FAQs
After upgrading Adaptive Authentication or NetScaler, users cannot log in. What do I do?
Self-assessment checks:
-
If the Adaptive Authentication IdP FQDN is not accessible:
- Check whether the authentication virtual server (auth_vs) is UP.
- If it is not UP, verify that the certificates are correctly bound.
Unsaved configurations or misconfigurations can cause certificates to become unbound or lost, which can bring the authentication virtual server DOWN.
-
Check whether the cloud tunnel virtual servers are UP from the primary Adaptive Authentication NetScaler CLI using:
show cloudtunnel vserver.Due to intermittent Azure IMDS connectivity issues, cloud tunnel virtual server configurations might be lost after a reboot.
Workaround: Perform another reboot.
-
If LDAP is used, ensure that
ldapActionis configured with a timeout (authTimeout) of 7–10 seconds.Note:
This LDAP-related login issue can occur regardless of whether an upgrade was performed.
Why does the Adaptive Authentication NetScaler instance show as “Down” or “In Grace Period” in ADM/NetScaler Console?
The Adaptive Authentication NetScaler instance entry appears in Console Service > Infrastructure > Instances > NetScaler.
-
The state shown in the console as UP (green) or DOWN (red) indicates connectivity between Console Service and Adaptive Auth NetScaler instances, not the actual state of the Adaptive Authentication node.
-
A DOWN connectivity state does not affect user login or functionality, but it can have these effects:
- Citrix cannot push upgrades to the NetScaler instance.
- Adaptive Authentication NetScaler LAS license lease refresh might fail, and instance bandwidth might be limited to 10 Mbps if connectivity remains DOWN for more than 30 days. A warning banner appear in the NetScaler admin UI.
Restore connectivity:
If the connectivity status appears as DOWN in the ADM/NetScaler Console, you must restore it. Perform the following steps or contact Citrix Support:
- SSH into the NetScaler instance whose connectivity status is shown as DOWN.
- Run shell.
-
Verify whether the mastools process is running:
ps -ax | grep mastoolsThe output must show both mastools and mastools_upgrade processes as running.
-
If needed, restart mastools:
cd /var/mastools/scripts./mastoolsd restart
Why do users get “Relaying party requested claims of user not found” after an Adaptive Authentication upgrade?
-
If the issue occurs before the Adaptive Authentication IdP login page appears, contact Citrix Support.
-
If the issue occurs after the Adaptive Auth IdP login page appears and after credentials are entered:
-
Ensure that the user has all 7 of the following required claims in AD.
- Email address
- Display name
- Common name
- sAMAccountName
- User Principal Name
- Object Identifier (OID)
- Security Identifier (SID)
-
If you are using SAML or RADIUS, add a NOAUTH LDAP factor at the end to extract all 7 required claims.
-
Adaptive Authentication is not working over LDAP ports 389 or 636. What do I check?
Ensure that connectivity testing (GUI: Test Network Connectivity) is performed from the primary node only.
- Verify that the tunnel to the on-premises AD is successful by checking for the Entering bitpump log entry in
ns.log. - If the tunnel is successful, run
cat /tmp/aaad.debugto view the authentication error. - If the issue persists, contact Citrix Support.
I’m trying to provision Adaptive Authentication appliances but the onboarding flow asks me to complete a form I cannot access. What do I do?
The form used to request Adaptive Authentication provisioning might display an “access denied” error to some customers.
Workaround:
Contact Citrix Support to submit the provisioning request directly.
How long does it take to enable Adaptive Authentication after the form is submitted?
A minimum of three business days.
In this article
- After upgrading Adaptive Authentication or NetScaler, users cannot log in. What do I do?
- Why does the Adaptive Authentication NetScaler instance show as “Down” or “In Grace Period” in ADM/NetScaler Console?
- Why do users get “Relaying party requested claims of user not found” after an Adaptive Authentication upgrade?
- Adaptive Authentication is not working over LDAP ports 389 or 636. What do I check?
- I’m trying to provision Adaptive Authentication appliances but the onboarding flow asks me to complete a form I cannot access. What do I do?
- How long does it take to enable Adaptive Authentication after the form is submitted?