Web Authentication (SAML SSO) when using Parallels Client for Windows: Remote session logon fails with "The username or password is incorrect"

Symptoms

When using Web Authentication (SAML SSO) in the Parallels Client for Windows, the session logon prompt returns the error: "The username or password is incorrect."

Cause

Smart card redirection is enabled on the client. The physical or virtual smart card attached to the client device interferes with the Parallels RAS virtual smart card component on the remote session host, causing credential resolution to fail during SAML SSO logon.

Resolution

Disable smart card redirection.

Option 1 — Per-connection setting (Parallels Client):

1. In Parallels Client, right-click the RAS connection and select Connection Properties.
2. Navigate to Local Resources.
3. Clear the Smart cards checkbox.
4. Reconnect.

Option 2 — Client Policy (RAS Console):

1. Open the RAS Console and go to Policies.
2. Select the applicable policy and locate Local devices and Resources > Smart cards or use Search with Smart cards query.
3. Clear the Allow smart card redirection checkbox.
4. Press OK and Apply in the RAS Console

Note: Updated Client Policies are applied on the client side upon the next logon or after a manual connection refresh.