Announcement: Citrix Authentication Upgrade

[oytuntez]

Authentication Upgrade for Citrix GoTo Product APIs

Later this month (March 2015), Citrix will release an upgrade for user authentication via API. This upgrade will introduce some security enhancements for the product APIs, and will result in a more consistent and easier sign-on experience for all of your users. In addition the authorization flow will automatically work for upcoming sign-on features from Citrix. The upgrade may impact some existing implementations.

Impact expected

The upgrade will impact the applications implementing OAuth in ways other than the ones documented or recommended. For example, embedding the product user credentials to avoid user interaction during login exposes the user accounts to security risks. This implementation will break after the upgrade is released.

Citrix has provided test OAuth and Direct Login requests you can use to validate your authorization method. We strongly advise that you run your calls using these requests within the next week or two to validate that your application will continue to run as expected. If your code does not run, this gives you time to revise your code as needed. In general, if you want to automate user login, Direct Login is the preferred method.

No impact expected

If you are using Direct Login for your authorization flows, you should see no change. In addition, if you are using the OAuth flow as documented on the site, you should see no change.

If you have any questions, please contact developer-support@citrixonline.com

Thank you,
Your Citrix API Team

[oytuntez]

The links mentioned on the email (but got lost while pasting):

https://developer.citrixonline.com/authentication-and-authorization
https://developer.citrixonline.com/content/pre-test-your-apps-authentication-and-security-upgrade-coming
https://developer.citrixonline.com/page/direct-login

[teodortalov]

I am going to try to get on this this week.

[teodortalov]

This has been addressed in Release 1.1

[oytuntez]

Thanks!