Netscaler 10 Load Balanced vServe w/ AAA Double Login Prompt

I have setup a Load Balanced vserver to use AAA for authentication. When I type in the FQDN of my vserver I get the login page for the AAA server which is great.  I login and then get another Windows login prompt to connect to my backend SharePoint server. After I login I can access the site without issue. I am using cookie insert with a 0 timeout value for persistent.

Any thoughts or suggestions?
LVL 21
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Dirk KotteSECommented:
do you see this articles?
Case Study: Using AAA Virtual Server to Remove Multiple Authentication Prompts for Web Application

and if you used Form Based authentication at Sharepoint:
How to Configure NetScaler Gateway for Single Sign-On to a Web Form
compdigit44Author Commented:
Thanks for the great articles. We are not using FBA and am still trying to understand the articles and trying to understand what I need to change to all the netscaler to pass  the credential to the back end web server
compdigit44Author Commented:
It sounds like I need a traffic policy but since we are not using FBA not sure what to put in for the reference URL..

I am still learn the Netscaler so please be patient with me.
Dirk KotteSECommented:
the first article don't use Form based authentication to the backend. the config example is for NTLM.
which part of the configuration a problem for you?
compdigit44Author Commented:
I am still learning the Netscaler so please bare with me..

In the GUI I am confused what I need to configure for the traffic policy.  I tried to match up the setting with a traffic policy and profile then applied it to my load balanced vserver but it did not work

Traffic Management Policy
add tm sessionAction prof_session_sharepoint_auth -sessTimeout 10 -defaultAuthorizationAction ALLOW -SSO ON
add tm sessionPolicy vs_auth_sharepoint Netscaler_true prof_session_sharepoint_auth

The Traffic Management Policy enabled the Single Sign On feature.
compdigit44Author Commented:
I tried creating another session policy with the default of allow and enabled SSO... and got the same result
Now one thing is my authencating domain field I left blank on my AAA vserver. My external domain is but my internal domain which user authenticate against is

Dirk KotteSECommented:
do you create "Authentication vServer" and bind the traffic management policy?

"bind authentication vserver vs_auth -policy vs_auth_sharepoint -priority 100"

here you have to config your internal authentication domain, not the FQDN from the webpage:
add authentication vserver vs_auth SSL 443 -AuthenticationDomain

sorry, would suggest to check the resulting config from CLI and add new lines from CLI also.
I am unsuccessful from GUI sometimes.
compdigit44Author Commented:
still a bit confused doing it via the command line... how can I do this via the GUI
Dirk KotteSECommented:
here are usable CLI and GUI config guide.

compare the steps needed with the corresponding GUI.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
compdigit44Author Commented:
Thanks that was a huge help.. I made a mistake originally on step 5
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today

From novice to tech pro — start learning today.