I’m troubleshooting an authentication issue on Citrix NetScaler Gateway and I’d like to clarify when entries should appear in aaad.debug. Scenario: • User accesses Gateway – login page displays correctly. • User enters credentials (RSA + LDAP). • If incorrect credentials are entered → standard authentication failure message appears (as expected). • If correct credentials are entered → user receives: “Request cannot be completed.” • However, in this case aaad.debug remains completely empty. This is confusing because I would expect to see at least some authentication processing in aaad.debug when valid credentials are submitted.

Request cannot be completed means the storefront isn't setup to accept authentication from the gateway.

Thanks. Not really… (its configured and checked multiple times but maybe I missed something… ) it's not working only from inside of company and in the same time it works fine from internet. Funny - both (external and internal users) using the same gateway (the same ip). There is no issue connecting directly via SF without gateway for internal users…

SF Server logs should have something

Callback URL? Maybe not available from the LAN

Nothing in SF logs, callback url avaliable from SF… 🤷‍♂️

If it is not working from inside, but from outside, it is not an authentication issue from NetScaler side. I guess, it's something about either routing or authentication mode on storefront. aaad.debug will show "something" as soon as the authentication daemon in BSD is hit (NetScaler OS can't do external authentication, this is done from BSD). You don't authenticate to NetScaler for sure. Prove? Do a nstrace. You will see nothing.