Entra ID Authentication at eLux Login

Last published : Oct 16, 2026
This guide describes how to configure Microsoft Entra ID authentication at the eLux® login screen using FIDO2 (a passwordless sign-in standard that uses a security key), with single sign-on (SSO) into Citrix Workspace™ app (CWA). It applies to eLux 7.2609 with Citrix Workspace app 26.08.
At login, eLux opens Chrome to handle Entra ID sign-in instead of showing the built-in login screen. Chrome persists the Entra ID sign-in session, so CWA reuses it afterward for both the store and the VDA (Virtual Delivery Agent, the Citrix® component that hosts the session) — the user authenticates only once.
Related information
Persistent User Configurations

Prerequisites

The eLux image must include the following before you enable this feature:
Requirement Why
google_chrome EPM (eLux software package), including the google_chrome_sso_browser FPM (a feature within it) Provides /usr/bin/unicon-sso-browser, the wrapper that owns the shared browser profile. Verified with Chrome 149 and 153.
ica EPM — CWA 26.08.0.123 Supplies the store and VDA legs. CWA 26.08.0.153 is not usable: its shared-browser login window renders nothing and closes.
systemlibs_libxml2_utils (provides xmllint) /etc/elux/eluxd.d/ica validates AuthManConfig.xml with xmllint. If the binary is missing, the file is treated as invalid and all of sessions.ini [ICADefaults] is silently skipped, so FIDO2Enabled and AADSSOEnabled never reach CWA. Not included in the 2609 recovery base — add it to the image definition file (the .idf file that lists which packages the image installs).
Gateway or StoreFront CA certificate in /setup/cacerts The authentication step now runs in Chrome's own trust store instead of CWA's. An internal CA that CWA tolerated will fail with ERR_CERT_AUTHORITY_INVALID once this feature is enabled.

Configuration

Configure this feature as Scout advanced INI entries on the OU (organizational unit). All nine entries are required, and the device must restart afterward — the logon and lock screens decide whether to use Chrome for sign-in at startup.
File Section Key Value What it controls
terminal.ini [Security] SsoBrowserEnabled true The eLux side: logon screen, lock screen, and logout hook. Defaults to false. Does not affect CWA by itself.
terminal.ini [Security] BrowserTrustedUris https://accounts.<store-domain>;https://accounts.cloud.com;https://login.microsoftonline.com Origins Chrome may hand off to without prompting. Must include the identity provider's own host — the device cannot derive this from the store URL.
terminal.ini [Browser] SuppressPrompts true Generates the Chrome prompt-suppression policy.
sessions.ini [ICADefaults] FIDO2Enabled true Routes the store login through the shared browser.
sessions.ini [ICADefaults] FIDO2AuthBrowser unicon-sso-browser Specifies which browser to use.
sessions.ini [ICADefaults] FIDO2AuthTimeout 180 The default 60 seconds is not enough for an interactive sign-in, especially with a security key.
sessions.ini [ICADefaults] AADSSOEnabled true Routes the VDA login through the shared browser. Verified on-device: this key already defaults to true; only set it if you need to turn the behavior off (false).
sessions.ini [ICADefaults] AADSSOWithFido2AuthenticationEnabled true Pairs the VDA login with the FIDO2 browser.
sessions.ini [Chrome] ExtraFlags --hide-crash-restore-bubble Suppresses Chrome's "Restore pages?" prompt after a session ends.

Turning off the feature

Set these three keys to false to disable it:
Setting Value
terminal.ini [Security] SsoBrowserEnabled false
sessions.ini [ICADefaults] FIDO2Enabled false
sessions.ini [ICADefaults] AADSSOEnabled false
Setting only SsoBrowserEnabled to false turns off the eLux login and lock screen behavior, but CWA keeps using the shared browser if FIDO2Enabled and AADSSOEnabled are still true.