Error: "401 - Unauthorized: Access is denied due to invalid credentials" - NetScaler Gateway or CAG

-
Hello everyone.

 In this post I am going to share you a solution to fix this dreaded Error: "401 - Unauthorized: Access is denied due to invalid credentials" when you access Citrix Web Interface 5.4 or Storefront via Citrix Access Gateway or Citrix Netscaler Gateway.

 There are numerous post out there and also there is a great post from Citrix to investigate and fix this issue if you come across.

 Meanwhile I came across this issue with Netscaler 10.5 Citrix Access Gateway and Web Interface 5.4.

Config and Setup info 

 1 Netscaler with 2 NIC's sitting in a DMZ with access to Backend internal server's via SNIP IP address and management via NSIP IP address, frontend User access via VIP accessible on the Internet.

 1 WebInterface in a Gateway Direct mode and authentication at the Netscaler configured for the default Citrix/Xenapp website.

 Troubleshooting

 I started with looking at the Windows 2008R2 - Web Interface event logs, Application and Security. No events logged whatsoever for the error and nothing related to access error.

 Enabled AAA.debug on Netscaler CAG to check if authentication is all okay. Steps to enable AAA.debug on Netscaler. AAA.Debug on Netscaler

 All User authentication was successful and enumerating group membership via LDAP Policy.

 Enabled and captured Network trace on the Netscaler CAG to check the packet flow.Steps to enable Network Trace on Netscaler.

 I could see in the Network trace that WebInterface was rejecting Netscaler with a reset packet and in the data Http 401 - invalid credential error was captured. But I still do not have a clue as to why this was failing.

 Microsoft IIS was looked into whether any recent Microsoft patches might have caused a lockdown of access method, including Windows Authentication with Kerberos and NTLM, changes to these made no difference.

 Reconfigured the LDAP Policy just to reassure that policy is correctly applies, reconfigured the Sessions Policy on Netscaler.

 Other way to test Call Back feature is to access FQDN of the VIP from the WebInterface server and if this is success without any errors that means no issues on the Network config. If you get certificate error or page cannot be displayed than you will have to import the Root Certificate and Intermediate certificate in the computer trusted root and intermediate store.
If the CAG VIP FQDN is not resolving you will need to then just create a DNS entry or hosts file entry on the WebInterface or StoreFront servers to point to this "internal" facing CAG VIP.

I added host file entry on the WebInterface and even created DNS entry to eliminate the name resolution issue but still the same error, it was evident the issue is on the Netscaler as every flow is fine from WebInterface.

Resolution

I looked into Session Policy on the Netscaler and started looking into the Gateway Session Profile, I noticed under the WebInterface address instead of FQDN of the WebInterface it was IP address of the WebInterface. Behold and as I changed this to FQDN of the WebInterface server followed by the path to the site ie: http://servername.domainFQDN/Citrix/Xenapp I was able to access my Citrix Farm and launch applications.

More details on the Citrix Netscaler Session Policy in this article.

 Points to consider when investigating this type of incidents check the logs on Netscaler and WebInterface.

Hope this helps.


Comments

Post a Comment

Popular posts from this blog

Windows 11 22H2 RDP disconnects and freezes randomly

-
Image
Namaste Everyone. I have been following and reading many forums with the similar issue of RDP session freezing or either getting disconnected frequently. Logs have not proved anything exceptional or drastic changes in the environment, however I was able to test this in my lab and have traced some Network Logs via the Wireshark and could see retransmision packets between the client and the server. This all started after the update to Windows 11 22H2. The resolution is to either rollback the 22H2 on the client or apply this registry or ADMX setting via the Group Policy. My theory is that after looking at the logs in my client is that the problem is due to the fact that the RDS connection is trying to connect over UDP and is not trying to connect over TCP if the UDP fails or gets block for some reason. So either you can manually set the registry in the client by following the below step: Browse to the below Registry Path with administrator account: HKLM\SOFTWARE\Policies\Microsoft\Win...
Read more

Certification - 70-533

-
Welcome Azure Techies!! In this blog I am going to share some tips and information on my personal experience in earning the Microsoft Specialist Azure Certification, specifically "Exam 70-533 Implementing Microsoft Azure Infrastructure Solutions". This was a great experience overall in achieving "Microsoft Specialist Certification", my journey started on the back of a several projects I was involved within the company and inclined to understand the in and out of the Azure Mechanics. At the time of writing this article Microsoft  exam measures your ability to accomplish the technical tasks listed below, and from March 2016 onward the Skills Measured for this exam will change and include some updates, Please refer the link for more information on the changes. Link I would suggest and recommend to keep checking this page regularly for the updates from Microsoft. Link. There are many helpful articles and guidance from the Pro's in earning the Certi...
Read more

Windows 2019 Server Change TimeZone error "Unable to continue" You Do not have permissions to perform this task.

-
Image
 Namaste everyone, During the install of a new Azure AD Connect software I was provided a brand new Windows 2019 Server Datacenter Edition and this was fully patched and updated with the Security patches. There were no Group Policies with exception of the Domain Policy and a SCCM Server Policy for patching. I noticed the time was out of sync an hour as the server was located in the different region and all other servers were set to local region settings. So the usual step is to try and change the date and time from the Control Panel, however when I tried to update the time I received a message that I cannot change the time. "Unable to continue" You Do not have permissions to perform this task. Please contact your administrator for help. The simple fix to use the Get-Timezone and Set-Timezone PowerShell commands,  Get-TimeZone -ListAvailable | where StandardName -like "*GM*"    ( This command will extract the specific Timezone with the words GM in the StandardName, y...
Read more