Greetings all! I'm attempting to implement a simple Netscaler OAUTH SP setup. The environment I'm working is using a less well known IDP, but one that is well known in the industry ( I would prefer not to share the IDP vendor name here, but can via DM) I'm on NS 14.1 latest, the OAUTH SP action has been set as per https://docs.netscaler.com/en-us/citrix-adc/current-release/aaa-tm/authentication-methods/oauth-authentication/citrix-adc-oauth-sp The user name and password are accepted on the redirected logon page, however, on redirection back to the Citrix gateway the error "Error trying to validate Access Token. Please contact your administrato" is displayed Digging into the NS logs, i get the following: Anyone that's configured Netscaler in SP mode to an IDP via OAUTH method seen this, if so, what was the fix?

As the log is saying certendpoint = 0 - maybe the IdP wants to use the certendpoint to send usernames? Entra ID is doing the same, when certendpoint is emtpy on the NS, you will get "Anonymous" as username. See some Details here (Entra ID) maybe you can copy the same for your IdP?

This might be a bug with Netscaler 14.1! We noted that the secret key added via GUI/CLI was scrambled on input! I've escalated to Citrix and will report back next week