This message was deleted.
# citrix-netscalers
Slackbot
07/26/2023, 6:32 AMThis message was deleted.
p
Preston Gallwas (Atum)
07/26/2023, 9:49 AMYour AAA logon has a SsoUsername field. If using nfactor you can specify the factor to use the username from in sso in the login schema at that step
c
CTXMike
07/26/2023, 1:10 PMEither disable SSO to webapps on your VPN session profile or create a trafficaction to disable SSO and bind it where you want to selectively disable sso.
CTXMike
07/26/2023, 1:11 PMSmoking gun for this is usually seeing "NETSCALER" as the client name in the auth attempt on the web service.
d
Daniel Marsh
07/26/2023, 11:30 PMThanks guys - Preston it's SAML auth so ssousername isn't applicable in this case, but I've played around with extracting samAccountName from the saml assertion and presenting that using a traffic policy.
Mike, I tried disabling SSO on the session profile and it broke a bunch of other internal access, so I've tried the traffic policy and had some limited success - it looks like first NTLM attempt presents upn username and hostname NETSCALER, receives a 401 then second NTLM attempt it presents domain\username and succeeds. I'll post up screenshots of the trace and policies if I still can't get it going.