Symptoms or Error
Solution
Basic check for cookie to be transferred:-
- The Sharepoint LB VIP and the AAA vip should be in the trusted site of the browser (preferred IE browser as IE and Word both are Microsoft application)
- The cookie type should not be HTTP only else the cookie wont’ be shared
- Cookie should be Persistent cookie (In latest NS firmware we have this option)
- Time/Timezone should be correct on NS and the Client and Sharepoint server so that cookie doesn’t get expired
Configuration on NS:-
??
Packet Flow:-
??
3. Client come to tmindex.html and then we see a POST happening with the credentials with TASS cookie after user entering the credentials
4. For this AAA sends a 302 back to sharepointcs.emea.in/cgi/selfauth where it sets NSC_TMAA and NSC_TMAS cookie and will expire the NSC_TASS cookie after authenticating the user
5. Now client comes to the sharepointcs.emea.in/cgi/selfauth without cookie and gets redirected to the sharepointcs.emea.in and again the same cookies were set
6.?? Now Client will send a GET to sharepointcs.emea.in with NSC_TMAA and NSC_TMAS cookie . NS will pass this to the Sharepoint backend server and server will ask for 401, NS will do SSO
7.?? After sso is successful then Sharpoint will send a 302 redirect to /SigeePages/Home.aspx and will set cookie:- WSS_KeepSessionAuthenticated
8.?? NS will pass the cookie to the client and will add one more NSC_PERS cookie and will send to the client
9.?? NSC_PERS is the persistent cookie set by the Netscaler based on the configuration and is very important since this cookie will be shared between the Internet Explorer and the Microsoft Word application and will keep the session authenticated
10.?? Page will load up
11.?? Now client will hit on upload/edit document on the Sharepoint page. During this time the Client Internet explorer will pass the cookies to the Microsoft word and you will notice a OPTIONS coming to Netscaler with user-agent as Microsoft work and very important NSC_PERS cookie and WSS_KeepSessionAuthenticated cookie should be present
12.?? Netscaler will pass this to the SharePoint server by striping the NSC_PERS cookie and keeping the WSS_KeepSessionAuthenticated cookie
13.?? After this you will see a 401 from backed ?? and a SSO from Netscaler as above and it will work.
Basically you have to see if the NSC_PERS cookie came in the OPTIONS field ( else NS will expire the session) and if WSS_KeepSessionAuthenticated came (else backend Sharepoint will expire the session)
??
Problem Cause
There could be following reason for this issue.
- Single sign on domain is not correct for the backend sharepoint server in the session policy
- Cookie is not being shared between the browser to the Word application
- The cookie in the traffic policy is wrongly set as "Http ONly" to yes, due to which it was not being passed to word application
Supporto Citrix
Traduzione automatica
Questo articolo ?? ¨ stato tradotto da un sistema di traduzione automatica e non ?? ¨ stata valutata da persone. Citrix fornisce traduzione automatica per aumentare l'accesso per supportare contenuti; tuttavia, articoli automaticamente tradotte possono possono contenere degli errori. Citrix non ?? ¨ responsabile di incongruenze, errori o danni derivanti dell'uso di articoli automaticamente tradotte.
Citrix技術支持
自動翻譯
這篇文章被翻譯由一個自動翻譯系統，並沒有受到人們的審查。 Citrix提供自動翻譯，增加獲得支持的內容;但是，自動翻譯的文章可能可以包含錯誤。思傑不負責不一致，錯誤或損壞因使用自動翻譯的文章的結果。
Поддержка Citrix
Tradução automática
Эта статья была переведена автоматической системой перевода и не был рассмотрен людьми. Citrix обеспечивает автоматический перевод с целью расширения доступа для поддержки контента; Однако, автоматически переведенные статьи могут может содержать ошибки. Citrix не несет ответственности за несоответствия, ошибки, или повреждения, возникшие в результате использования автоматически переведенных статей.
시트릭스 지원
자동 번역
이 문서 자동 번역 시스템에 의해 번역 된 사람들에 의해 검토되지 않았다. 시트릭스는 컨텐츠를 지원하기 위해 접근을 높이기 위해 자동 번역을 제공합니다; 그러나, 자동으로 번역 기사 오류를 포함 할 수있다. 시트릭스는 자동으로 번역 된 기사의 사용의 결과로 발생하는 불일치, 오류 또는 손해에 대해 책임을지지 않습니다.