Was there some issue on 14.1-43.50 with SAML? If I...
# citrix-netscalerk
Kari Ruissalo (WyW)
05/13/2025, 12:41 PMWas there some issue on 14.1-43.50 with SAML? If I try configuring SAML auth on GW, I'm just stuck with
Http/1.1 Internal Server Error 43549/nf/auth/doSaml?ctx_hint%...Kari Ruissalo (WyW)
05/13/2025, 12:52 PMThis is what I'm seeing in ns.log
May 13 065811 <local0.info> NSIP 05/13/20250658:11 GMT hostname 0-PPE-2 : default AAA Message 40728 0 : "SAML nFactor: context found in the url"
May 13 065811 <local0.info> NSIP 05/13/20250658:11 GMT hostname 0-PPE-2 : default AAA Message 40729 0 : "SAML nFactor: Derserializing context "
May 13 065811 <local0.info> NSIP 05/13/20250658:11 GMT hostname 0-PPE-2 : default AAATM Message 40730 0 : "nFactor: deserialize aaa_info, hash verification failed"
a
Andy Stadtlander
05/13/2025, 2:51 PMDo you have WAF enabled? If so check your learned rules. We had to do some tweaks when login.microsoftonline.com redirects back to our gateway URL.
k
Kari Ruissalo (WyW)
05/14/2025, 4:21 AMI don’t have WAF (yet). The browser reqs don’t leave the NSGW. I set this up behind a CS vServer as non-addressable and am using authn profile/aaa for auth. I re-read the SAML signing cert and verified my policies.
In CS I have tried even using
trueis_vpn_urlKari Ruissalo (WyW)
05/14/2025, 5:19 AMnot about the cs vserver, I'm getting the same exact error with IP directly on GW
Kari Ruissalo (WyW)
05/14/2025, 5:21 AMtried adding the GW DNS name as an A record in the netscaler internal DNS, no dice... opening a ticket
j
Jan Tytgat
05/14/2025, 7:50 AMjust ugpraded another customer to 14.1 43,50 last weekend.
They also have a setup like CS --> GATEWAY with SAML Auth on AAA
Jan Tytgat
05/14/2025, 7:50 AMtowards two different SAML providers
Jan Tytgat
05/14/2025, 7:51 AMworks fine
Jan Tytgat
05/14/2025, 7:51 AMonly thing we had to fix was the subject command using nsapimgr
Jan Tytgat
05/14/2025, 7:51 AMis_vpn_url && HTTP.REQ.URL.EQ("/").NOT
k
Kari Ruissalo (WyW)
05/14/2025, 8:10 AMI tried the subject command, but I don't think we're getting that far, as the subject should cause issues when the session is redirected to Entra rather than on the GW URLs?
Kari Ruissalo (WyW)
05/15/2025, 8:28 AMJust heard that there are some serious problems in 14.1-43.50 build with HA and apparently a new build is coming soon
Kari Ruissalo (WyW)
05/16/2025, 4:49 PM”This is a known bug in this version and the bug id is : NSHELP-39808.
RCA : Base64 decode providing wrong data which makes signature verification failure.
Resolution : The fix for the issue is included in the upcoming release (14.1-47.X). ETA for the release is end of May tentatively.
You can upgrade the Netscaler to the above release once available to have the fix.”
Babby’s first 14.1
2 Views