https://worldofeuc.com logo
Join Slack
Powered by
Do passkeys work inside a session? Asking since f...
# citrix-vad
p
Do passkeys work inside a session? Asking since for us we are always prompted for a hardware device.
j
yes, you need to pass them through to the session using the whitelist in fido2 redirection
Append the full path of the msedgewebview2.exe in the AllowedProcesses registry value: • Key: HKLM\SOFTWARE\Citrix\WebAuthnAllowedProcesses • Value name: AllowedProcesses • Value type: REG_MULTISZ • Value data: 
<add full path of the msedgewebview2.exe here >
this doc is super helpful
p
thank you. I was on that doc but did not make my way to the bottom of it
j
the tricky part is getting the right processes to allow. my best advice is to look at task manager when the "insert hardware device" box pops up and you can find out what its spawning from
i had to disable updating of msedgewebview2 because the path changed everytime it updated, then broke the passthrough
then when updating manually, I would add the path in the registry/gpo
s
This should ideally work. As Josh mentioned, the processes trying to interact with WebAuthn will have to be allowlisted in the registry.
p
Hmm. Not working for me. I guess i need to open a ticket.
l
how about on Macs? Its working for us with Windows devices, but Macs are giving a security popup within the session for a USB key rather than the touch id prompt like the whfb does
j
By chance are your Mac users hybrid in office/remote Brian? I've been chasing something semi-adjacent that seems to be triggered when I have an in-person day, where I use a Yubikey on site, then Hello is not an option from home the next day. https://worldofeuc.slack.com/archives/CK6TCV3JN/p1736957832037659 I've missed my last 2 in-person days the last two weeks though and haven't been able to troubleshoot further.
l
No they are remote only. We aren't using strictly WHfB, but registering the passkey as a fido2 device in OKTA. It works perfect for windows endpoints, but Mac endpoints arent. Ive never used a Mac so I can't say if it ever did, and only our IDM team claims it used to.
p
i tested from mac and PC. Not working on either.
to be clear, this is what i'm missing, the window with the QR code in it. Regular hardware FIDO2 works fine, but without a hardware token all we see is this message box.
s
I will have to check on Mac endpoints but touchID on Mac clients to my knowledge is not supported. Apologies if my earlier comment caused any confusion. I was referring to it ideally working on Windows clients.
p
Not trying to do touch ID.
On a non Citrix session you get a modal ovelay window of the browser, and prompted to either use a token or scan the code. None of this is Hello or touch ID, it's just FIDO2. But in Citrix there is a brief blink and miss it flash of the browser window, and then the key not found message.
j
Foundationally it's just WebAuthn call from browser to passkey... but in your case Paul you want that WebAuthn call to be intercepted and then wfica32 to do handle the call at the client endpoint right?
p
no. I want the QR code to show in the session. I have users with FIDO2 hardware keys we are passing though fine. But now i have another group of users who do not have keys, so we need them to be able to see the passkey QR code. Up until today it has not been an issue that the QR code never shows in session.
j
Right, but using BestBuy.com as our critical LOB app as an example. Teal invoked WebAuthn -> PassKey modal Orange in session wfica32 intercepted
58 Views
Open in Slack
PreviousNext
Powered by