Netscaler login looping back to login page

[Jocelyn Briere]

On 6/29/2022 at 2:45 PM, Joost Sannen said:

It's not fixed yet so there are no release notes containing this bug ID. I'll update when I've more information from Citrix.

 

Anybody heard back from Citrix ? We are still having the issue and support isnt helping at all, Workspace is looping and sessions timeout seem not to work anymore. Web is fine.

Tried the rfwebui fix, overwrite the default timeout to no avail so far.

Edited July 12, 2022 by Jocelyn Briere
Missing details

[Kelly Jones]

On 7/12/2022 at 6:18 PM, Jocelyn Briere said:

 

Anybody heard back from Citrix ? We are still having the issue and support isnt helping at all, Workspace is looping and sessions timeout seem not to work anymore. Web is fine.

Tried the rfwebui fix, overwrite the default timeout to no avail so far.

did you resolve this issue, we have this issue on 13.0.87.9

[Jocelyn Briere]

On 8/17/2022 at 7:23 AM, Kelly Jones said:

did you resolve this issue, we have this issue on 13.0.87.9

Hello,

No this is a major pain the the butt so far!!!

We have been talking to support for more than 2 months about this and have 2 escalation team looking at it (ADC, Workspace + eng)

So far they have found some ssl errors on the Netscaler when the looping occurs. Were now collecting fiddler traces for them and Workspace verbose logs to see whats happening from the client side.

 

Timeout definitely seems not to work and session management is all over the place.

We have seen people getting other users sessions when the loop occurs. 

Sometime a user will login just fire but other times we'll get the loop 2-10 times before actually being able to login.

 

This seems to happen mostly with the workspace (web login seems fine 99% of the time)

[Joost Sannen]

Hmm, seems to be a hard nut to crack for Citrix ?. I just found https://support.citrix.com/article/CTX459672 . No fix yet.

[Vinod Yadawa]

Override the session timeout on the Client Experience tab in session profiles bound to your Gateway vServer, and set the value to 720 had worked for me.

 

Also, had got a fix from Citrix to fix gateway issues and get A+ cert ratings .

 

Disable HSTS in SSL profile and run following command. Later enable HSTS

 

nsapimgr_wr.sh -ys call=toggle_vpn_datalen_multipleof_mss

[Jocelyn Briere]

So after 3+ months and many escalations to the dev team Citrix finally found the issue and came out with a solution. 

They found out that some javascript files were wrong and the code needed to be corrected.

Support provided us with new webview_complete_browser and webview_complete_native files.

Upon applying those new files all the login loop stopped immediately without needing to do anything else.

Support told us that these changes would be available on the next release as it was definitely a bug with the Workspace and ADC.

[Julian Jakob]

A fix for the issue is already released in 13.1 - 33.47 and will be released in future release 13.0 - 88.x with ETA Oct 18th, I got these informations from Citrix Support.

[Dominic Ottiger1709163156]

I updated the Netscaler on 20th October, when it was released.

(13.0 Build 88.12 Oct 20, 2022| NEW)

 

I still have some User claiming the Login Loop. I dont know if its a cache thing or something. It worked with Private Mode.

 

Anyone else have some conclusions?

 

Thx all

[Michael Hammer1709162612]

As a workaround you can change session timeout value  to 60 in session profile 

Gateway >> Virtual server >> Session policy >> Edit session profile >> Client experience >> Session timeout. Change it to 60 and enable override global.

[Andy Stadtlander]

Can anyone confirm NSHELP-30832 is resolved in 88.12? It's not mentioned as fixed in the latest Release Notes:

https://docs.citrix.com/en-us/citrix-adc/downloads/release-notes-13-0-88-12.html

[Joost Sannen]

Hi Andy,

On 11/3/2022 at 9:09 PM, Andy Stadtlander said:

Can anyone confirm NSHELP-30832 is resolved in 88.12? It's not mentioned as fixed in the latest Release Notes:

https://docs.citrix.com/en-us/citrix-adc/downloads/release-notes-13-0-88-12.html

 

Asked Citrix the same and the answer I got is bug ID NSHELP-30832 is cancelled and duplicated to a consolidated bug id NSHELP-31478. It is noted in the release notes from 13.0 88.12.

 

So when @Dominic Ottiger is still experiencing issues please open a new support case. I myself have to wait for this fix for the 13.1 release.

[Gerald Körber]

we have upgraded to NS 13.1 33.52 due to the security bulletin released yesterday and this issue is still there, seriously?

[Dominic Ottiger1709163156]

Hi all

 

As mentioned, updating did not help. So, I looked for other Solutions. Only setting Timeouts on my Session Profiles on the vServer itself, helped. Now it works like a charm.

 

 

Hope that helps you. My Problem is solved now.

 

Regards,

Dominic

[Marco Hofmann]

NS13.1 33.47.nc: Can confirm @Dominic Ottiger that it now works with the settings from the screenshot.

[Sukumar Andela]

Thank you

[Cormac Long 2]

Anyone still seeing this issue? I have an appliance on 13.1 33.52 and i am still seeing it. Setting the timeouts as above does not resolve it either.

[Loris Delorenzi1709163142]

On 1/17/2023 at 9:54 PM, Cormac Long 2 said:

Anyone still seeing this issue? I have an appliance on 13.1 33.52 and i am still seeing it. Setting the timeouts as above does not resolve it either.

 

For me, the solution provided from Dominic worked fine as well. In my case, I only set the Session Time-out and left the Client Idle Time-out blank.

Make sure that you override the settings in the session profile. Let the global settings as they are.

[Alex Jordan]

Wanted to mention that we're still seeing this issue on 13.1 33.54. The workaround: setting the Session Timeout and Client Idle Timeout at the Session Profile resolved it as well. 

[Mattias Waara1709163261]

Still seeing this issue on 14.1 8.50.  The workaround: setting the Session Timeout in the Session Profile resolved it as well. 

[Dia]

Hello everyone

 

We have also encountered the same problem since we switched from X1 to RFWeb UI. I have tried adjusting the client idle timeout and session timeout, unfortunately, it doesn't help. When I switch back to X1, it works. I am grateful for any help.

[Ray Davis]

I just confimed this as well, We were getting the NetScaler Gateway Login Loop with Entra ID. This work around is allow CWA now to login as it should.
14.1.21.57 verison. Need to check release notes on this and see if it was addressed in higher verisons.