Citrix Netscaler failing to properly handle New PIN Mode and On-Demand Authentication (ODA) when using RADIUS with RSA Authentication Manager 8.x
4 years ago
Originally Published: 2015-06-29
Article Number
000063072
Applies To
RSA Product Set:  SecurID
RSA Product/Service Type:  Authentication Manager
Issue
When a user with a token in New PIN Mode tries to authenticate through a Citrix Access Gateway to RSA Authentication Manager 8.x, authentication fails even though the correct tokencode is entered and the PIN being created is compatible with the defined token policy that allows for a user-created PIN.

In the On-Demand Authentication (ODA) scenario, the user is not getting the email or SMS with the tokencode after entering the correct PIN.  Below is a detailed description of the issue: 
  1. The user connects to the Citrix portal, and is prompted for his user ID, tokencode or PIN (if using ODA).
User-added image
  1. The user is asked to create a new PIN then prompted to re-enter the PIN.
User-added image
 
User-added image
  1. Citrix responds that the new PIN has been accepted and to wait for the tokencode to change, then enter the new passcode (PIN + tokencode) and click Submit. 
User-added image
  1. When the user enters the next passcode, an Access Denied message displays.
Cause
Citrix, the RSA Partner group and RSA Continuing Engineering all state that this behavior is how Citrix and ODA are designed to work.   
 
Resolution
The user should enter the new PIN that was just created at the prompt stating "PIN Accepted. Wait for token to change, then enter the new tokencode."
 
Workaround
Below are several options to have this work 

Option 1

The securid.ini file that handles the messaging can be edited so that the steps users need to take are more clear.  Editing this file will change the messaging seen by users to all RADIUS clients.  Citrix article CTX124374 on how to modify the RSA token prompts displayed by NetScaler Gateway has information on how to make the required changes to the securid.ini directly on a Windows server.  RSA Authentication Manager admins can make the change through the Operations Console using the steps below.
  1. Login to the Operations Console.
  2. Select Deployment Configuration > RADIUS Servers.
  3. Click on the drop-down next to the RADIUS primary and choose Manage Server Files.
  4. Click on the arrow next to the securid.ini file and select Edit. 
  5. Following the steps in the Citrix article above, edit the ExtInputNextCode value, the ExtOutputChange value or both.  Note that there is a 255-character maximum for the message. 
  6. When done, click Save and Restart RADIUS Server.
  7. Repeat steps 1 through 6 for any replicas in the deployment. 


Option 2

Refresh the Citrix webpage after setting the new PIN.  The user can typically authenticate normally with the passcode (PIN+tokencode).  


Option 3

In the case of ODA, refreshing the page will trigger a new email or SMS that will be sent to the user.
Notes
Citrix has raised a defect for this issue (TSK0534888).  If the customer is not satisfied with the workarounds provided, we recommend opening a ticket with Citrix support.
Don't see what you're looking for?