CWA for Mac 2603 | Touch ID passkey authentication failing within the VDI session when the session is launched from a Mac endpoint.
Article ID: CTX697164
Updated On:
Description
Users are unable to use Passkey via Touch ID inside a Citrix Virtual Desktop session.
When prompted to authenticate and selecting Touch ID, auth fails with error "46, FIDO_ERR_NO_CREDENTIALS".
- Cannot find any corresponding credential stored in the keychain!Prompt error: FIDO_ERR_NO_CREDENTIALSPrompt error UI due to failure of BuildAssertion. 46
Cause
This is a limitation of Touch ID for passkey. The users must register the passkey in a session.
Resolution
When trying to access TouchID for the first time from a Mac device, user should register the new passkey in HDX session rather than doing it on the endpoint device.
To do so, user should login to his account in session and then register a new passkey. Below are the steps that user should follow to register the passkey:
- At first user need to login using username and password inside the published desktop session:
- Once logged in, go to your account and then navigate to Security and Click on "Manage how I sign in":
- Then register a new login method by clicking on "Add another way to sign in to your account."
- Choose "Face, fingerprint, PIN, or security key"
- Now select TouchID or Password on Passkey Storage and click Continue:
- You'll be prompted to provide your password by Citrix Viewer, please key in your password and click OK:
- Provide a name to your passkey:
- Once this is saved, please attempt to login again using TouchID. You should be able to login now.
Please note the PassKey is specific to the local macOS user profile and stored in the Secure Enclave, accessible only by Citrix Viewer. This feature is supported on Mac devices with the Secure Enclave.
This passkey is not roaming and If user want to login on another Mac device, the above steps need to be followed again.
Issue/Introduction
