Hello, I m configuring Citrix saml login in netscaler. I've setup CA server, FAS, VDA config etc all configurations. When we open netscaler gateway url, it redirects to ping saml url. After we login, it shows the apps without any issues. I click on any of the app. It shows the citrix dialog box showing that it loads profile, negotiating capabilities etc and shows "the request is not supported" error. On the app server (VDA) it shows [S104] Identity Assertion Logon failed. Failed to connect to federated authentication service. As per https://rakhesh.com/citrix/s104-identity-assertion-logon-failed/ site, discussed the same with our firewall team. They said all our servers are in same subnet and firewall is not in picture. I can telnet to fas server from VDA on port 80 and ping also works. Not sure what am I missing.

any time i have seen the request not supported error with FAS its because of the certificate on the domain controllers

domain controllers??? Can you please elaborate?

The certificate issued to your domain controllers must support smart card logon :)

Thank you. I ll follow this article.

• Have a look on the event logs on your domain controllers you should see this - This can be confirmed by the event 19 or 29: "*The key distribution center (KDC) cannot find a suitable certificate to use for smart card logons, or the KDC certificate could not be verified. Smart card logon may not function correctly if this problem is not resolved. To correct this problem, either verify the existing KDC certificate using certutil.exe or enroll for a new KDC certificate*."

Yeah, looks like Certificate issues. Usually all domain controllers need to trust the certificates. Generating an auth cert on all of those usually will trust it correctly.

Thanks a ton @c4rm0 Issue is resolved. This smart card logon cert worked like a charm.