Tech Brief: Seamless Authentication Options on Citrix Workspace app

Overview

Citrix Workspace app (CWA) provides users a personalized interface that enables instant access to virtual applications, desktops, SaaS, and web apps. Users get seamless and secure access to all the apps needed to stay productive, including features like embedded browsing and single sign-on.

CWA provides several authentication options administrators can enable in line with the identity provider enabled in your organization across on-premises and cloud environments.

Force Login Prompt

Force Login Prompt is a feature that allows administrators to configure CWA to prompt users for their login credentials each time they access the application, even if they have previously logged in and have a valid session. The IDP stores user credentials via persistent cookies to enable single sign-on (SSO) and provide a seamless user experience. However, there can be scenarios where administrators want to force users to enter their login credentials each time they access Citrix resources, such as when the user is accessing sensitive data or applications or when there are security concerns.

The Force Login Prompt setting is enabled by default. This setting allows administrators to force Citrix Workspace login to override the IdP timeout. If the setting is disabled, the IdP timeout is honored. It is important to note that enabling this feature can impact user productivity and increase the frequency of login-related issues. Therefore, use this setting judiciously and only in scenarios necessary for security or compliance purposes.

The Force Login Prompt setting must be disabled when:

• Administrators want to provide users accessing the CWA over the web (including HTML5 clients) with longer-lived login. For example, if administrators have set Azure Active Directory (AAD) to have a 14-day default timeout, login again in the browser does not occur.
• CWA would auto log in for AAD-joined client devices. Otherwise, CWA forces prompt a login even though SSO is enabled.

Persistent Login to Citrix Workspace app

Persistent Login is a feature of CWA that allows users to remain logged in even after they close disconnect from their virtual desktop or application session. This means that users do not have to enter their credentials each time they access Citrix, providing a more streamlined and convenient experience.

Persistent Login creates a long-lived authentication token that can be set anywhere from 2 to 365 days and stored on the user’s device. This token is encrypted and can be configured to expire after a set period or when the user logs out of Citrix. When the user returns to CWA, the app checks for the token and, if found, logs the user back in automatically.

Persistent Login is compatible with various authentication methods, including Active Directory, LDAP, and SAML. This feature helps improve user productivity by eliminating the need for users to enter their credentials repeatedly while also maintaining the environment’s security by requiring authentication when the token expires, or the user logs out. For any newly configured store, it is enabled by default with a value of 30 days.

Note

As of this writing, the authentication timeout option is available for CWA client apps. Browser access is not supported. It is recommended to use the inactivity timer if frequent authentication is a use case for your environment.

Behavior on Cloud stores

Note

The Persistent Login feature is currently not supported for on-premises stores.

Persistent Login to VDI sessions

The Persistent Login to VDI sessions option enables users to single sign-on (SSO) to VDI sessions using a long-lived password instead of entering their credentials each time they access their VDI environment. This eliminates the need for users to enter their credentials multiple times and simplifies the authentication process. This is set to a value the same as persistent login to CWA between 2 and 365 days.

Key factors to be noted:

• Log in to VDI with SSO can occur only when the IdP is AD, AD+TOTP, or Citrix Gateway.
• In all other cases (AAD, Okta, Google, SAML, and so forth) Citrix Federated Authentication Service (FAS) is required.

Inactivity Timer for Citrix Workspace app

The Inactivity Timer for Citrix Workspace app - Authentication Timeouts option enables administrators to enforce an authentication check in the event of inactivity on the application by end users. This option is used to ensure secure access to resources by legitimate users using their devices or shared devices. The inactivity timeout can be set at anything less than 24 hours.

Key behavior to be noted:

• Inactivity overrides Persistent Login experience.
• In desktops, users are logged out after the inactivity timeout.
• In mobile, users can use biometric authentication after the inactivity timeout but not logged out.

Domain pass-through support on Citrix Workspace

Domain pass-through support for Citrix Workspace allows users to access virtual desktops and applications without the need to authenticate explicitly to the Citrix environment. Instead, users can use their Windows domain credentials to authenticate and gain access to their applications and desktops automatically.

When domain pass-through support is enabled, users logged in to their Windows desktop or laptop with their domain credentials can access their Citrix Workspace account and any associated virtual desktops or applications without reentering their credentials. This eliminates the need for users to remember multiple sets of login information and simplifies the authentication process.

Pre-requisites and conditions to be noted:

• Citrix Workspace must be configured with an IdP that supports Integrated Windows Auth: For example, Citrix Gateway, AAD (with AAD Seamless SSO), Okta, SAML, and so forth
• This option works best on Windows clients.
• For Windows, clients can be AD or hybrid AAD joined.
• Linux thin clients can also be configured with a Kerberos profile.
• iOS/Mac also has a concept of Kerberos profile. In addition, they also can be enrolled in AAD using Intune, which allows SSO to AAD.
• For SSO to VDI on non-windows clients. FAS is required.
• End-to-end login to CWA for Windows with SSO to VDI works if the user logs in to Windows OS using user name and password.

Notes

Clients need to be reachable to AD for Kerberos to work.

SSONSvr works only with a user name and password on the client. FAS is required if a user uses Windows Hello to log in and expects passwordless login.

Authentication may not be promptless in the cloud if LLT is enabled or if the end-user acceptance policy is configured.

Recommend configuring FAS as it applies to non-windows platforms.

Domain Pass-through Support for StoreFront

Domain pass-through support for Citrix StoreFront allows users to access virtual desktops and applications without the need to authenticate explicitly to the Citrix environment. Instead, users can use their Windows domain credentials to authenticate and gain access to their applications and desktops automatically.

With domain pass-through support enabled, users logged in to their Windows desktop or laptop with their domain credentials can access their Citrix applications and desktops without having to reenter their credentials. This provides a more seamless user experience and helps to reduce the burden on IT support teams who would otherwise have to manage password resets and user authentication issues.

Pre-requisites and conditions to be noted:

• Configured in Windows.
• Credential Insertion: healthcare software partners provide a user name and password to CWA to silently authenticate users.
• This is also applied on Linux and uses a similar credential Insertion SDK. SSO to VDI works the same as point 7 for on-premises stores.

Note

Needs registry to enable SSO

Smart card/Derived Credentials Support

Smart card authentication and derived credential authentication are both methods of authentication into CWA and login to the VDI session that this option supports.

Smart card authentication involves using a physical smart card that contains the user’s digital identity information, such as a public key certificate or private key. When the user inserts the smart card into a card reader, the card reader reads the digital identity information and sends it to CWA for authentication. This method ensures higher security than traditional user name and password authentication, as the smart card cannot be easily duplicated or stolen.

On the other hand, Derived credential authentication is using a mobile device to authenticate a user. When a user logs into CWA on their mobile device, the device generates a derived credential based on their digital identity information. The derived credential is then sent to CWA for authentication rather than the user’s physical smart card. This method offers users a higher level of convenience, as they can authenticate themselves using their mobile devices without carrying a separate smart card.

Password-less Authentication (Workspace)

Notes

Any IdP that supports smart card authentication via federation can support SSO.

Support for iOS exists with Purebred only.

Pasword-less Authentication (StoreFront)

FIDO2 support with Workspace/Storefront- Passwordless Auth

FIDO2 is an authentication standard that allows users to securely and conveniently authenticate to online services using public key cryptography. FIDO2 enables passwordless authentication, eliminating users’ need to create and remember passwords and reducing the risk of phishing and other cyber-attack forms.

With CWA FIDO2 support, users can enjoy a passwordless authentication experience that is both secure and convenient. They can lo into their Citrix Workspace account without remembering passwords, making it easier to work securely from anywhere and on any device. FIDO2 support also helps to enhance security posture by reducing the risk of password-related cyber-attacks.