Citrix web redirection with external password-less authentication. SAML or Kerberos, security token will be saved on the end point. Automated re-authentication adjustable based on access protocol.
We can tunnel traffic for proxy in server fetch mode to control website access / authentication even if execution happens on the end point.