World of EUC

*No session for authentication*
Still dealing with tons of errors in a complex SF deployment.

```An error occurred during authentication.
Citrix.DeliveryServicesClients.Authentication.Exceptions.NoSessionForAuthenticationException, Citrix.DeliveryServicesClients.Authentication, Version=3.34.0.0, Culture=neutral, PublicKeyToken=null
No session for authentication
AuthenticationControllerRequestUrl: <https://SF-BASE-URL/Citrix/StoreWeb/CitrixAuth/Login>
   at Citrix.Web.AuthControllers.Controllers.FederatedAuthBaseController.Login(IClaimsPrincipal claimsPrincipal)```
When i browse to this url, i get an 404.
<https://SF-BASE-URL/Citrix/StoreWeb/CitrixAuth/Login>

Any troubleshooting step i can do here?

I reduced complexity a bit, so we got:

<http://citrix.domain.net|citrix.domain.net> => External NSGW
<http://citrix.domain.com|citrix.domain.com> => Internal LB for SF Servers
citrix.domain.com:8444 => Internal GW all users should use for hdx, so all traffic passed either through external or internal GW.
• Due to security reasons <http://citrix.domain.net|citrix.domain.net> cannot be resolved internal, singlefqdn is not possible.
• Users move from inside to outside and back
• Workspace app and browser access needs to work
I configured Storefront to use internal GW as HDX Proxy, therefore all ica file contain citrix.domain.com:8444 as SSLProxyHost
SF writes this in EVERY ica file, so also to these, that are opend via the external gateway.
Therefore i have an rewrite policy at the external gw in place, that rewrites <http://SSLProxyhostcitrix.domain.com|SSLProxyhost=citrix.domain.com>:8444 to SSLProxyhost=<http://citrix.domain.net|citrix.domain.net>
This works for 95% of all users.

I see this error a lot on our SF servers. While working with a SF escalation engineer for a different issue he thought it may be from CWA caching cookies. By default SF times them out after 20 minutes, but CWA will continue to try and use that cookie after 20 minutes. When it fails it then asks for a new one. These are <http://ASP.NET|ASP.NET> cookies in the IIS record and there isn't currently a way to force logout of CWA before that cookie expires if connecting to on-prem SF. I think the only way around that right now is to have a gateway in front of SF.

Another way around it might be to have CWA refresh apps under the session timeout, by default 20 minutes.

Sounds like you are already using an internal gateway though so maybe you're seeing the error for a different reason.

this could go into the right direction.
For authentication, i do not have a gw before my storefronts, as CWA is too dumb to handle a two gateways and pick the correct one when internal/external

Therefore our internal connection go directly to storefront, the internal ica traffic is routed through an internal gateway