https://worldofeuc.com logo
Join Slack
Powered by
anyone else run into issues trying to get android/...
# citrix-netscaler
m
anyone else run into issues trying to get android/ios to work with FAS? I’m getting prompted for creds when opening apps, but the same app through a browser doesn’t prompt.
Entra with SAML on the gateway, I have session profiles set up for with and without workspace app, I’m wondering if I need to do something special with the session profile?
r
I know you can set a profile if it is an android or ios device, Do you think you need a particular setup for Android?
m
I don’t know, because it’s doing it with all workspace app, which is weird. It’s like it’s a credential index thing, but there’s only one credential unless it’s trying to do domain passthrough or something. It’s a client system I have to troubleshoot over Teams so not having direct access is making it a bit tricky to see what’s going on.
it seems like storefront just doesn’t invoke FAS when the connection came in via the gateway on Workspace App
like it’ll get into storefront and enumerate the apps and launch them, but then asks for creds again
and I can see it hits the right session policy/profile coming in on workspace
I got them to open a ticket because I’m stumped
r
Not much of a fan of FAS. Same user so it can't be the certificate config? Does the FAS log show it obtained a certificate for them?
m
it did when it went through the browser
we checked the CA too and saw it issued a new cert
r
So, either the android didn't know what to do with the cert, or the client didn't use it when presented with the login.
I am interested to know what you find when Citrix fixes it
m
yeah. might have to turn kerberos logging on and see what the VDA is doing because nothing useful in the logs
it’s funny because it does it on iOS and Windows workspace too which made me think it was the session profile
r
🤔
m
we had group extraction on so I thought it might be trying to use that as the auth part sent to storefront, but even taking that out of the mix didn’t change it
r
I can't think of anything else to try.
m
the only thing I can think to do is reboot the netscaler lol
it’s a test box
r
"Have you tried turning it off and back on again?"
Lol
m
I mean it’s fixed a lot of things lately unfortunately
I used to never reboot them
s
sorry, so it does or doesn't work with native workspace app?
m
it prompts
the only way it works is if you go via the web and then open the ica file
so maybe something to do with the config file storefront is sending workspace?
beacons? I don’t even know anymore
This is why I do not use workspace app
or why I don’t log into it rather
s
could it be the session profile for the Receiver one? Are they using that same session profile on a netscaler gateway that doesn't use saml/fas?
m
it very well could be, this was a new profile we created
I don’t know what setting in the profile would cause this
s
double check the receiver session policy and compare to https://www.carlstalhood.com/citrix-gateway-ica-proxy/#sessionprofiles
m
that’s what we used to create it lol
s
lol, figured.
the user is completely external, thus removing any beacon type stuff?
m
yeah, unless the phone is on some kind vpn, but they said it’s just android with workspace app
but it does it on an iphone and a windows laptop too from what I’m tol
it’s like the bad old days of radius and having to flip the credential index
s
m
OOOOOOOOOOOHHHHHHHHHH
That’s probably it
will try, thank you
well that wasn’t it
I think this is an issue with FAS, it sees the identity assertion from storefront and then doesn’t do anything else
s
Dang dang. Updated workspace app?
m
yeah, I’m going to rebuild storefront
this is working with other storefront servers, just this test one seems to have issues
so FAS itself works
this is such a pain to troubleshoot too, like there’s nothing in the logs even after turning on kerberos and capi2 logging
it just gets the assertion from storefront and then… nothing
c
have you enabled FAS options on the storefront store you are using ? Get-Module "Citrix.StoreFront.*" -ListAvailable | Import-Module $StoreVirtualPath = "/Citrix/Store" $store = Get-STFStoreService -VirtualPath $StoreVirtualPath $auth = Get-STFAuthenticationService -StoreService $store Set-STFClaimsFactoryNames -AuthenticationService $auth -ClaimsFactoryName "FASClaimsFactory" Set-STFStoreLaunchOptions -StoreService $store -VdaLogonDataProvider "FASLogonDataProvider"
FAS GPO linked to the test Storefront server ? Checked your FAS server rule for storefront access perms ?
m
yeah, checked all that
this storefront has a lot of other stores on it so I’m building a whole new storefront just for this store, going to run the FAS powershell again and then see how it goes
👍 1
OMG, it was a problem with the powershell for FAS on Storefront. The script they were running cut off the last 2 chars so it never set the logon data provider correctly. That’s why the assertion got through and then died. It never actually worked with the web because they also had domain passthrough enabled, so that was what was doing the SSO when they were testing.
Open in Slack
PreviousNext
Powered by