Netscaler OAuth Duo Universal Prompt

[Poster34232]

We recently set this up following the documentation here. Everything appears to work correctly...logins to the Netscaler, duo prompt, and getting into an internal desktop.  However, once in, when launching apps on the internal desktop via workspace app, we are getting an incorrect username and password.

It's my understanding that with this method, you do not need Citrix FAS, however, it is behaving exactly the same as Duo SSO with no FAS.

The only difference I see is when launching the same desktop via our production gateway still using iFrames is the following:

The Citrix Desktop Service detected that a user session has started. User 'samaccountname' has started session.

Via Duo Oauth:

The Citrix Desktop Service detected that a user session has started. User 'UPN' has started session.

Our internal storefront these VDAs are connecting to does accept UPN logins.

We have a ticket open with Citrix on this, but have been waiting a few days for a response.

[DuoKristina]

Have you already take an look at and tried the suggestions in this Duo KB article: https://help.duo.com/s/article/9044 ?

If so, then NetScaler support is our next suggestion, and sounds like you've already started that process.

[Poster34232 · Accepted solution]

Thanks, but this actually was some left over Citrix FAS configuration (when we were testing DUO SSO) on storefront that was causing this issue. Once we disabled that, the SSO issues into workspace app on the desktop cleared up.

[DuoKristina]

Glad you got to a working config! Are you able to mark your post as solved with your own comment (I have no idea)?