Linux VDA 2402 - You might encounter an “Invalid Login” issue with FAS when using Linux VDA 2402 on Rocky Linux or RHEL
Article ID: CTX696049
Updated On:
Description
Error “Invalid Login” when trying to launch FAS enabled Linux VDA Desktop. while in the same environment, Windows VDA Desktop works well.
Cause
During ICA session logon to a Linux VDA, the krb5-pkinit module is called for authentication. However, RHEL 9 and Rocky Linux 9 introduced an updated version of this module with a new attribute that is currently unsupported by the Linux VDA, resulting in logon failures.
Authentication failed with a logged error of "Not valid Type, UNSUPPORTED!", confirming an incompatibility with the expected attribute type.
secure log:
Jan 5 16:59:29 login[4483]: pam_xxx: authentication failure; logname=xxx uid=978 euid=978 tty=:2 ruser= rhost=
Jan 5 16:59:29 login[4483]: pam_xxx: authentication failure; logname= uid=978 euid=978 tty=:2 ruser= rhost= user=xxx
Jan 5 16:59:29 login[4483]: pam_xxx: request wbcLogonUser failed: WBC_ERR_AUTH_ERROR, PAM error: PAM_AUTH_ERR (7), NTSTATUS: NT_STATUS_LOGON_FAILURE, Error message was: The attempted logon is invalid. This is either due to a bad username or authentication information.
Jan 5 16:59:29 login[4483]: pam_xxx: user 'xxx\xxx' denied access (incorrect password or invalid membership)
Hdx.log:
2026-01-05 07:59:29.389838 <P4483:T4483:S2> citrix-xxx: get logon certificate success
2026-01-05 07:59:29.389840 <P4483:T4483:S2> citrix-xxx: CKA_ID get value
2026-01-05 07:59:29.390074 <P4483:T4483:S2> citrix-xxx: duplicate call!
2026-01-05 07:59:29.390082 <P4483:T4483:S2> citrix-xxx: Not implement.
2026-01-05 07:59:29.392908 <P4483:T4483:S2> citrix-xxx: Not valid Type, UNSUPPORTED!
Resolution
To resolve the compatibility issue, a fix was developed to support the specific attribute required by the new version of the krb5-pkinit module in Linux VDA 2402 CU3 and 2507 CU1.
Issue/Introduction
Linux VDA 2402 - You might encounter an “Invalid Login” issue with FAS when using Linux VDA 2402 on Rocky Linux or RHEL.
Additional Information
The same issue was listed in Linux VDA 2507 CU1 but not listed in 2402 CU3.
https://docs.citrix.com/en-us/linux-virtual-delivery-agent/2507-ltsr/whats-new/cumulative-update-1/fixed-issues
