After upgrading to 13.1 59.19nc, my radius/duo auto has broken for WEB only connections. I can SSH in just fine with the same engine. What's odd is, when entering my username/password, the URL goes to login/loginview?errorcode=1034, instead of the normal /login/do_login to enter my passcode... Then of course entering my passcode doesn't work and it just bombs me out. NPS is fine as it says "granted access", and Duo is sends a response code 11, but never gets a return response code 2.... Has anyone seen this? Did some Radius things change in this build?

In the big thread there was someone who radius broke for on admin auth and another that had issues with Duo. I think one of them solved it with the CSP disable "fix". https://worldofeuc.slack.com/archives/CKHRXATV2/p1750854948531979

Citrix Gateway > Global Settings > Change AAA settings > Default CSP header? = Disabled

Did you clear cache after? shell nsapimgr_wr.sh -ys call=ns_ic_flush

yeah, tried that too.. will hit up that thread, thank you

Same issue - no admin login on GUI because of RADIUS failing. Fortunately our local account is exempt (for just this reason) and we can get in with nsroot. CLI works fine. We aren't using iframe or DUO, just an OTP prompt using the singleauth.xml. I was wondering if the XML was hosed possibly causing the issue. Opened a case - they seemed perplexed this would ever be an issue - had me do a trace and support bundle. Interestingly - they told me to clear cache (on the browser) NOT on the netscaler as suggested here, after disabling CSP Header. I tried that after I was done with them and still no luck.

good to know, same here, thank you. I have nsroot disabled on this system, and forgot how to reenable in SSH. I find it interesting that SSH works fine with radius/duo login too....

It also changes "HttpOnly Cookie" to Enabled so you might want to revert that. I had the same issue with DUO and those were the only things I needed to change.

I changed that as well and still unable to login to gui w/MFA

I had the same issue with Duo iframe. Had to roll back as i missed change window. Did the change again tonight, with the csp disable, httponly cookie disabled and cache clear, all is working

http only cookie disabled ?

just following up here. what is your workaround? disable Duo or can you fix it with a newer version of the Duo auth proxy?

for Management? I don't have this for Gateway.... Workaround is to just allow nsroot logins... i normally have it disabled through a radius policy.

ok I mean for logins

got httpcookie disabled too?

where is that again?

right below csp header. gateway global aaa settings

image.png

i didn't disable httpcookie. I mentioned it to teh support engineer and she said that wouldn't matter for management login.. but , I can test anyway

so if I make this disabled, it would fix this?

and clear cache with the commands which are in this thread somewhere

possibly - i have both disabled (as others have said) and our admin login doesnt work. We dont use duo though - using radius to okta

it's a radius problem, not a duo/okta problem, imo

i think others said it can help with the iframe duo stuff

yes, ok. try to update the duo auth proxy and see if that helps

netscaler "radius" issue, more clearly

yes

when i called suppor,t my tech made it seem like we were the only people to ever experience this, never seen it before. didnt even do any troubleshooting- just, grab a har file, and tech bundle - now we wait

The fact the URL goes directly to login/loginview?errorcode=1034..... yeah... bad

i got the new guy

hahahaha

We had the combination of the first cve fix not affecting duo with iframe and radius, second cve did and the CSP and HTTP were on, solution for us was moving away and use the nfactor route with auth policies (gateway only edition still so no real AAA) and that one failed on 14.1 only got it working with 13.1 with https://help.duo.com/s/article/7839?language=en_US and https://duo.com/docs/netscaler-nfactor-radius-iframe, best solution would be the oauth with universal prompt and is it with the pooled capacity license if you have it.

Looks like this made it onto bleepingcomputer as well https://www.bleepingcomputer.com/news/security/citrix-warns-of-login-issues-after-netscaler-auth-bypass-patch/