I'm using NetScaler to protect some reverse web proxy services. I have authentication setup and all's good, but I can see that I need to always re-login when changing hostnames. So, let's say the user authenticates to https://reverseproxy1.company.com (the authentication loops via "https://gateway.company.com") and I can see in the browser that the NSC_TMAS cookie is bound to https://reverseproxy1.company.com. Now that I go to https://reverseproxy2.company.com, which uses the same exact Gateway for authentication, the user needs to authenticate again. My suspicion is that NSC_TMAS cookie, but can't say for sure. What am I missing? I think it was working before. Authentication is Entra ID (SAML) where NetScaler Gateway (with AAA) is configured as SAML SP. The TM/LB vServers are configured to use the Gateway as the point of authentication and in TM/LB I have configured Authorization policies (as part of AAA processing, I'm collecting LDAP group information).

There are settings like authentication domain and authentication level that come into play as well.

Thanks Jan, I have never needed to touch those, but are they related to the cookie domain that is responded for browser post-auth?

The NetScaler uses the authentication domain to determine which hostnames are covered by the authentication cookie. By default, if i recall correctly, it is set to the hostname in the NSC_TMAS cookie. However, you might want the user to authenticate just once for a whole domain (jantytgat.com) for example instead of a single hostname (www.jantytgat.com) You can then use authentication levels to require additional authentication steps as the level increases.