just sorting a traffic policy for sso to SF

yeh originally i had both ldap and radius in the same policy label

if i do not enter anything in the pin+passcode box it doesnt allow me in now. if i successfullyput in username and password and add pin+passcode it allows me in and passed me through to SF

i think because radius was last in the chain it was sending the radius creds to sf as i was getting a cannot complete your request error so i had to create the traffic policy that passed the username and password

its all working on 8 netscalers fine but i am having issues with a couple where i get a bad radius pssword rejecting with error code 4007. its strange as this have the exact configuration settings as the 8 that are working ok with below config

to summarise i have a username only login schema which is bound to AAA vserver. The advanced auth policy also bound to AAA vserver is doing group extraction via ldap auth is off/ next factor configured on that auth policy bound to AAA is a policy label called mfa-policylabel this policy label has the dualauth login schema bound and a ldap policy which has authentication enabled. I have set user credential index to 1 and password credential index to 2 on the dualauth login schema. Next factor on the ldap policy is a Radius policylabel which has no login schema bound and a radius policy/server. I then have configured a SSO traffic policy that gets the following for sso user expression http.req.user.attribute(1) and http.req.user.attribute(2) for sso password expression. This traffic policy is then bound to my ns gw vserver

there is a nother policy label that looks at group membership but didnt want to complicate it