A smart card PIN prompt occurs when launching from a non-domain-joined Citrix Workspace app machine because the endpoint cannot use domain trust for credential pass-through and must prompt for the smart card PIN.
A smart card PIN prompt also occurs at NetScaler Gateway during resource launch when authentication is configured with "Client Cert: Required," because the client certificate validation process requires user PIN entry for smart card authentication.