Loop eventid 1007 after upgrade

[marco_aimi]

hello!

after we Jumped from 2209 to 2311 we have recourrency eventid 1007 in config services and never happened behavior after login ( via Netscaler gateway on STA) to storefront ( 2 or 3 Hit login before POST to Application) 

Jump also to tech preview 2402 but still fails random Login and 1007 eventID

Know issue https://docs.citrix.com/en-us/citrix-virtual-apps-desktops/whats-new/known-issues.html  seems ourt of scope

We are in stack : in LogOnSummary SQL Table event are not logged.

On ACD Live authentication are fine .

Anyone can help to find a road map or if in NewRelease will be fixed ?

Since 10 year of Citrix services it's first time we have this BUG

Thank's to anyone can help to way out

 

 

root@nsprd01# cat /tmp/aaad.debug | grep aimi
user :marco.aimi, vsid :42553, userlen 10
user :marco.aimi, vsid :42553, req_flags 400802
 /usr/home/build/adc/usr.src/netscaler/aaad/naaad.c[6055]: cascade_auth 1-152600: starting ldap auth for: marco.aimi, sizeof(*ar) is 36, userlen 11
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[154]: start_ldap_auth 1-152600: attempting to do ldap auth for marco.aimi @ xxxx
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[984]: continue_ldap_init 1-152600: User marco.aimi Connecting to: xxxx:636
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[315]: receive_ldap_bind_event 1-152600: User name: dirty = <marco.aimi> sanitized = <marco.aimi>
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[317]: receive_ldap_bind_event 1-152600: Admin bind successful, attempting user search event for marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[1401]: ns_ldap_search 1-152600: Searching for <<(& (sAMAccountName=marco.aimi) (objectClass=*))>> from base <<dc=afabpo,dc=local>>
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[490]: receive_ldap_user_search_event 1-152600: Admin authentication(Bind) succeeded, now attempting to search the user marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[792]: extract_ldap_multi_value_attribute 1-152600: While retrieving ldap attribute objectClass, 4 attribute values found for marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[533]: receive_ldap_user_search_event 1-152600: Updated usrobj for user marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved sAMAccountName value marco.aimi for marco.aimi, length is 10
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[692]: receive_ldap_user_search_event 1-152600: extracted attribute, name: sAMAccountName, value: marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved mail value m.aimi@avanade.com for marco.aimi, length is 18
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[692]: receive_ldap_user_search_event 1-152600: extracted attribute, name: mail, value: m.aimi@avanade.com
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved givenName value Marco for marco.aimi, length is 5
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved sn value Aimi for marco.aimi, length is 4
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved mail value m.aimi@avanade.com for marco.aimi, length is 18
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[692]: receive_ldap_user_search_event 1-152600: extracted attribute, name: mail, value: m.aimi@avanade.com
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[586]: extract_ldap_attribute 1-152600: While retrieving ldap attributes physicalDeliveryOfficeName attribute not found
for marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[690]: receive_ldap_user_search_event 1-152600: Doing ldap authentication, failed to extract attribute physicalDeliveryOfficeName for user marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved pwdLastSet value 133552393577402834 for marco.aimi, length is 18
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_common.c[650]: extract_ldap_attribute 1-152600: retrieved mail value m.aimi@avanade.com for marco.aimi, length is 18
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[817]: receive_ldap_user_search_event 1-152600: extracted attribute, name: mail, value: m.aimi@avanade.com
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[915]: receive_ldap_user_search_event 1-152600: For user marco.aimi, group stringLength 266
 /usr/home/build/adc/usr.src/netscaler/aaad/ldap_drv.c[2332]: receive_ldap_user_bind_event 1-152600: User authentication (Bind event) for user marco.aimi succeeded
 /usr/home/build/adc/usr.src/netscaler/aaad/naaad.c[4483]: send_accept 1-152600: sending accept to kernel for : marco.aimi
 /usr/home/build/adc/usr.src/netscaler/aaad/naaad.c[4399]: aaad_alloc_serialize_keyValue_attrs 1-152600: Total attribute values to PE : 155, email=m.aimi@avanade.com
user :marco.aimi, vsid :42393, userlen 10
user :marco.aimi, vsid :42393, req_flags 400802
 /usr/home/build/adc/usr.src/netscaler/aaad/naaad.c[6135]: cascade_auth 1-152600: Delegating email auth to kernel for : marco.aimi

[Jeff Riechers]

What happens if you do Storefront direct instead of going through Gateway?

What's the OS?

[marco_aimi]

OS 2019, yes going directly to StoreGTW work's

We use login schema AAA for MFA before 

 

 

[Jeff Riechers]

So what are the error messages that the client gets?

[marco_aimi]

no error, just back to 401 again for login

Before this we use FAS for authorization, on new release we bypass FAS

From Citrix ADC Gateway  random don't generate a ticket to store for authenticate user: there are any client debug tool ?

 

 

[Jeff Riechers]

What is your authentication method?  If SAML or oAuth you still need FAS.  Did you switch authentication to LDAP?

[marco_aimi]

we use LDAP  with custom OTP mail factor, we have bypassed FAS