This message was deleted.

Switching to Kerberos gets pretty hairy thanks to having to setup KCD on everything to avoid double logins. I wonder if FAS might get around this requirement in a more elegant way.

so stepping back a bit. Whats the simplest way to tell Netscaler to talk to AD using Kerberos instead of NTLM? Or is that not possible?

Telling NS to talk to AD over Kerberos isn't generally an issue, but it's the delegation to other services that gets annoying. Last time I went down this road (which, granted, was years back) you had to setup KCD to storefront as well as any VDA the users could possibly hit, otherwise there would be multiple login prompts.

What about management interface on NS itself?

Haven't tried, but you might be able to get that to work by binding a Kerberos policy globally.

do you know if there are any documents around this? tbh this is going over my head a bit.

Unfortunately I haven't had the need to look recently. This one is a bit dated but should explain the pieces pretty well https://support.citrix.com/article/CTX135587

What do you have that’s doing NTLM? If you’ve setup LDAP on the gateway it should be doing kerberos impersonation I thought

It does not. As soon as I add a user to protected users they cant login to either management interface or the portal

you can’t do impersonation with the protected users group though?

that I do not know

isn’t that the whole point of that group?

yes it is

I don’t know, I’ve never had to deal with anyone using that group

Maybe you can delegate auth to StoreFront: https://support.citrix.com/article/CTX223838

it looks like they can still be delegated, so I guess you need to go down the delegation path and make sure the accounts don’t have the sensitive flag checked which disables delegation

We have SAML/FAS in one of the environments. But that does not cover all the accounts. Also does not address the management logon

You’d need to front the management interface with AAA, it doesn’t support that by default

So create AAA for ldap or something and use it as a server?

yes, I’ve never done it so I’m not sure if you can front the management gui with AAA, but that’s the only thing I can think of

ok that makes sense. I will see what I can dig up. Seems like a common issue people would have... Anyhow on that KCD article. Do I just create an AD account and add it to Session policy for storefront

I haven’t ever done it

🙂

I’ve never run into a situation where impersonation wouldn’t work

yea, this is a bit of special case situation