WebAutn redirection and IWA

[Xtralogic]

We are getting requests to implement WebAutn redirection support in our Xtralogic Remote Desktop IWA app.
The implementation requires support for remoteDesktopClientOverride extension in navigator.credentials.get({publicKey:{...}} (see explainer at https://github.com/w3c/webauthn/wiki/Explainer:-Remote-Desktop-Support/a4e158c569f456c759d0ddd294a9015bd4d4eb9a)
Is remoteDesktopClientOverride supported for IWA apps on ChromeOS and if yes, how to enable it? Using JSON configuration for WebAuthenticationRemoteDesktopAllowedOrigins policy on ChromeOS (https://chromeenterprise.google/policies/?policy=WebAuthenticationRemoteDesktopAllowedOrigins) does not seem to work.

[Olga Korokhina]

Greetings! You're correct, you need to set up the remoteDesktopClientOverride extensions with the list of allowed relying party ids, and add permissions permissions_policy.publickey-credentials-get (and publickey-credentials-create if needed) in your IWA manifest. Then you need to add your IWA's origin (isolated-app://[your IWA bundle id]) to the list managed by WebAuthenticationRemoteDesktopAllowedOrigins policy. And here we enter the gray zone: recently you cannot set this policy values via Google Admin Panel, we are working on it actively, ETA is the end of Q2 2026. Without an ability to set up values of this policy via Admin Panel you can set it via custom JSON configuration for Windows, Mac, Linux and Android but not for Chrome OS. For the Chrome OS the only way to set this policy will be via Admin Panel, so you have to wait.

Important: WebAuthn for VDI will work for affiliated users only (user profile belonging to same organization as the device)  on CrOS for Chrome Browser 147+ and on W/M/L/Android for Chrome Browser 151+. You're expected to get the meaningful error message if user is not affiliated.

Please let me know if I can help you with anything else,

- Olga

[Xtralogic]

Hi Olga! Thank you for the prompt response. I hope the Google Admin Panel support for  WebAuthenticationRemoteDesktopAllowedOrigins will be available soon.

[Xtralogic]

Hi Olga!

We are in Q3 2026 now   :-).  What is the status of Google Admin Panel support for  WebAuthenticationRemoteDesktopAllowedOrigins for ChromeOS?

Thanks,

Sergey.

[Olga Korokhina]

Greetings, perfect timing - yesterday we rolled it out
 for GA:, so please check your Admin Comsole.

I am also attaching a draft help center article on using it in VDI across different platforms. I'm happy to answer any of your questions!

- Olga

[Xtralogic]

Hi Olga,
we have tested the new "WebAuth Remote Desktop Override" permission in the Admin console and it works on ChromeOS fine. Thanks!

We hit a fundmental problem with the remoteDesktopClientOverride extension though. I know it was designed for remote desktop use case, but
it still does not seem to allow WebAuthn redirection implementation. The problem is that sometimes a browser or remote server randomly inject a so called anti-templating member "other_keys_can_be_added_here" into clientDataJSON they are generating. Then it is injected by any side the clientDataJson generated by a browser and clientDataJson generated by the remote server do not match, as a result the signature generated by the local browser does not pass verification on the server.
A solution for this would be to use the upcoming remoteClientDataJSON extension which W3C has recently standardized, it allows the remote host to pass down the exact clientDataJSON string it expects, rather than forcing the local browser to spoof he origin.
I am wondering when is the remoteClientDataJSON extension projected to be available on ChromeOS?

-Sergey