• The customer migrated from NIS to OpenLDAP because NIS is no longer supported on RHEL 9.

• OpenLDAP authentication was configured successfully, and users could log in with their OpenLDAP username and password.

• After authentication, the following error was displayed: "Due to a missing credential cache file, your logon request cannot be authenticated and this session will be terminated in 30 seconds. Please contact your administrator."

• The user session terminated automatically after 30 seconds.

• Investigation confirmed that Citrix Linux VDA SSO depends on Kerberos authentication and requires a valid Kerberos credential cache (krb5 ticket). OpenLDAP authentication alone does not satisfy this requirement, causing session authentication to fail with the "missing credential cache file" error.

Citrix Linux VDA does not support OpenLDAP as an SSO authentication provider.

While OpenLDAP can authenticate user credentials, it does not provide the Kerberos credential cache (krb5 ticket) required.

As a result, session authentication fails with the "missing credential cache file" error and the session is terminated.

To support this deployment scenario, both OpenLDAP and Kerberos (krb5) authentication must be configured.

The following changes were applied:

1. Configure Kerberos authentication in "/etc/sssd/sssd.conf", including

#====krb5====
auth_provider = krb5
chpass_provider = krb5
ldap_id_mapping = false
case_sensitive = false
krb5_server = KDC01.example.com
krb5_server = KDC02.example.com
krb5_realm = EXAMPLE.COM
krb5_ccname_template = FILE:/tmp/krb5cc_%U 
krb5_ccachedir = /tmp

2. Disable the default KCM credential cache, edit "/etc/krb5.conf.d/kcm_default_ccache" and comment out:

#default_ccache_name = KCM:

3. Ensure "/etc/krb5.conf" uses a FILE credential cache:

default_ccache_name = FILE:/tmp/krb5cc_%{uid}

4. Clear SSSD cache and restart SSSD

sudo systemctl stop sssd
sudo rm -f /var/lib/sss/db/*      # clear SSSD cache to force rebuild
sudo systemctl start sssd

5. Disable Citrix LVDA SSO

/opt/Citrix/VDA/bin/ctxreg create -k "HKLM\System\CurrentControlSet\Control\Citrix\WinStations\tcp" -t "REG_DWORD" -v "fPromptForDifferentUser" -d "0x00000001" --force

After migrating from NIS to OpenLDAP on RHEL 9, the customer was able to authenticate with OpenLDAP credentials but encountered a session termination error after login.

Since Citrix Linux VDA does not support OpenLDAP-based SSO, the issue was resolved by disabling SSO and using interactive username/password authentication.