This content has been machine translated dynamically.
Dieser Inhalt ist eine maschinelle Übersetzung, die dynamisch erstellt wurde. (Haftungsausschluss)
Cet article a été traduit automatiquement de manière dynamique. (Clause de non responsabilité)
Este artículo lo ha traducido una máquina de forma dinámica. (Aviso legal)
此内容已经过机器动态翻译。 放弃
このコンテンツは動的に機械翻訳されています。免責事項
이 콘텐츠는 동적으로 기계 번역되었습니다. 책임 부인
Este texto foi traduzido automaticamente. (Aviso legal)
Questo contenuto è stato tradotto dinamicamente con traduzione automatica.(Esclusione di responsabilità))
This article has been machine translated.
Dieser Artikel wurde maschinell übersetzt. (Haftungsausschluss)
Ce article a été traduit automatiquement. (Clause de non responsabilité)
Este artículo ha sido traducido automáticamente. (Aviso legal)
この記事は機械翻訳されています.免責事項
이 기사는 기계 번역되었습니다.책임 부인
Este artigo foi traduzido automaticamente.(Aviso legal)
这篇文章已经过机器翻译.放弃
Questo articolo è stato tradotto automaticamente.(Esclusione di responsabilità))
Translation failed!
Entra ID Authentication at eLux Login
This guide describes how to configure Microsoft Entra ID authentication at the eLux® login screen using FIDO2 (a passwordless sign-in standard that uses a security key), with single sign-on (SSO) into Citrix Workspace™ app (CWA). It applies to eLux 7.2609 with Citrix Workspace app 26.08.
At login, eLux opens Chrome to handle Entra ID sign-in instead of showing the built-in login screen. Chrome persists the Entra ID sign-in session, so CWA reuses it afterward for both the store and the VDA (Virtual Delivery Agent, the Citrix® component that hosts the session) — the user authenticates only once.
Prerequisites
The eLux image must include the following before you enable this feature:
| Requirement | Why |
|---|---|
google_chrome EPM (eLux software package), including the google_chrome_sso_browser FPM (a feature within it) |
Provides /usr/bin/unicon-sso-browser, the wrapper that owns the shared browser profile. Verified with Chrome 149 and 153. |
ica EPM — CWA 26.08.0.123 |
Supplies the store and VDA legs. CWA 26.08.0.153 is not usable: its shared-browser login window renders nothing and closes. |
systemlibs_libxml2_utils (provides xmllint) |
/etc/elux/eluxd.d/ica validates AuthManConfig.xml with xmllint. If the binary is missing, the file is treated as invalid and all of sessions.ini [ICADefaults] is silently skipped, so FIDO2Enabled and AADSSOEnabled never reach CWA. Not included in the 2609 recovery base — add it to the image definition file (the .idf file that lists which packages the image installs). |
Gateway or StoreFront CA certificate in /setup/cacerts
|
The authentication step now runs in Chrome’s own trust store instead of CWA’s. An internal CA that CWA tolerated will fail with ERR_CERT_AUTHORITY_INVALID once this feature is enabled. |
Configuration
Configure this feature as Scout advanced INI entries on the OU (organizational unit). All nine entries are required, and the device must restart afterward — the logon and lock screens decide whether to use Chrome for sign-in at startup.
| File | Section | Key | Value | What it controls |
|---|---|---|---|---|
terminal.ini |
[Security] |
SsoBrowserEnabled |
true |
The eLux side: logon screen, lock screen, and logout hook. Defaults to false. Does not affect CWA by itself. |
terminal.ini |
[Security] |
BrowserTrustedUris |
https://accounts.<store-domain>;https://accounts.cloud.com;https://login.microsoftonline.com |
Origins Chrome may hand off to without prompting. Must include the identity provider’s own host — the device cannot derive this from the store URL. |
terminal.ini |
[Browser] |
SuppressPrompts |
true |
Generates the Chrome prompt-suppression policy. |
sessions.ini |
[ICADefaults] |
FIDO2Enabled |
true |
Routes the store login through the shared browser. |
sessions.ini |
[ICADefaults] |
FIDO2AuthBrowser |
unicon-sso-browser |
Specifies which browser to use. |
sessions.ini |
[ICADefaults] |
FIDO2AuthTimeout |
180 |
The default 60 seconds is not enough for an interactive sign-in, especially with a security key. |
sessions.ini |
[ICADefaults] |
AADSSOEnabled |
true |
Routes the VDA login through the shared browser. Verified on-device: this key already defaults to true; only set it if you need to turn the behavior off (false). |
sessions.ini |
[ICADefaults] |
AADSSOWithFido2AuthenticationEnabled |
true |
Pairs the VDA login with the FIDO2 browser. |
sessions.ini |
[Chrome] |
ExtraFlags |
--hide-crash-restore-bubble |
Suppresses Chrome’s “Restore pages?” prompt after a session ends. |
Turning off the feature
Set these three keys to false to disable it:
| Setting | Value |
|---|---|
terminal.ini [Security] SsoBrowserEnabled
|
false |
sessions.ini [ICADefaults] FIDO2Enabled
|
false |
sessions.ini [ICADefaults] AADSSOEnabled
|
false |
Setting only SsoBrowserEnabled to false turns off the eLux login and lock screen behavior, but CWA keeps using the shared browser if FIDO2Enabled and AADSSOEnabled are still true.
Share
Share
In this article
This Preview product documentation is Citrix Confidential.
You agree to hold this documentation confidential pursuant to the terms of your Citrix Beta/Tech Preview Agreement.
The development, release and timing of any features or functionality described in the Preview documentation remains at our sole discretion and are subject to change without notice or consultation.
The documentation is for informational purposes only and is not a commitment, promise or legal obligation to deliver any material, code or functionality and should not be relied upon in making Citrix product purchase decisions.
If you do not agree, select I DO NOT AGREE to exit.