Anyone see the same topic. After upgrade to the newest 13.1 and 14.1 NetScaler version, I see the following error with saml with.

You may need this: nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject ref (at the very bottom): https://docs.netscaler.com/en-us/citrix-adc/current-release/aaa-tm/authentication-methods/saml-authentication/azure-saml-idp.html

Hmmm I tried it on the 13.1 environment , without any luck

I am seeying this error in the NetScaler dashboard quite often

Is there anything complex about your nfactor policies or is it just SAML? I saw this come up once with a client who had a complex nfactor setup and the previous factor was trying to pass something to the SAML factor that it didn't like

With the newest update u have to define the rejected unsigned assertion to on or strict. No possibility to set it to off

Geert I have seen that too (prior to this firmware) with NetScalers that don't have internet from NSIPs - I think an internal monitor is trying to reach the SAML URL? I haven't investigated further yet, doesn't seem to break anything.

yeah, was common thing with Entra ID specifically. @Daniel Marsh funny, I just got done explaining to a customer the other day same thing. I don't really know why its some but not all specifically. But it is only Entra/Azure AD. Was mostly thinking it was an older build thing but never really found out why we have to set the workaround to fix it on some but not others.