This morning I went to lifecycle NetScalers and Storefront servers. We stood this configuration up in non-production and have been testing for weeks with no issue. NetScalers are 14.1 66.59 Storefront 2507 CU1 on windows 2022 Two issues: • Unchecked “require token consistency”: never had to change this setting in any Storefront over the years • Single Sign on from NetScaler to Storefront not fuctioning. Storefront is asking for authentication I was getting crossed eyed on the configuration and stepped away. Hoping someone will have a thought that will stop me from overlooking the misconfiguration.

The STAs on the NetScaler, are they configured with the path “/scripts/ctxsta.dll” in it? There's a bug that you now have to leave that out for it to work. I think it only affects the initial login, but maybe not.

You cant launch a session without the sta working

@Richard Faulkner that isn't it but thanks.

Logging in to storefront doesnt use an sta ticket. Launch does. The login to storefront happens using something called agbasic when you use passthrough from gateway. Are you using mfa with saml or oidc or an AD logon at the gateway?

Active Directory and radius/rsa securid

Ok then it should be logging on to storefront w the users password. Did you find errors in the event log?

Simple checks would also be, certificate full chain trust NetScaler internal / external network and vice versa. The callback url if configured or not, usually always have a dedicated callback URL gateway VIP for this. STA order NetScaler gateway and StoreFront, double checking the firewall rules for all items, taking the NetScaler out of the equation, does it work with storefront direct login, after that storefront load balancer, also check the source up / X-Forwarded-For client-ip insertion, enable the delegate gateway authentication in StoreFront, check all the event logs for logon errors, take a nstrace from the NetScaler as well.