Hi All, we have some VDAs with Imprivata agent installed. We have Gateway configured with SAML auth and FAS servers for VDA login, but VDAs with Imprivata agent are not doing SSO to VDA. Anyone got this working?

Imprivata has a guide, to setup Citrix FAS with Imprivata. This needs to be followed to the point, otherwise it doesn't work.

Yeah we have it working I will look at my notes on monday

@Daniel Madsen - Could you share the link? I am not able to find it.

@Srinivasan Shanmugam unfortunately no 😞 I don't have access to Imprivata docs anymore

imprivata probably disables the normal login method that FAS needs, installing the DUO agent does the same thing. There’s likely an authentication providers whitelist registry setting somewhere and you’ll need to add them back in.

from my notes- Subject: Re: Case #: Citrix FAS with Imprivata Hi. This morning I ran through a test of using the same keytab file in two seperate Imprivata Enterprises. The ktpass command had to be used, and not the ISXKerbUtil tool. The steps taken were: - 1. Create Keytab file Firstly, on a Windows Server in the same domain as the appliances check if an account already exists with the SPN, type the following: • setspn -q host/ssohost4kerberos.domain.xxx Next, on the same server delete the SPN as part of your troubleshooting, type the following: • setspn -d host/ssohost4kerberos.domain.xxx SSOKerberos Again on the same server use the ktpass command to create the keytab • ktpass -mapuser SSOKerberos@domain.xxx -pass XXXXXXX -princ host/ssohost4kerberos.domain.xxx@DOMAIN.XXX -out OneSign.keytab -ptype KRB5_NT_PRINCIPAL -crypto ALL These Windows commands are very case sensitive. See the attached "Error Creating and Uploading keytab File" document for further details. 2. Upload Keytab In the Imprivata Admin Console on both Enterprises navigate to Users > Directories, select the domain. Then delete any pre-existing keytab files and upload and apply the new keytab file. Then I followed the remaining instructions of the attached "Configuring Kerberos Authentication.pdf" document. • Step 5: Verify that the Keytab File Uploaded to the Appliance • Step 6: Configure a Computer Policy for Kerberos Authentication • Step 7: Disable the Imprivata OneSign Login Module • Step 8: Enable the Imprivata Credential Manager Module