Citrix Workspace app for Linux 2204 - Technology Preview

Note: This is an Early Access Build shared for the purpose of testing/validation with the intent to make organizations ready for the upcoming release and is NOT advised to be deployed in production environments. 

We are excited to share with you the Early Access Release of our next version of Citrix Workspace app for Linux.    

Please provide your feedback here before 21st Apr 2022.

What's new in 2204

Authentication enhancement for Storebrowse

Starting with this release, the authentication dialog is present inside Citrix Workspace app and the store details are displayed on the logon screen for a better user experience. The authentication tokens are encrypted and stored so that you don’t need to reenter credentials when your system or session restarts. 

The authentication enhancement supports storebrowse for the following operations:

• Storebrowse -E: Lists the available resources.
• Storebrowse -L: Launches a connection to a published resource.
• Storebrowse -S: Lists the subscribed resources.
• storebrowse -T: Terminates all sessions of the specified store.
• storebrowse -Wr: Reconnects the disconnected yet active sessions of the specified store. The [r] option reconnects all the disconnected sessions.
• storebrowse -WR: Reconnects the disconnected yet active sessions of the specified store. The [R] option reconnects all the active and disconnected sessions.
• storebrowse -s: Subscribes the specified resource from a given store.
• storebrowse -u: Unsubscribes the specified resource from a given store.
• storebrowse -q: Launches an application using the direct URL. This command works only for StoreFront stores.

Note:

• You can continue to use the remaining storebrowse commands as used earlier (using AuthMangerDaemon).
• The authentication enhancement is applicable for cloud deployments only.
• With this enhancement, persistent login feature is supported.

Authentication enhancement configuration

By default, the authentication enhancement feature is enabled.

To disable the authentication enhancement, do the following:

1. Navigate to /opt/Citrix/ICAClient/config/AuthmanConfig.xml.

2. Update the following entry:

<AuthManLiteEnabled>false</AuthManLiteEnabled>

If the gnome-keyring is not available, the token is stored in the selfservice process memory.  

To enforce storage of token in memory, disable gnome-keyring, using the following steps:

1. Navigate to /opt/Citrix/ICAClient/config/AuthmanConfig.xml.

2. Add the following entry:

<GnomeKeyringDisabled>true</GnomeKeyringDisabled>

Persistent login (Technical Preview)

The Persistent login feature enables you to stay logged in for up to the duration (2 to 365 days) configured by your admin. When this is enabled, you need not provide login credentials for the Citrix Workspace App during the configured period.

With this functionality, the SSO to Citrix DaaS sessions is extended up to a period of 365 days depending upon the lifetime of Long-Lived Tokens. Your credentials are cached by default for 4 days (or Lifetime whichever is lower) and then extended when you become active within these 4 days (by connecting to Citrix Workspace App).

Note:

Technical previews are available for customers to test in their non-production or limited production environments, and to give customers an opportunity to share feedback. Citrix does not accept support cases for feature previews but welcomes feedback for improving them. Citrix might or might not act on feedback based on its severity, criticality, and importance. It is advised that Beta builds aren’t deployed in production environments.

Configure the persistent login feature

An admin need to configure the persistent login on the Workspace environment using the following procedure:

1. Sign in to Citrix Cloud.

2. In the Citrix Cloud console, click the menu in the upper left corner of the screen.

3. Select the Workspace Configuration option > Customize > Preferences.

4. Scroll down to Reauthentication Period for Workspace App

5. Click Edit next to the Current Reauthentication Period field.

6. Enter the required days in the Current Reauthentication Period field.

          You need to enter two days or more in the Current Reauthentication Period field.

For more information, see the instructions in the "Reauthentication Period for Workspace App section".

Experience with enhanced authentication

The persistent login window is embedded within the self-service window.

1. Access the Citrix Workspace app.

The authentication window appears.

2. Sign in with your credentials.

You are redirected to the Permission prompt to accept.

3. Click Allow.

Note: If you select "Deny" for consent,  you would see a second login prompt and you need to sign in to Citrix Workspace app for every 24 hours.

Disable the persistent login feature

An admin can disable the persistent login feature in the Citrix Cloud UI or in the AuthManConfig.xml  file.  However, the value set in the AuthManConfig.xml file overrides the value set in the Citrix Cloud UI.

Using Citrix Cloud UI

1. Login to Citrix Cloud.

2. In the Citrix Cloud console, click the menu in the upper left corner of the screen.

3. Select the Workspace Configuration option > Customize > Preferences.

4. Scroll down to Reauthentication Period for Workspace App.

5. Click Edit next to Current Reauthentication Period field.

6. Enter one day in the Current Reauthentication Period field.

Using AuthManConfig.xml file

To disable persistent feature, do the following:

1. Navigate to <ICAROOT>/config/AuthManConfig.xml file.

2. Set the values as follows:

<!-- AuthManLiteEnabled - enable AML - true/false -->

<key>AuthManLiteEnabled</key>

<value>true</value> 

<AuthManLite>

<primaryTokenLifeTime>1.00:00:00</primaryTokenLifeTime>

<secondaryTokenLifeTime>0.01:00:00</secondaryTokenLifeTime>

<longLivedTokenSupport>false</longLivedTokenSupport>  

<nativeLoggingEnabled>true</nativeLoggingEnabled>

<platform>linux</platform>

<saveTokens>true</saveTokens>

</AuthManLite>

Email-based auto-discovery of store

Note: This feature is generally available for Citrix Workspace app.

You can now provide your email address in Citrix Workspace app to automatically discover the store associated with the email address. If there are multiple stores associated with a domain, by default the first store returned by the Global App Configuration Service is added as the store of choice. Users can always switch to another store if necessary.

To disable this feature, do the following:

1. Navigate to $ICAROOT/config/AuthManConfig.xml.

2. Set the following entry to false.

 <key>AppConfigEnabled</key> 

<value>false</value>

Provision to disable LaunchDarkly service

Starting with this release, you can disable LaunchDarkly service on Citrix Workspace app.

To disable the LaunchDarkly service, do the following:

1. Navigate to the <ICAROOT>/config/module.ini  folder and go to the LaunchDarkly section.

2. Select the entry EnableLaunchDarkly  and set it to Disable.

Fixed issues in 2204

• The DNS server in a customer environment with limited internet access might not resolve the URL, clientstream.launchdarkly.com. As a result, Citrix Workspace app sends a large number of DNS queries (>1000 within three seconds per day) to the URL. [CVADHELP-19559]
• When the app protection feature is enabled, the anti-keylogging functionality might not work for the Authentication Manager interface that uses the UIDialogLibWebKit3.so library. This issue is resolved in gnome and kde desktop environment. [RFLNX-8027]
• Attempting to print from a VDA session running on Raspberry Pi ARMHF client version 3 or 4 might make the session unresponsive. [CVADHELP-18506]
• When you launch the self-service user interface after setting the `AMLDebugMode` and `AuthManLiteEnabled` to True, the following error message might appear:

“Response for Secondary Token request is not 200/400/404 42”

This issue occurs on Fedora 35. [RFLNX - 8603]

Known issue in 2204

No new issues have been observed in this release.