This message was deleted.

As long as they aren't using it, it'll be fine.

You know what's coming next don't you - it's that kind of customer - how would they know they aren't using it? Is there something I can check to verify that?

if they using an IDP such as Azure AD /OKTA ect they will be using SAML so potentially breaking auth. If they just use standard ldap auth they not impacted by it

You'll need to check for authentication policies on the ADC to see what points where. Should be fairly straight forward.

You should be able to check the AAA/Vserver policies. This link will get you to the right spots. Ignore the troubleshooting part.

Damn, now I'm going to have to log into the damned thing

Or request the config file

easiest method is check the GW Vserver and look at the basic auth (primary/Secondary auth) if there is nothing bound and it has a authentication profile set you will need to look at the AAA auth profile / Vserver and check the setup might be a advanced auth policy bound on the AAA vserver or could be using Nfactor and your would have to look at the Nfactor visualizer

I've asked one of the people with access to export the config file and have a look (it's the kind of client that can't send it to me without a full genetic scan first) - cheers all

or can grep it out cat /flash/nsconfig/ns.conf | grep samlaction -i

That might make their head explode

Option 2, screen share once they have the running config in notepad and find SAML lol if not found it's not being used. These types of clients always make me laugh. Belt and braces about config files etc... But they probably have the same local admin account on all servers.

Lord God, you think I can do a screen share?! That would involve me probably being arrested

Sounds like you have some super strict rules you have to get through.

Yeah, but those rules don't extend to support and therefore, patches

disable the Netscaler acting as a saml idp/sp ? you would need to remove any saml advanced auth polices and switch to a different kind of authentication

So if they're not in ns.conf, no action required?

yup

Correct

Thanks all