We are seeing an issue on Workspaces Pools with *certificate-based Authentication (*CBA) enabled that published Citrix XenApp apps to the Start Menu of the Workspaces Pools desktop launch but get a message "The user name or password is incorrect. Try again". If I turn off CBA, and log in to the desktop with AD credentials it works ok. I found an Citrix article https://support.citrix.com/s/article/CTX289690-unable-to-start-session-in-double-hop-environment?language=en_US that has a similar issue that mentions FAS, we don't have FAS deployed in our Citrix envionment. Is it required to get it to work? Wasn't sure whether anyone else has encountered this?

CBA is effectively logging you into Microsoft Windows with short lived smartcard, but it's the kerberos login nonetheless. I wonder if the fact that the issued certificate is deleted might have something to do it? But you're still getting that kerberos token after successful logon, which is what the Citrix client is using to logon with so I'm a bit confused...

Thanks for your message. We're building another test storefront store and will enable smart card login to see if that resolves the issue but as you say if the certificate is deleted that might be an issue.

Please keep me posted, thanks Peter!

The test Storefront with smartcard login didn't work. We've logged a call with Citrix support. Hopefully they will come back with what the solution should be. We also have an externally hosted XenApp app that ~100 users use that has the same problem. I expect the solution would be for use to get SAML authentication to Citrix and implement FAS and maybe (reconfigure Netscaler / Citrix Gateway). And say they can't have XenApp shortcuts published to the start menu anymore.