Citrix Cloud Connect issue with Nested AD Groups for app permissioning

[Eddie Santana]

We are using Citrix Cloud with Storefront hosted service.  

While setting application permission on apps noticed a possible limitation. It doesn't appear to resolve nested security groups

 

Example for Notepad:

AD Global Security Group "Notepad Users"

It Contains "Group1 ,Group2,Group3"

Result: App doesn't show for users in the group.

 

If I add user directly to "Notepad Users" it works.

 

Limitation or a tweak needed on AD/Citrix Connectors?

 

[Jon Shackelford1709162182]

Adding a group as a member of another group (nesting) is not supported for federated authentication using Azure AD. If you do assign a nested group to a catalog, members of that group can’t access apps from the catalog.

From https://docs.citrix.com/en-us/citrix-workspace/secure.html

 

[Tobias Luumlcke]

It is workking with "Citrix Cloud SAML SSO" instead of Azure-AD authentication:
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/citrix-cloud-saml-sso-tutorial

[Julien DESTOMBES1709158802]

On 2/16/2022 at 1:28 PM, Tobias Luumlcke said:

It is workking with "Citrix Cloud SAML SSO" instead of Azure-AD authentication:
https://docs.microsoft.com/en-us/azure/active-directory/saas-apps/citrix-cloud-saml-sso-tutorial

Hi Tobias,

 

I did not see anything on the documentation on this. Do you have made your own experience ?

 

Thanks for your answer.