Citrix might cause some interesting handling. Especially with usernames since it is a terminal session.
I use an Active Directory webservice, which I know works with Citrix. It returns the users domain account which they authenticated with as well as gives you access to email, department, manager, phone number, etc that is stored in Active Directory. For remote users without Citrix this allows it to work correctly in VPN scenarios. It also can be used to lookup other user's information and check group memberships.
Might be an option for you and give you some other functionality.
Email me if you would like to see it demonstrated.