the policy does not check for an IP it check for a content in the SAML Response

which is what makes it a much more solid fix for sure

yup looks like there will be

many thankyou's

I am still getting the crash, but I did it all manually. anyone able to provide me a way to confirm I have the fix in place? I manually bound the created responder policy to everything I could find, authentication AAA vservers, AAA vpn servers, anything else?

Bound as AAA_REQUEST ???

crap...

AAA_Request on both AAA and NSGW vServer

ok thanks adjusting now

added them as both

yeah im doing the same

you'd want AAA_request, as this problem happens before auth....normal 'request' pols don't apply until after auth, thats my understanding

ok so AAA_Request is the only option for AAA vservers, but for VPN servers there are two options, request and AAA_Request

so AAA auth servers that have a SAML Adv Auth policy bound got to have the responder policy bound as well??. I only bound to my NS GW Vserver let me bind on AAA auth server as well

yes, as stated in the original post, bind to VPN vs and AAA vs, depending on the use

no, you would want AAA_Request on the VPN vservers too. Here's a screenshot from Citrix

Forgive what is probably obvious, but this is only impacting systems with SAML auth policies defined?

you can see AAA_request on both binds for AAA or VPN vservers

Go to expression END i presume

correct

When I try to bind the policy on the aaa vserver it says non terminating policy must have noop action

you need to select END instead of NEXT

i bound it to my AAA Auth Vserver but when i do show bindings it only shows it bound to the NS GW Vserver ?

Yeah that's just a GUI bug, check ns.conf and go directly to the AAA, it's there

im still getting booted