Citrix Workspace app for Linux 2601 - Preview

You can download Citrix Workspace app for Linux 2601 preview version from the Downloads page.

Note:

This is an Early Access Build shared for the purpose of testing or validation with the intent to make organizations ready for the upcoming release and is NOT advised to be deployed in production environments.

What’s new

The following features are available in this release:

• Seamless Integration of Endpoint Analysis (EPA)
• Entra ID single sign-on (SSO) from web browsers
• Single sign-on (SSO) through cookie sharing for on-premises stores
• Microsoft Edge support for FIDO2 and Entra ID SSO
• FIDO2 authentication timeout configuration
• Identity Provider (IDP) logout on Workspace (WSP) inactivity timeout
• Automatic Maximum Transmission Unit (MTU) adaptation
• Audio Quality Enhancer for reliable transport (Technical Preview)
• Enhanced keyboard settings
• Transparent key pass-through on Wayland and XWayland
• Improved session reconnection experience (Technical Preview)
• Extended logging support

Seamless Integration of Endpoint Analysis (EPA)

Starting with version 2601, Citrix Workspace app for Linux prompts administrators to install the Endpoint Analysis (EPA) plug-in and installs it only when it detects an older EPA version; equal or newer versions remain unchanged.

Entra ID single sign-on (SSO) from web browsers

Starting with version 2601, Citrix Workspace app for Linux supports Entra ID single sign-on (SSO) from web browsers through the Citrix Web Extension. This feature is enabled by default.

Prerequisites:

The following libraries are required:

• gnome-keyring version 3.18.3 or later

  If you are using Debian, run the following command:

   sudo apt-get install gnome-keyring
   <!--NeedCopy-->
  

  If you are using RPM, run the following command:

   sudo yum install gnome-keyring
   <!--NeedCopy-->
  

• libsecret

  If you are using Debian, run the following command:

   sudo apt-get install libsecret-1-0
   <!--NeedCopy-->
  

  If you are using RPM, run the following command:

   sudo yum install libsecret-1*
   <!--NeedCopy-->
  

Single sign-on (SSO) through cookie sharing for on‑premises stores

Starting with version 2601, Citrix Workspace app for Linux extends Single Sign-On (SSO) support to on‑premises stores, including both direct StoreFront stores and those accessed through a gateway. This enhancement delivers seamless authentication for on‑premises environments by applying cookie sharing through the Credential Insertion SDK.

SSO support for cloud-based stores was added in version 2508 using the CitrixSSOnSDK::LogonSsoCookies API to inject validated cookies. The same SDK and API are now used for on‑premises stores as well.

For stores behind a gateway, authentication occurs during the store addition phase. Therefore, cookies must be injected into AuthManager’s cache before adding the store, and the AuthManager daemon must be running. To ensure AuthManager is running, execute storebrowse --liststore. This command lists existing stores and starts the AuthManager daemon if it is not already running.

In addition to injecting cookies obtained from identity providers, you can optionally inject an AAAC cookie for stores behind a gateway. Injecting an AAAC cookie prompts AuthManager to directly initiate a Gateway session.

For more information on cookie sharing, see the Credential Insertion SDK documentation.

Microsoft Edge support for FIDO2 and Entra ID SSO

Starting with version 2601, Citrix Workspace app for Linux adds support for using Microsoft Edge for:

• FIDO2 authentication
• Entra ID Single Sign-On (SSO) using the system browser

To configure Microsoft Edge for these flows, edit AuthManConfig.xml located at /opt/Citrix/ICAClient/config/AuthManConfig.xml.

Use Microsoft Edge as the browser for FIDO2 authentication:

<!-- FIDO2AuthBrowser - CEB, chromium, firefox, chromium-browser, edge -->
<FIDO2AuthBrowser>edge</FIDO2AuthBrowser>
<!--NeedCopy-->

Use Microsoft Edge as the system browser for Entra ID SSO:

<!-- SystemBrowser - CEB, chromium, firefox, chromium-browser, edge -->
<SystemBrowser>edge</SystemBrowser>
<!--NeedCopy-->

These settings ensure that both FIDO2 authentication and Entra ID SSO flow launch using Microsoft Edge.

FIDO2 authentication timeout configuration

Starting with version 2601, Citrix Workspace app for Linux provides a configuration option to control the browser-based FIDO2 authentication timeout.

To configure, open /opt/Citrix/ICAClient/config/AuthManConfig.xml and set the timeout (in seconds) using FIDO2AuthTimeout:

<!-- FIDO2AuthTimeout - Authentication timeout in seconds (default: 60, max: 180) -->
<FIDO2AuthTimeout>60</FIDO2AuthTimeout>
<!--NeedCopy-->

Note:

Set the timeout to a value between 60 and 180 seconds, as required.

Identity Provider (IDP) logout on Workspace (WSP) inactivity timeout

Starting with version 2601, Citrix Workspace app for Linux adds support for logging out of the Identity Provider (IDP) during user logoff and when a Workspace (WSP) inactivity timeout occurs. This opt-in feature helps ensure complete session termination across the authentication chain while preserving existing logout behavior unless enabled.

To configure this feature, edit AuthManConfig.xml located at /opt/Citrix/ICAClient/config/AuthManConfig.xml.

Default setting:

<!-- EnableChainedLogoffOnTimeout - true, false -->
<EnableChainedLogoffOnTimeout>false</EnableChainedLogoffOnTimeout>
<!--NeedCopy-->

To enable the feature,

<!-- EnableChainedLogoffOnTimeout - true, false -->
<EnableChainedLogoffOnTimeout>true</EnableChainedLogoffOnTimeout>
<!--NeedCopy-->

Note:

This feature is disabled by default. Contact your admin to enable this feature if needed.

Automatic Maximum Transmission Unit (MTU) adaptation

Starting with version 2601, Citrix Workspace app for Linux supports dynamic adjustment of the session’s Maximum Transmission Unit (MTU). This feature automatically detects and adjusts the MTU during a session if the network path changes. This feature is disabled by default.

To enable this feature:

1. Navigate to the $HOME/.ICAClient/wfclient.ini.

2. In the [WFClient] section, add:

   MtuRediscovery = On
   <!--NeedCopy-->
   

For more information, see the EDT MTU Discovery section in the Citrix Virtual Apps and Desktops documentation.

Audio Quality Enhancer for reliable transport (Technical Preview)

Starting with version 2601, audio quality enhancer is also available for connections over reliable transport (that is, TCP and EDT-Reliable). Under poor network conditions, both audio playback and recording have a smoother experience with reduced latency.

To enable and disable this feature, see Audio quality enhancer for Linux VDA.

Note:

• Adaptive audio must be enabled for this feature to work.
• This feature is disabled by default in Technical Preview (over reliable transport).
• This feature must be enabled on both VDA and CWA.
• This feature is supported with Linux VDA version 2511 and later, and Mac VDA version 2507 and later.

Enhanced keyboard settings

Starting with version 2601, Citrix Workspace app for Linux introduces enhanced keyboard settings that provide improved control over system shortcuts and keyboard input modes. These enhancements include UI settings for system shortcut pass-through (transparent key pass-through) and an automatic mode for keyboard input that dynamically selects the best input method based on the VDA type.

System shortcut pass-through settings

To configure system shortcut pass-through:

1. Select the Keyboard tab.

2. In the System shortcut pass-through settings section, select one of the following options:

   • Local device – Shortcuts are sent to the local Linux client.
   • Fullscreen HDX session only (Default) – When the VDA session is in full-screen mode, shortcuts are sent to the VDA session. Otherwise, shortcuts are sent to the local Linux client.
   • Remote session – Shortcuts are sent to the VDA session.

Note:

Keyboard configuration changes take effect in real time.

Automatic keyboard input mode

To configure keyboard input mode:

1. Select the Keyboard tab.

2. In the Keyboard input mode settings section, select one of the following options:

   • Automatic (Default) – Dynamically selects the keyboard input mode based on the current session. For Linux VDA sessions, the input mode is Scancode. For Windows VDA or Mac VDA sessions, the input mode is Unicode.
   • Scancode
   • Unicode

Note:

The keyboard configuration changes take effect when you modify the configuration in the UI.

Transparent key pass-through on Wayland and XWayland

Starting with version 2601, Citrix Workspace app for Linux supports reliable transparent key pass-through on Wayland and XWayland. System-level keyboard shortcuts (for example, Alt+Tab) pass through to the HDX session and are not intercepted by the local Linux desktop.

Improved session reconnection experience (Technical Preview)

Starting with version 2601, this feature enhances the end-user experience during session timeouts caused by inactivity or network interruptions. Users can reconnect directly from the timeout screen for both desktop and app sessions, and also reconnect after the Auto-Client-Reconnect (ACR) phase. This feature is enabled by default.

Prerequisites:

• Citrix Virtual Apps and Desktops: Version 2511 or later
• Citrix Workspace app: Version 2511 or later

The key features are as follows:

• Displaying specific reasons for session timeouts, such as Device went to sleep, or Network disruption.
• Allowing seamless reconnection to new or existing sessions based on administrator configuration.
• Supporting scenarios where auto reconnect might fail, such as network switches (for example, Wi‑Fi to LAN).
• Supporting direct reconnection after the Auto-Client-Reconnect (ACR) phase.

Note:

• The new reconnection feature does not support the hybrid-launched sessions.

• If a customer experiences a “Failed to reconnect” error immediately after clicking the Reconnect button:

  • Open .HOME/.ICAClient/All_Region.ini.
  • If the following section is not present, add it to the end of the file:

  [Network\Relaunch]
  ResourceName=
  ResourceID=
  StoreURL=
  <!--NeedCopy-->
  

Extended logging support

Starting with version 2601, Citrix Workspace app for Linux adds a configuration option to enable extended logging for easier diagnostics.

To enable extended logging:

1. Edit the AuthManConfig.xml file at /opt/Citrix/ICAClient/config/AuthManConfig.xml.
2. Set ExtendedLoggingEnabled to true.

Example:

<!-- ExtendedLoggingEnabled - true, false (Collects verbose, service record, and dslogs) -->
<key>ExtendedLoggingEnabled</key>
<value>false</value>

<!-- To enable extended logging -->
<key>ExtendedLoggingEnabled</key>
<value>true</value>
<!--NeedCopy-->

When enabled, extended logs are collected for ServiceRecord and dslogs in Citrix Workspace app for Linux.

Fixed issues

• You might have noticed unexpected behavior where certain browser keyboard shortcuts could launch a non-sandboxed browser window during a Browser Content Redirection (BCR) session. The affected shortcuts are now blocked and can no longer trigger this action. [CVADHELP-30447]
• You might have noticed an issue where Bloomberg keyboard special function keys (top row green keys) did not function correctly in ICA sessions. The keys now work as expected. [HDX-97528]

Known issues

There are no new known issues.