Symptoms

• Published desktop launch fails and stops at Logon Page (ask to enter password).
• Both pass-through authentication and manually typed passwords are denied.
• Local console (GDM) logon for the same user succeeds.
• getent passwd <user> / id <user> return correct data (NSS/name resolution is fine), yet the session is still denied.

Log evidence — /var/log/sssd/sssd_<domain>.log:

[ad_gpo_access_send] Configuration hint: PAM service 'ctxhdx' is not mapped to any Group Policy rule. ... 
[ad_gpo_access_send] service ctxhdx maps to Denied
[ad_gpo_access_done] GPO-based access control failed.

/var/log/auth.log shows the account phase being denied:

pam_sss(ctxhdx:account): Access denied for user <user>: 6 (Permission denied)

A Citrix ICA logon is a remote interactive logon and is processed through the PAM service ctxhdx (and ctxfas when FAS/pass-through is used). SSSD's AD GPO access control only evaluates PAM services that are explicitly mapped via the ad_gpo_map_* options.

By default, ctxhdx/ctxfas are not in any SSSD map table.

When ad_gpo_access_control = enforcing, any unmapped PAM service falls back to ad_gpo_default_right, which is Denied. As a result, SSSD denies the Citrix session at the account/access-control stage — even though the credentials, the AD account, and Kerberos are all valid.

The successful console (gdm-password) logon confirms the issue is limited to the unmapped Citrix PAM service, not authentication.

Edit the [domain/<your-domain>] section of /etc/sssd/sssd.conf and map the Citrix PAM services to the Remote Interactive login right:

[domain/<your-domain>]
ad_gpo_map_remote_interactive = +ctxhdx, +ctxfas
# ctxfas is required for FAS / pass-through authentication

Then clear the cache and restart SSSD:
sudo sss_cache -E
sudo systemctl restart sssd

Launch the published desktop again.

When launching a published desktop or application from a Linux VDA that uses SSSD, the session fails and stops at the logon screen. 

Unable to log in even when manually entering the password. The user can still log on successfully at the local console.