Question for the NetScaler SAML gurus before I burn time trying to lab this up. Can I configure a AAA VIP as a SAML IDP, that authenticates the user against another SAML IDP? Reason for this is customer wants to direct users to different app servers based on department and other criteria, without having to configure each individual app server in Azure AD. We can't use Kerberos or any other sort of auth to the app servers because they only support SAML auth.

Sure, in that scenario your AAA vServer is SAML IdP and there are also bound SAML SP policies which connects your AAA to "any" IdP for authentication. NetScaler is SAML IdP and SP at the same time

Thanks Julian!

not all SAML but blogged about similar thing https://blog.comping.fi/?p=233

Great, I'm feeling more confident about this! Next thing is to lab it up... what I am actually hoping to achieve is this (see pic). The policy flows I'm ok with and have done before, just unsure about the back-to-back SAML parts. Goal is to minimise the number of enterprise apps to create in AAD and also only have one entry point for all users/apps via a CS vserver. My diagram may not be 100% correct yet, I only knocked it up quickly to demonstrate to colleagues the theory of what we want to achieve, yet to be proven until we lab it 😊

I have a couple of envs where we use NetScaler as OIDC IdP for the environment apps and then the NetScaler itself is configured as SAML SP for Entra ID (as IdP), this way we don't need to allow the apps using OIDC to access the internet at all, they just need to reach the NetScaler