Netscaler Cannot Connect to Server Try Connecting Again in a Few Minutes

Enhanced Authentication Feedback introduced since v10.1 is a NetScaler option disabled by default which provides more information to the terminate user nearly the reason for an authentication failure. By default when a user authenticates to as an example NetScaler Gateway and fails, the Wrong user name or password message returned is the only reason NetScaler will give.

The reason could be entirely different though. A disabled account, expired password, and restricted logon hours are just some of the reasons a failure could indeed occur. This is why the Enhanced Authentication Feedback option could prove useful to you lot and the end-user. It may reduce back up calls and make it easier for the back up team to resolve hallmark failures because they will get a more granular reason as to the failures.

On the other manus, a security risk is included when enabling this selection. In one case this option is enabled it will be easier for an attacker to identify if a user business relationship does not exist for example. Information technology is important to highlight this.

To enable, via CLI run command ready aaa param -enableEnhancedAuthFeedback or via GUI navigate to NetScaler Gateway -> Global Settings -> Change authentication AAA settings -> Enable Enhanced Authentication Feedback .

Fault codes and a list of supported reasons are given below:

• 4001 – Invalid credentials. Catch-all error from previous versions. (Incorrect credentials. Try again.)
• 4002 – Login not permitted. Take hold of-all error from previous version. (Y'all do not have permission to log on at this time.)
• 4003 – Server timeout. (Cannot connect to server. Try connecting over again in a few minutes.)
• 4004 – System error. (Cannot connect. Try connecting again.)
• 4005 – Socket error talking to authentication server. (Cannot connect. Effort connecting again.)
• 4006 – Bad (format) user passed to nsaaad. (Incorrect user proper name.)
• 4007 – Bad (format) password passed to nsaaad. (Wrong password.)
• 4008 – Password mismatch (when entering new password). (Passwords do not match.)
• 4009 – User non plant. (User not found.)
• 4010 – Restricted login hours. (You exercise not take permission to log on at this time.)
• 4011 – Business relationship disabled. (Your business relationship is disabled.)
• 4012 – Password expired. (Your password has expired.)
• 4013 – No dial-in permission (RADIUS specific). (Yous do not have permission to log on.)
• 4014 – Error irresolute password. (Could non change your countersign.)
• 4015 – Account locked. (Your account is temporarily locked.)
• 4016 – User password complexity requirement not met when irresolute password. (Could non update your countersign. The password must meet the length, complexity, and history requirements of the domain.)

Example – User not institute.

Example – Business relationship disabled.

How can I change the response codes returned past NetScaler?

Remember the point highlighted higher up. Enabling Enhanced Authentication Feedback will out of the box return a User non found response if you enter a username and LDAP can non find that actual username in Active Directory. This is a security concern. Now, the responses tin can be inverse.

Annotation: Citrix practice non support or help with this configuration. Perform this modification at your ain risk. If you exercise keep, make certain to always take a backup before changing a live environment.

For non-RfWebUI themes:

Open up WinSCP or like. Browse to and edit the following file:

• NSv11+ – /var/netscaler/logon/themes/default/resources/en.xml
• NSv10.5 – /netscaler/ns_gui/vpn/resources/en.xml

Note: If you accept a custom theme, the default portion will be whatever name you had specified during theme creation.

Edit the en.xml file and look for the department shown below.

Change any of the values then salve en.xml.

At present as an example, my modified "User not establish" text contains some new information!

Note: You might have to wait for a period of time, or warm reboot NetScaler to see the new feedback changes.

For RfWebUI themes:

Open up WinSCP or similar. Browse to and edit the following file:

• /var/netscaler/logon/LogonPoint/receiver/js/ctxs.cadre.min.js

Note: You volition probably desire to open up the file using Notepad++ or similar for easier reading. Search the file for errorMessageLabel and edit the reasons every bit appropriate.

nobleswhould46.blogspot.com

Source: https://www.jgspiers.com/netscaler-enhanced-authentication-feedback/

Share this post