RBA logon through RSA Authentication Agent for Citrix StoreFront 1.0 fails with "Cannot complete request"
Originally Published: 2016-11-14
Article Number
Applies To
RSA Product/Service Type: Authentication Agent for Citrix StoreFront
RSA Version/Condition: 1.0
Issue
Cannot complete your request.
Cause
KB article 000033532 (How to increase your changes of successfully configuring Citirx Delegated Forms Authentication (DFA)) outlines that DFA should be configured and working successfully for password logons before attempting to add either SecurID passcode or RBA authentication. The article will provide some details on how to do that on the Citrix StoreFront server through PowerShell. For full details, review the DFA Configuration document on the Citrix website.
Resolution
- Configure the Citrix StoreFront back to standard DFA, without RSA SecurID or RBA, in PowerShell with the command:
Set-DSDFAProperty -ConversationFactory ExplicitAuthentication
- Test a Citrix logon through DFA with the default LDAP or AD password. If it still fails, look at the Windows Event Log on the Citrix StoreFront server when you get the authentication failure such as "Cannot complete your request." In one particular case we saw the following error:
The decryption of the delegated form body failed. Is there an encryption key mismatch?
System.Security.Cryptography.CryptographicException, mscorlib, Version=4.0.0.0
System.Security.Cryptography.CryptographicException, mscorlib, Version=4.0.0.0
This error indicated that the passphrase was not the same on the NetScaler as the StoreFront, even though it was verified. It turned out the there was a special character in the passphrase, which caused the discrepancy, so we simplified the passphrase to avoid special characters.
- On the StoreFront server, launch PowerShell and issue the following command to use a different, simpler passpharase:
Update-DSCitrixPSKTrustedClient -clientID <access_Web_agent> -passphrase <passphrase>
- se the same less complex passphrase on the NetScaler:
- Once you successfully logon to Citrix with an LDAP or AD password through DFA, you can change DFA to use SecurID in PowerShell.
Set-DSDFAProperty -ConversationFactory SecurIDAuthentication
- Test SecurID with a fixed passcode.
- If the test is successful, test again using RBA. Troubleshoot any script problems or RBA helper problems
Workaround
