One of my colleagues upgraded a NetScaler Tuesday night to the 13.1-56.18 and it broke their RSA Siteminder SAML. Has anyone else seen an issue with the newest firmware and SAML?

Yes, i have seen issues with SAML after upgrade to 13.1-56.18. What issue are you seeing?

It is related to the other thread started by James Rankin.

ok, so issues with commands in rc.netscaler? Should be fixed in 13.1-57.x which has ETA late Jan. And specifically nsapimgr_wr.sh -ys call=ns_saml_dont_send_subject with regards to SAML. It has the following ID at Citrix: NSHELP-39034

It's not the dont send subject, but they do have saml nsapimgr entries in rc.netscaler

ok, but yes it's all commands in rc.netscaler that's ignored.

https://support.citrix.com/s/article/CTX573440-saml-intermittence-on-citrix-gateway-internal-server-error-43524?language=en_US Just got this error code post login in one of the upgraded NetScalers... Works with one account and fails with another.

Yes, @Kari Ruissalo (WyW), the problem being experienced is that the entry of that in the rc.netscaler is not being applied following a reboot like it should. We are having to manually enter the nsapimgr command every reboot.

that command is there by default @Richard Faulkner, I don't think I've added it to any of the environments we're running

I can show you the entry in the rc.netscaler for the customer in question. I can show you the case number with support determining that the command needed to be entered. And why would there be a support article informing you how to add a command that was there by default?

Thank you for the clarification, shouldn't be the case in this environment then.

Agreed. In the case I reached out for, it broke SAML and affected all users. And right now it is preventing us from upgrading the firmware since it does not reapply the rc.netscaler at boot. Fortunately, the customer is not using rdp proxy and the errant kerberos. so no security vulnerability.