AD Credentials Pass-Through for Google Chrome

Last published : Oct 16, 2026
Related information
Persistent User Configurations

Overview

eLux supports Active Directory (AD) credential pass-through for Google Chrome, enabling seamless access to internal web resources without repeated authentication prompts.
Important:
This SSO Support option cannot be enabled together with Chrome Enterprise Premium (CEP). CEP already provides single sign-on for Citrix Secure Access™. If CEP is enabled, disable this SSO Support option in the image definition.

Key Capabilities

  • Single sign-on (SSO) After logging in to eLux with AD credentials, Google Chrome automatically reuses the same Kerberos-based authentication context (Kerberos TGT).
  • Policy-Controlled Experience Chrome enforces centrally defined policies, ensuring transparent and compliant access to corporate web services.

Prerequisites

Ensure the following conditions are met before configuration:
  • AD authentication is enabled and functional in Scout.
  • The user successfully logs in to eLux with AD credentials.
  • Google Chrome is installed on the eLux endpoint.
  • You have sufficient permissions to modify the device profile in Scout.

Configuration (Scout)

  1. Open the relevant device profile in Scout.
  2. Navigate to Applications → Google Chrome → Free parameters.
  3. Add the following parameter and save the configuration: AllowSSOLists=example.com Notes:
    • "example.com" is an example and may be exchanged with your domains.
    • The parameter accepts a comma separated list of domains.
    • The parameter accepts Google Chrome policy wildcards (e.g. *.example.com)
  4. Save and deploy the profile to the target devices.

End-User Experience

  1. The user logs in to eLux using their AD credentials.
  2. Google Chrome is launched (manually or via autostart).
  3. When accessing any domain listed in AllowSSOLists, Chrome performs automatic authentication without prompting for credentials.

Troubleshooting

Google Chrome still prompts for a password

  • Verify the user logged in with an AD account.
  • Confirm the destination site is included in AllowSSOLists.
  • Redeploy the Scout profile if changes were made recently.

Policy not applied

  • In Chrome, enter chrome://policy and check that AuthNegotiateDelegateAllowlist shows the expected entries.

Need Help?

Contact your system administrator or eLux support for further assistance.