cards appear for any operation. To show launch cards but not store-operation cards, set LaunchStatusIndicatorEnabled to true and leave LaunchStatusIndicatorPreLaunchEnabled set to false.

Known limitations

• Web and SaaS resources do not produce a status card, because they do not open an HDX session.
• The indicator supplements rather than replaces existing error messages in Citrix Workspace app.

Dynamic smart card support

Starting with Citrix Workspace app 2608 for Linux, you can use smart cards from different vendors on the same device without configuring a fixed driver. When you insert a card, Citrix Workspace app reads the card’s Answer To Reset (ATR), selects the matching PKCS#11 driver, and loads that driver automatically. Cards that you insert or remove during authentication are detected in real time, so you can switch between cards from different vendors without any manual steps.

Earlier, Citrix Workspace app for Linux could use only a single, fixed PKCS#11 driver. As a result, only one smart card type worked at a time, and an administrator had to configure the driver in advance.

This feature applies to client-side smart card authentication to Citrix StoreFront or NetScaler Gateway. In-session ICA smart card redirection is a separate, existing capability that is unchanged.

This feature is enabled by default (MultipleSmartCardSupported=true), so you do not have to configure a driver value.

Note:

The fixed-driver setting PKCS11module in the AuthManConfig.xml file is deprecated. It is used only as a fallback when MultipleSmartCardSupported is set to false. For more information, see Revert to a single fixed driver.

Prerequisites

If the dependencies are not already present, install them as follows:

On Ubuntu or Debian:

sudo apt-get install pcscd libpcsclite1 opensc
sudo systemctl enable --now pcscd
<!--NeedCopy-->

On RHEL:

sudo dnf install pcsc-lite pcsc-lite-ccid opensc
sudo systemctl enable --now pcscd
<!--NeedCopy-->

Install the vendor PKCS#11 package instead of, or in addition to, opensc when your card is not supported by OpenSC. For example, install SafeNet Authentication Client for Gemalto IDPrime .NET cards.

How it works

By default (MultipleSmartCardSupported=true), Citrix Workspace app does not load any PKCS#11 module at startup. When you insert a card, it reads the card’s ATR, selects the matching driver, and loads that driver. If you later insert a different card, Citrix Workspace app switches to the driver for that card automatically.

Citrix Workspace app selects the driver from the following three sources, checked in priority order. It uses the first source that matches the card and does not check the remaining sources.

Configure ATR-to-driver mappings

The smartcard_drivers.ini file maps a card’s ATR to its PKCS#11 driver. Citrix Workspace app uses only one file and does not merge the two files. When the system file is present, it takes precedence:

• $ICAROOT/config/smartcard_drivers.ini – The system default. This file is owned by root and is preferred.
• $HOME/.ICAClient/smartcard_drivers.ini – The per-user file, which is used only when the system file does not exist. This file is restricted for security. Citrix Workspace app ignores the [library_paths] section and any absolute driver paths, and accepts only driver file names that resolve within the standard system directories.

The file that ships with Citrix Workspace app already covers common cards, including YubiKey 5, 5 FIPS, and NEO, and Gemalto IDPrime MD, .NET, and .NET Astrid. It also includes an opensc-pkcs11.so fallback, so any card that OpenSC supports works without changes.

The file uses the following format:

[library_paths]
path1 = /usr/lib64/pkcs11
path2 = /usr/lib/x86_64-linux-gnu/pkcs11

[card:YubiKey_5]
driver = libykcs11.so
atr = 3BFD1300008131FE158073C021C057597562694B6579

[card:Gemalto_IDPrime_MD]
driver = opensc-pkcs11.so
atr = 3B7F9600008031B8658B0802

[fallback]
driver = opensc-pkcs11.so
<!--NeedCopy-->

To add a new card type, append a section with the driver and one or more ATR prefixes:

[card:MyNewCard]
driver = my-pkcs11-driver.so
atr = 3B12AB34CD
atr = 3B56EF7890
<!--NeedCopy-->

The following table describes the fields:

Revert to a single fixed driver

Dynamic, ATR-based selection is the default. If you need the legacy behavior, that is, a single, fixed PKCS#11 driver that is loaded at startup, you can turn off dynamic selection with the MultipleSmartCardSupported key in the AuthManConfig.xml file.

When MultipleSmartCardSupported is false, set the driver path in the deprecated PKCS11module key:

<key>MultipleSmartCardSupported</key>
<value>false</value>
<key>PKCS11module</key>
<value>/usr/lib64/pkcs11/opensc-pkcs11.so</value>
<!--NeedCopy-->

Note:

• PKCS11module is deprecated. Citrix Workspace app reads it only when MultipleSmartCardSupported=false. When MultipleSmartCardSupported=true (the default), Citrix Workspace app ignores it.
• If MultipleSmartCardSupported=false and PKCS11module is empty or unset, Citrix Workspace app does not load any PKCS#11 module and logs a warning. Smart card authentication does not work until you supply a driver path.
• In this mode, only one card type works at a time. This is the earlier behavior, which is retained only for backward compatibility. Keep MultipleSmartCardSupported=true unless you have a specific reason to use a single driver.

Use dynamic smart card support

1. Ensure that pcscd is running and the driver for your card is installed.
2. If your card is already covered by the smartcard_drivers.ini file or by the OpenSC fallback, no configuration is needed. Otherwise, add a [card:Name] entry as shown earlier.
3. Launch Citrix Workspace app or Self-Service and authenticate to your Citrix StoreFront or NetScaler Gateway store.
4. Insert the smart card when prompted, and then enter the PIN or select the certificate. Citrix Workspace app detects cards that you insert during authentication and loads the matching driver automatically.

Troubleshooting

Fixed issues

Known issues

• When you launch a seamless application from a Linux client configured with 300% dots per inch (DPI) scaling, the application window might display a non-seamless frame and the message Please wait… Adjusting screen resolution while the session window is being resized. This issue is specific to 300% DPI configurations on Linux clients. As a workaround, reduce the DPI scaling on the Linux client from 300% to 200% or 100%. [HDX-106160]

• On a Wayland desktop session, snapping a seamless application window to half the screen by dragging it to the top edge might cause the window to freeze and show a distorted or mirrored image. [HDX-101776]

  As a workaround, perform any of the following: - Click the affected window once to refresh it and return it to normal. - Use an Xorg desktop session instead of Wayland to avoid the issue.