Citrix Cloud FAS error 103

[oraat]

I have this single FAS server that works just fine with my on prem Citrix. I can see from the event logs as well as from Issuing CA that it obtains certificates for users and everything works.
But this works only with my onprem Citrix. When I try to use this same FAS server  with my Citrix Cloud POC (AAD) I get always the event ID 103 in FAS Application log.

 

And yes, FAS is enabled in the Citrix cloud and FAS server is added to resourse location. Checks are just fine. FAS server version is the newest, i.e. 10.0.0.2.

 

exact error is:
[S103] Server [CC:60da6poppfzr] requested UPN [user.name@domain.aad] SID S-1-5-21-3676925492-572991883-3269444322-1312, but lookup returned SID S-1-5-21-2053793227-2943714206-3195920420-14243. [correlation: cc#37424020-c340-4bd0-99aa-55d76feee3f7]

 

Problem is somehow related to account SIDs, I have AAD ghost accounts on my on prem domain. AAD accounts are used to login to Azure. On prem domain is completeley different domain, so users are not synced to anywhere, as said on prem domain has only ghost accounts from the AAD.

Also no trusts, because I want to use federation.

 

 

Can't find any info about this error with G, only that this is one of the FAS errors.

Any info/experience about this error ?

thanks,

[Nicholas Preetzmann1709157772]

Hi oraat,

 

Did you manage to solve the S103 error? I have the exact same issue.

 

Nicholas

On 12/18/2019 at 6:20 AM, oraat said:

I have this single FAS server that works just fine with my on prem Citrix. I can see from the event logs as well as from Issuing CA that it obtains certificates for users and everything works.
But this works only with my onprem Citrix. When I try to use this same FAS server  with my Citrix Cloud POC (AAD) I get always the event ID 103 in FAS Application log.

 

And yes, FAS is enabled in the Citrix cloud and FAS server is added to resourse location. Checks are just fine. FAS server version is the newest, i.e. 10.0.0.2.

 

exact error is:
[S103] Server [CC:60da6poppfzr] requested UPN [user.name@domain.aad] SID S-1-5-21-3676925492-572991883-3269444322-1312, but lookup returned SID S-1-5-21-2053793227-2943714206-3195920420-14243. [correlation: cc#37424020-c340-4bd0-99aa-55d76feee3f7]

 

Problem is somehow related to account SIDs, I have AAD ghost accounts on my on prem domain. AAD accounts are used to login to Azure. On prem domain is completeley different domain, so users are not synced to anywhere, as said on prem domain has only ghost accounts from the AAD.

Also no trusts, because I want to use federation.

 

 

Can't find any info about this error with G, only that this is one of the FAS errors.

Any info/experience about this error ?

thanks,

 

[Robin Whittle1709158660]

On 1/8/2020 at 10:08 PM, Nicholas Preetzmann1709157772 said:

Hi oraat,

 

Did you manage to solve the S103 error? I have the exact same issue.

 

Nicholas

 

 

Were either of you able to resolve this one?

Thanks

[Magnus Edholm]

On 1/8/2020 at 11:08 PM, Nicholas Preetzmann1709157772 said:

Hi oraat,

 

Did you manage to solve the S103 error? I have the exact same issue.

 

Nicholas

 

Hi

 

Did any manage to solve the S103 error? I have the exact same issue.

[Thiago Bravin1709161877]

Having the same issue, It seems FAS is checking the user SID from azure AD with the SID from shadow account created on the local domain. Did you find a solution for this?

[Josh Farlow1709163581]

Any update here? I am experiencing the same issue. Thank you

[Julian Jakob]

Hey guys,

 

as I had exactly the same issue, but only with Citrix DaaS, as OnPrem CVAD + NetScaler was working fine, I narrowed it down and wrote a detailed blogpost.

Spoiler: You need a NetScaler (OnPrem / Cloud / Adaptive Auth / whatever hosted) to be able to solve this.

 

https://www.julianjakob.com/citrix-fas-sid-lookup-mismatch-with-citrix-daas/

 

Best Regards

Julian