Product documentation
Linux Virtual Delivery Agent
Current Release 2507 LTSR 2411 2407 2402 LTSR 2311 2308 2305 2303 2301 2212 2210 2209 2207 2206 2204 2203 LTSR 2201 2112 2110 2109 2107 2106 2104 2103 1912 LTSR 7.15
View PDF

Integrate Non-domain-joined Linux VDA with Red Hat IdM

November 9, 2025
Contributed by: 
C

Red Hat Identity Management (IdM) is a widely adopted solution for managing identities in Linux environments. Compared to directly joining Linux systems to Active Directory (AD), IdM offers significant strategic and operational advantages—particularly in infrastructures with a substantial Linux footprint.

With Citrix Linux VDA has supported non-domain-joined (NDJ) deployments, organizations can consider integrating NDJ Linux VDAs with IdM. This approach expands the range of available authentication methods and enhances flexibility in identity management. Users should authenticate to their workspace using either AD domain credentials or credentials from an IdM domain that has established trust with AD. Once authenticated, they can seamlessly access Linux desktops joined to IdM via Single Sign-On (SSO).

The following outlines the verified integration and testing steps for configuring a Linux VDA with IdM.

  1. Prerequisites and Environmental Setup

  • Identity Management (IdM) Integration:

    • IdM Server Installation: The IdM server must be properly installed and its service operational. Refer to Red Hat document

  • Integrating IdM and AD:

    • Two-Way Trust: A two-way trust relationship should be established between IdM and AD to enable users from both domains to access each other’s services. Refer to Red Hat document

  • Validate Trust Relation in IdM Server:

    • Check IdM user permission: getentpasswd idmuser1@idm.example.com
    • Check AD user permission: getentpasswd aduser1@domain
  1. Create a Non-Domain-Joined Linux VDA Machine

To create a non-domain-joined Linux VDA, Refer to Create non-domain joined linux vdas using mcs

  1. Change the Default Logon Type on DDC

The default MachineLogOnType of a Delivery Group created by MCS is LocalMappedAccount. This needs to be set to ActiveDirectoryvia running below powershell command on DDC:

Set-BrokerDesktopGroup -Name "<your delivery group name>" -MachineLogOnType ActiveDirectory

  1. Install IdM Client and Join VDA to IdM

  • Install and configure IdM Client on the Linux VDA:

  • Verify the AD/IDM user authentication:

    • Check IdM user permission: ssh localhost -l idmuser1@idm.example.com
    • Check AD user permission: ssh localhost -l admuser1@domain
  1. Launch Session to Verify the Integration
  • For on-Prem Scenario: Both AD and IdM users can launch sessions with Linux VDAs integrated with IdM.
  • For DaaS Scenario: Due to IdM users not being able to utilize services belonging to the AD domain, only AD users can launch sessions with Linux VDAs integrated with IdM in a DaaS environment.
  1. Batch Provision Linux VDA Machines
  • Refer to step 2, Provision more Linux VDAs via MCS
  • Refer to step 4, Leverage 3rd party automation to join each VDA to IdM
Integrate Non-domain-joined Linux VDA with Red Hat IdM
November 9, 2025
Contributed by: 
C
November 9, 2025
Contributed by: 
C

In this article

Site feedback | Your privacy choices footer linkYour Privacy Choices | Privacy and legal terms | Cookie preferences | Consent settings | docs.cloud.com
© 1999- Cloud Software Group, Inc. All rights reserved.