World of EUC

Hey folks.
I've configured Azure SAML on my Netscaler for Citrix access and it works perfectly using the browser. Users get redirected to the Microsoft login page. After a successful login they get booted to the storefront and get presented their applications and can start working immediately. On Workspace however, after a successful login over at Microsoft, the user gets presented a second login prompt. Any ideas?

Likely there are different session Profiles for Web Browser and Workspace App in your Gateway... likely there's some authentication setting in the one WSApp one which causes the issue (like single sign on domain or sth)

Check your Receiver session profile is configured correctly

(StoreFront Delivery Services log might also give you a hint what's causing the issue)

image.png

you should have two session polices/profiles for RFW/Receiver. On your Receiver session profile check your single sign on domain it must be blank for saml

The session profiles are the default ones generated by the wizard. I did remove the default domain from that and I've checked to see the global setting which is also empty.

(Tried it with both domain filled in and blank, but the results are the same. SAML login is a success, but the regular old login pops up nevertheless.)

Web works fine, so I don't think there's an issue with my AAA virtual server or its action. I think.

are you using a AAA auth profile / AAA V server where your advanced saml auth policy is bound to as it used to be a requirement for SAML with CWA

<https://docs.netscaler.com/en-us/netscaler-gateway/current-release/authentication-authorization/configure-saml/using-saml-authentication-to-login-to-citrix-gateway.html|https://docs.netscaler.com/en-us/netscaler-gateway/current-release/authentication-auth[…]l/using-saml-authentication-to-login-to-citrix-gateway.html>

~Beacons are good, using the service url which can only be resolved on the network, not outside. (Trying the connection from the internet, no vpn). On storefront the~
Found it. I have several Citrix Gateways configured in Storefront. (The new SAML One is for testing at the moment while we leave the other ones available.)
Once I set the new SAML one as default appliance, it works...  Never figured that would make a difference.

Hmpf... here's hoping we don't run into issues with the other ones tomorrow.

you may run into issues with CWA clients having outdated info from the store provisioning file. Always happens if you change beacons or add additional GW's in storefront