Just an FYI for anyone else trying to secure Netscaler with the newer application protections. The guide is missing a couple of critical steps. The nFactor flow won't always send the proper password credentials to the Storefront causing an error of unable to connect. The logs will show:
CitrixAGBasic single sign-on failed because the credentials failed verification with reason: Failed. The credentials supplied were; user: test domain: test
To fix this, inside of the login schema that it asks you to create you need to add a couple more variables:
User Credential Index: 1
Password Credential Index: 2
Then you need to make a traffic policy and define:
SSO User Expression: HTTP.REQ.USER.ATTRIBUTE(1)
SSO Password Expression: HTTP.REQ.USER.ATTRIBUTE(2)
Apply the traffic policy to the Virtual Server and it should then properly send the correct password to the storefront.
Hope this helps someone.
