> For AI agents: [llms.txt](https://docs.trustedauth.com/llms.txt) provides a Markdown index of this documentation. # Citrix Netscaler This technical integration describes how to integrate Citrix NetScaler and Identity as a Service. Once integrated, access to the server will require Identity as a Service authentication. The NetScaler details, such as the IP address, name, configuration secret, and ports can be added or modified during the VPN server configuration. ## Supported authentication methods | Authentication method | Notes | Supported protocols | | ------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------ | | Password | Password authentication is first-factor authentication with Identity as a Service password feature. | PAP, CHAP, MS-CHAP | | RADIUS | RADIUS authentication is first-factor authentication with a RADIUS server. | PAP, CHAP, MS-CHAP | | External | External authentication is first-factor authentication with an LDAP-compliant directory or a Windows domain controller through Kerberos. | PAP | | Grid\* | Two-step authentication only. | PAP, CHAP, MS-CHAP | | Token | Hardware/software Mobile Soft Token (supports response-only tokens for second-factor authentication) | PAP Entrust tokens also support CHAP and MS-CHAP | | Temporary Access Code | | PAP, CHAP, MS-CHAP | | One-time password | Two-step authentication only | PAP, CHAP, MS-CHAP | | Knowledge-based questions and answers | The RADIUS proxy only supports a single question and answer. For CHAP and MS-CHAP, the answer must be an exact match. Two-step authentication only. | PAP, CHAP, MS-CHAP | note The PA-VM supports only CHAP authentication methods with RADIUS. ## Prerequisites Complete the following steps before integrating your authentication system with Identity as a Service: 1. Install and configure your first-factor authentication resource using the documentation provided by the vendor. The first-factor authentication resource can be a RADIUS server or an external authentication resource (a Local DB, LDAP-compliant directory or Windows domain controller through Kerberos). 2. Install and configure the RADIUS appliance using the documentation provided by the vendor. The device must be able to route traffic before integrating with Identity as a Service. 3. Install and configure Identity as a Service and an Identity as a Service Gateway (containing a RADIUS proxy agent). Take note of the shared secrets, IP addresses, and ports you use. You need this information to configure the RADIUS appliance and first-factor authentication resource. 4. If you want to configure your RADIUS appliance and first-factor authentication resource to recognize Identity as a Service user groups, you must define the Identity as a Service user groups first. ## Integrate Citrix Netscaler Complete the following procedures to integrate Citrix NetScaler with IDaaS. ### Step 1: Configure the Citrix Netscaler server #### Configure CITRIX Netscaler server 12.0 1. Log into the Citrix NetScaler Configuration utility. ![Citrix NetScaler Configuration utility](/assets/images/citrix-netscaler-configuration-utility-f2f0087380b699cd378713bc5af50d0e.png) 2. Expand the **NetScaler** **Gateway** option on the left-hand menu. ![Citrix NetScaler Gateway option](/assets/images/citrix-netscaler-gateway-option-2b7ac99adf628335d4b678700d125c3a.png) note You can configure the authentication, policy, and virtual servers manually or you can use the Access Gateway Wizard. The wizard is much easier and configures the authentication on a global level. 3. Select the **NetScaler** **Gateway Wizard**. The **NetScaler** **Gateway Wizard** appears. ![Citrix NetScaler Gateway Wizard](/assets/images/citrix-netscaler-gateway-wizard-edaf6dcd2fbd960e86597dff85ad3151.png) 4. Click **Get Started** to continue. The **NetScaler** **Gateway Settings** page appears. ![Citrix NetScaler Gateway Settings](/assets/images/citrix-netscaler-gateway-settings-25da1b73b2ee854c0816da439d0cdce0.png) 5. Do one of the following: - If you are creating a New Virtual Server, enter the IP address, port, and virtual server name for the new virtual server. - If you are modifying an existing virtual server, select existing and then choose the virtual server to modify. 6. Click **Continue**. The **Server Certificate** page appears. ![Citrix NetScaler Server Certificate](/assets/images/citrix-netscaler-server-certificate-42dac4e2759515609dc2691658a471b6.png) note The Virtual Server for the Access Gateway needs to have a certificate installed, or the Virtual Server interface is disabled. There are several options for creating and selecting the Virtual Server certificate. In a production environment you would most likely install a certificate from a trusted Certificate Authority using a certificate signing request. To get the system up and running quickly you can simply use a test certificate issued by the device itself. 7. In the **Server Certificate** page, do the following: 1. The **Server Certificate** section, select **Create Test Certificate**. 2. In the **Certificate FQDN** box, enter a domain name that users will enter into the browser. 8. Click **Continue**. The **Authentication Settings** appear. ![Citrix NetScaler Authentication Settings](/assets/images/citrix-netscaler-authentication-settings-5f9876a59429e40813b833dccd51f48e.png) 9. In **the Authentication Settings** page, you can configure Primary and secondary authentication. 10. Under **Primary authentication method**, you can select **Local users** or **Active Directory/LDAP**. For this procedure we use Active Directory/LDAP. 11. For the **Primary authentication** set the following: 1. Enter the **IP Address** of the Active Directory/LDAP server. 2. Enter the **Port** that Active Directory/LDAP server is listening to for requests (default 389). 3. Enter the **Base DN** under which users are located. > **Example:** `CN=Users,DC=example,DC=com`. 4. Enter a valid **Password** to log onto Active Directory/LDAP server. 5. Enter the value you entered in the **Password** field into the **Confirm Password** field. 6. Accept the **Time out** default value. 7. In the **Server Logon Name Attribute** enter **SAMAccountName**. 12. To set the **Secondary authentication method**, do the following: 1. Select **RADIUS** from the secondary authentication drop-down list. 2. Enter the **IP Address** of the RADIUS server. 3. Enter the **Port** that RADIUS server is listening (default 1812). 4. Set the **Time out** to **50**. 5. Enter the **Secret Key** (shared secret). 6. Confirm the Secret Key. note You need to increase the **Time out** value if you are using TVS (Mobile ST) authentication. This can also be confirmed by tracking how long a request waits before it times out. 13. Click **Continue**. The **NetScaler Gateway Wizard** page appears. ![Citrix NetScaler Gateway Wizard Successful](/assets/images/citrix-netscaler-gateway-wizard-successful-9e9251f6a819adcf8bb85407da055ae6.png) 14. Review the settings and click **Done** to complete the configuration. 15. Verify that the setup is working: 1. Expand the **NetScaler** **Gateway** option on the left-hand menu. Select the **Virtual Servers** options. The **NetScaler** **Gateway Virtual Servers** page appears. 2. On the **Virtual Server** page and ensure that the state is **UP**. #### Configure CITRIX Netscaler 12.1/13.0 service 1. Log into the Citrix NetScaler Configuration utility. ![Citrix NetScaler Configuration utility](/assets/images/13-citrix-netscaler-configuration-utility-f8454bc6edaaf921d13bbab778337e9c.png) 2. Expand the **Citrix** **Gateway** option on the left-hand menu. ![Citrix NetScaler Gateway option](/assets/images/13-citrix-netscaler-gateway-option-7e7f85c615668985638c8984131f84cd.png) note You can configure the authentication, policy, and virtual servers manually or you can use the Access Gateway Wizard. The wizard is much easier and configures the authentication on a global level. 3. Select the **Citrix** **Gateway Wizard**. The **Citrix** **Gateway Wizard** appears. ![Citrix NetScaler Gateway Wizard](/assets/images/13-citrix-netscaler-gateway-wizard-c71f033af87723e5828dedcd5a4762f8.png) 4. Click **Get Started** to continue. The **Citrix Gateway Settings** page appears. ![Citrix NetScaler Gateway Settings](/assets/images/13-citrix-netscaler-gateway-settings-c5275bd1950aca1564da33f395e8bfac.png) 5. Do one of the following: - If you are creating a New Virtual Server, enter the IP address, port, and virtual server name for the new virtual server. - If you are modifying an existing virtual server, select existing and then choose the virtual server to modify. 6. Click **Continue**. The **Server Certificate** page appears. ![Citrix NetScaler Server Certificate](/assets/images/13-citrix-netscaler-server-certificate-9d82ab1e4fc619d7a63d08113d5e8ef0.png) note The Virtual Server for the Access Gateway needs to have a certificate installed, or the Virtual Server interface is disabled. There are several options for creating and selecting the Virtual Server certificate. In a production environment you would most likely install a certificate from a trusted Certificate Authority using a certificate signing request. To get the system up and running quickly you can simply use a test certificate issued by the device itself. 7. In the **Server Certificate** page, do the following: 1. Under **Server Certificate**, select **Use existing certificate.** 2. Select the **Server Certificate** **from the drop-down list.** 8. Click **Continue**. The **Authentication Settings** appear. ![Citrix NetScaler Authentication Settings](/assets/images/13-citrix-netscaler-authentication-settings-0c94d6746b8e09d051bb1218f3a93d51.png) 9. In **the Authentication Settings** page, you can configure Primary and secondary authentication. 10. Under **Primary authentication method**, you can select **Local users** or **Active Directory/LDAP**. For this procedure we use Active Directory/LDAP. 11. For the **Primary authentication** set the following: 1. Enter the **IP Address** of the Active Directory/LDAP server. 2. Enter the **Port** that Active Directory/LDAP server is listening to for requests (default 389). 3. Select the **Security Type** from the drop-down list. 4. Enter the **Base DN** under which users are located. > **Example:** `CN=Users,DC=example,DC=com` 5. Enter a valid **Service Account** used to query LDAP. 6. Enter a valid **Password** to log onto Active Directory/LDAP server. 7. **Enter the value you entered in the Password field into the Confirm Password field.** 8. Accept the **Time out** default value. 9. In the **Server Logon Name Attribute** enter **SAMAccountName**. 12. To set the **Secondary authentication method**, do the following: 1. Select **RADIUS** from the secondary authentication drop-down list. 2. Enter the **IP Address** of the RADIUS server. 3. Enter the **Port** that RADIUS server is listening (default 1812). 4. Set the **Time out** to **50**. 5. Enter the **Secret Key** (shared secret). 6. Confirm the Secret Key. note You need to increase the **Time out** value if you are using TVS (Mobile ST) authentication. This can also be confirmed by tracking how long a request waits before it times out. 13. Click **Continue**. The **Citrix Gateway Setting**s page appears. ![Citrix NetScaler Gateway Settings](/assets/images/13-citrix-netscaler-gateway-settings-complete-ba1c1eed9d46d5b3b4f30fdc3665a24d.png) 14. Review the settings and click **Done** to complete the configuration. 15. Verify that the setup is working: 1. Expand the **Citrix** **Gateway** option on the left-hand menu. Select the **Virtual Servers** options. The **Citrix Gateway** **Virtual Servers** page appears. 2. On the **Virtual Server** page and ensure that the state is **UP**. ### Step 2: Add CITRIX Netscaler to Identity as a Service note Entrust recommends that when multiple RADIUS applications are configured that each RADIUS application is given a unique shared secret. 1. Click Menu icon **>** **Security > Applications**. The **Applications** page appears. 2. Click **Add**. The **Select an Application Template** page appears. 3. Do one of the following: - Select **RADIUS and VPN Integrations** from the search drop-down list and scroll to find the application you want to add to IDaaS. - In the **Search bar**, enter a search option to filter for the application you want to add to IDaaS. 4. Click **Citrix Netscaler**. The **Add Citrix Netscaler** page appears. 5. Optional: Edit the **Application Name**. 6. Optional. Enter a **Description** for your application. 7. Optional. Add a custom application logo as follows: 1. Click Circle Plus icon next to **Application Logo**. The **Upload Logo** dialog box appears. 2. Click Arrow Up From Line icon to select an image file to upload. 3. Browse to select your file and click **Open**. The **Upload Logo** **dialog box** displays your selected image. 4. If required, resize your image. 5. Click **OK**. 8. Click **Next**. The **Setup** page appears. 9. Click **Add** to next to **Hosts** to add the host name of the VPN server. The RADIUS agent receives the request on this host. The RADIUS Agent on the Gateway determines the RADIUS application the request is for based on the host name and port. 10. Enter the host name in the **Host** dialog box and then click **OK**. Repeat this step to add more host names. 11. In the **Port** field, enter the port on which the RADIUS agent accepts messages. tip Do not enter `8443` as the port number for this application. Port `8443` is used by the Entrust Identity Enterprise agent in your Gateway. attention The RADIUS agent uses the host name that sent a request and the port number that it received the request from to determine which RADIUS application made the request. Because of that: - Two RADIUS applications with the same port value cannot share any host names. - Two RADIUS applications that have one or more matching host names must have different port values. 12. In the **Shared Secret** field, enter the shared secret that is used by your VPN server. This is the RADIUS secret shared between your VPN server and the RADIUS server. The shared secret value must match a shared secret in your RADIUS client. 13. From the **Select** **RADIUS Agent** drop-down list, select the name of the Gateway containing the **RADIUS agent** to which this application will be assigned. 14. Optional: From the **Select RADIUS Attribute for IP Address** drop-down list, select the RADIUS attribute that corresponds to your IP location. 15. In the **Challenge Response Queue Max Time** field, set the number of seconds that the RADIUS agent waits for a response to first-factor authentication. The default value is 180 seconds. 16. In the **Challenge Response Queue Max Size** field, set the maximum number of second-factor challenge requests allowed in the queue of your RADIUS application. The default value is 1000 requests. The maximum value is 10,000. 17. In the **Request Cache Timeout** field, set the number of seconds to cache requests. The default value is 10 seconds. 18. From the **Character Set** drop-down list, select the character set used to decode and encode string values (including the user ID and password values) in RADIUS messages. The options are UTF-8 and ISO-8859-1. 19. Optional: Select **Log RADIUS messages** to enable RADIUS message logging. When enabled, messages for the RADIUS agent are logged to the same log file as the gateway logs. 20. Optional: Enable the **Authentication Settings**. 1. Select **Enable Push Authentication Fallback** if you want to authentication to fallback to another authenticator in the event of a failure. If required, set the **Push Authentication Fallback Timeout** to the number of minutes before the push authentication times out. 2. Select **When authenticating the user will be asked to select their second-factor authenticator**. When selected, after the user responds to the first-factor challenge, they are prompted to select their second-factor authenticator. The list of available second-factor authenticators is set by the resource rule. 3. The following is a list of supported strings matched to the authentication types: - Grid: grid - Knowledge-based Authentication: kba - One-time password: email, sms, voice - Smart Credential Push: scpush - Temporary Access Code: tac - Token: token - Token push: push 4. Select **Indicate if requests must include the message-authenticator attribute for incoming messages** to include the message-authenticator attribute for incoming messages. 5. Select **Indicate if requests must include the message-authenticator attribute for outgoing messages** to include the message-authenticator attribute for outgoing messages. 6. Select **Remove domain from user ID for incoming requests** to remove the `domain` value from the user ID during authentication when the user ID provided by the RADIUS client is in the format `domain\username` and the user ID in IDaaS is in the format `username`. 7. Select **Indicate if Active Directory password authentication requests are handled by the same Gateway Instance that initiated the request** to require that Active Directory password authentication and change requests that are initiated as part of the RADIUS authentication are handled by any Gateway Instance in the same Gateway cluster that initiated it. If disabled, the request is handled by any Gateway Instance. 8. Select **Enable one-step multi-factor authentication**. When enabled, the user enters their user ID and then their password and token response in the password field. If you select this option, second factor authenticators available in the resource rule are limited to token and temporary access code. 9. Enter the **One-step multi-factor authentication security token length**. This is the length of the token or temporary access code response if you enable one-step multi-factor authentication. 21. Optional. **Add Response Attributes**. Response attributes are returned to the RADIUS application after successful authentication. Use this setting to configure RADIUS attributes to return information such as the user's group information to the VPN server. When adding response attributes, you optionally add group filters. For example: example Users in IDaaS may belong to one of the following groups CANADA, US, UK, FRANCE. The VPN server wants the FilterID attribute returned from the IDaaS RADIUS agent to be the value NA or EUROPE, depending on whether the user is in NA (Canada, US) or Europe (UK, France). To do this, use a RADIUS attribute filter for the FilterID attribute with a Groups value with the following filters: - match CANADA, replace NA - match US, replace NA - match UK, replace EUROPE - match FRANCE, replace EUROPE 1. Set the **Response Attributes** as follows: 2. Click Circle Plus icon **Add**. The **Add a Response Attribute** dialog box appears. 3. Select the **RADIUS Attribute ID** from the drop-down list. The option you select depends on your VPN vendor. 4. Select the **Value Type** from the drop-down list. 5. TTo return a static value specific in the RADIUS attribute definition, select **Static** and enter a **Value** in the field and then click **Add.** 6. To return the user's group membership, select **Group** and then optionally do the following: 1. Click **Add** to add filters. 2. Enter the **Match** and the **Replace** attribute filters. 3. Click **Add** to add more attribute filters. 4. If you add multiple filters, you can drag and drop them in order of preference. 5. Select **Stop after matching filter** if you only want one the filter to return one value. Using the example above, if you want NA to have preference over Europe, make sure to list Canada and US in the list of filters. 6. For Multiple Values Per Attribute, enter the **Value Separator** and then click **Add.** info If a user belongs to more than one group, you can either add a separate attribute to your RADIUS response for each group or you can combine all of the groups into a single attribute. For example, if the user belongs to G1,G2,G3 then you would - return a RADIUS response with three attributes - return a RADIUS response with one attribute and a value like "G1,G2,G3" where the , is defined in the Value Separator setting or a value like "G1 G2 G3" where the Value Separator is defined as a space. attention The default group separator is a space. If you have group names that are separated by a space, use another separator, such as a comma. 7. Repeat these steps to add more response attributes. 22. Optional: Configure the **EAP Settings** to set up the application to use the EAP RADIUS authentication protocol. 1. Select **EAP Enabled** to allow the RADIUS application to accept EAP messages. - When enabled, authentication messages with EAP content are treated as EAP requests. The application can accept only EAP authentication requests. - When disabled, incoming authentication requests are processed by the RADIUS application as a standard RADIUS authentication request (even if the request includes EAP content). In this case, the application can accept only standard RADIUS authentication requests. 2. Select the **EAP Protocol** from the drop-down list. The options are PEAPv0 with MS-CHAPv2 and PEAPv1 with GTC. 3. This setting defines the type of EAP authentication protocol that is performed on EAP requests received by the RADIUS application. Consult the configuration requirements of your VPN server to determine which EAP protocol to select. 4. Select **Return MPPE Keys** to include the MPPE (Microsoft Point-to-Point Encryption) recv and mppe send keys in the Access-Accept message returned during a successful EAP authentication. The setting is enabled by default. 5. Select **Use PEAPv1 label when calculating MPPE Keys** to use the PEAPv1 label when calculating the mmpe recv and mppe send keys. 6. Leave the **Minimum TLS Version**, **Maximum TLS Version** and **Allow Weak Ciphers** at the default settings unless you have an older VPN and need to configure these settings to allow older versions of TLS or weaker ciphers to interoperate with older VPN servers that do not support the latest versions. 23. Configure the **Deprecated Settings** **if your RADIUS application is** connected to a Gateway version older than 3.0. These values are only required for backwards compatibility. 24. Select Token OTP Only, Password with second-factor, or No first-factor as the **Authentication Type.** This setting defines the level of authentication required to access a RADIUS application that relies on a gateway RADIUS agent configured before release 3.1. warning MSCHAPv2 authentication is not supported when **No first-factor** authentication is configured for the RADIUS application. 25. Click **Submit**. ### Step 3: Add a resource rule See [Create resource rules](/docs/authentication-and-security/create-and-manage-resource-rules.md). ### Step 4: Test the integration #### Test the configuration using two-factor authentication 1. Open a Web browser and enter the https URL of the newly configured virtual server, for example `https://192.0.2.0`, or connect using the Secure Access Client. ![Citrix NetScaler Virtual Server](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAATcAAABoCAIAAAAb7yDzAAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABN6ADAAQAAAABAAAAaAAAAAAclCKsAAAZoklEQVR4Ae1dPWzjSpLmm5sFKOAeQAYLkMEGvIzKqGABMbiAFywgBwvImRVqMzs4QM6eQk0mZ1b2FNKZlZkhQzoTM/GACzpsAnsAGRzADh5w9zUpUbRkezw2ZUmjJmasJtk/1V+zuqr6p/oXyegohi2JSyAgEDhIBFiSfFUUXU4ClUUHSaEgSiBw6ghQvf/l1DEQ9RcIHDwCXwsKGTt4SgWBAoFTRUDI0lNteVHv40FAcOnxtJWg9FQREFx6qi0v6n08CORcKozS42kwQekJIlCMHiVZlp1g5UWVBQJHgcByjHfvtDYaDVkxZFmRJDknhjGWspSI7mPvTSMI2DsCe+ZSMKeitdXmOThUkvVNOMCphCbUTaNQsOsmOOL+ZBDYJ5fqhqPbZ7Juvog2ZKtpKOZQMgmJPDp/eDGmeCEQ+HkR+BdZb339458SSz+zjhChf/nbf/7l33tff/3zm8r9VVWNv/6q2v/8n+gTSNV19ddfG8W/P/3pF8b+OOtf/b31F/Jf0f/+8SZ63xJpF3m+pdydxkGl/vZv//rfUcyk+pDaKcUHn/kff/4rl6VYeMTST+JSJimaYZidq9dE6AvAQa7ayjDyb6JoIUu7Ilg2e/3Ltq5yWHCRYHbvzZWGpst8gC2tCSgFV56nzLHf7SC7Yli21Uwjf0GzuuivNpFp2bqqEBImkqboMF2ozOiO61Qt/2cOg18wVPMVP8VwzefUFSza6lzLulEtDhwBJmhqiqE3FJmTkzK2oJTEUkxZshxPylPouukMJOmGREE1h9rDkT+7n7OW03Xsbiuiy/wT/qvrupJjRmkSp5JpNOScZox3JUmGJ7wWeQRGGUkp+BHCGQlhY9OtpZgsQX1ZmScyIYQXt0yVJkzm+aOsKoOVeRbx0YgggxOHwTcZPMLLLW4Rs2nb5465kJDFHJ3MRtoiWvG3yKeozkbt0JVQuqwLCi0KQhxJNVqO4xiKO0slQnx3qjJCMRKoN2SWpRKHoiCyKBf5EJpx0FhGM2kNYJrgtlrHKmEnHv5UuxTt1OJS9AmLtnTJsQyYnwV/lu3RNjXwakRSP6TzFZvwtzrs2cuELnbdopQsEtbhY84y57HiMq3Oea9jqBIkqw9ODpNOr9/KK5QlZHZzR3Sr1+cRcAUPiKCddXtOk3c9dI5v2I+2jAvT6Zx3lknoIvQ8d8HMZaqMd1KqFE8n02AlxiG7nLMLFJpJKqPzmXu3kMzLyy66gVRpmmpG5v5k4hU9AsC6cGx0I+hxGqpyP4+rab37mR+SompgUafT63ZMFfyexK7rMt12Oo7R4EoEdAr3XpLt7vW5CSKVpqNmCRCIVLvT4iMLvd4F6qvbXZmGyWR+PrjS2CKWDFOXEhJOJveS1UPawB3eZ83eoK/F/rep79hOt9PmJWbMv5s+LASjFq3x5O+X3amOT8qBvJAU3e5VFV2I0HNLueyYYMgNFi3S4iFeXXZNREPkMkPwuXF2jQzLJ7UHDLs7HI0cU6ELf06XnQTTudww5Bifo0eY7dhNFvsPd657d+8TJht2xwRpYNGFP3Nvp95jZNsOWNT3H/2AyKbTai0phQxZXmbTsTsKI+7tzfT+UTYsx7abps1TuXfj6axQHUuFAqWA31pajPgT15UUo+O09VyYoyn96TSIJFNvciLyKwz9Oz+AmA+8OzeIq2nB0o5tGStVxTRtsCgj4e3oZuz6VEXv4cjkYTy+Qd8CQOwmWkHKZJWlyeT2HqBYLWPhP3hzKDwR6EEPtKoV/23IjcCdekHa0C1de9I1F9Fg/KAIdC6uCzjltrNCp5rLaYcL9vw8jVczW0brvMQcXOdY2oXzTOOVcYoAeBXRlEZjFpDyY9UNG18VBn43Itd1m9EwnCc0jYk/jyTZyfOVlYYBhlBN+0zjDzIFOoBlX5gKCQm+Sc4YNJr5i4HjdJvt+H62MPIEjtPOM5BkDbNNSwYtfpBG1RpQc0kIjXTBGQO5ytwKJhTZyi3KjApIigoFWs3iiEYkhIjrOKaKPLguHhOyIAsYiGl7PaeFZk6SvKg0SyhR9H6WLtM6dmbqKhTkogNE3weZFpAgJJCu6FN6isTtWKi1ZJ5221wsQhlvMGTjh5FK2BmXoQlJcgWYMcyZ5SZBUVXAE5M5IU2dSi1Fb7BSH2K5cM5jaZoqq2qr1+M1zCRNlRrpCp9VNuJX+jyNt9nqw2YqIQeLduz1x4TnJE7jhBVflKqgxWRDU8r4nbaWZtl9uPzEkZXe6kVRsCNdII4Cd1bujF+SzfChp/ikoyAICNRxfJO60dWkEB8tMy1IAliETJr7MxJxKeFYEskQj8tSWNlSkpGV1lrWiyLPGNxiGBaM0yYYI4yRccIaimUYiayBzRFZXtmZKexTmqC30E1DUk185ODCwlBEtFJEF7ZlUUrBH7KmqlR6klZrpBEqhPy5DKQ0SmAwGhCvKFxPVLziS010nRgtDQwcRjRROGNuXikHAu2R9xaNJ43Ko66aLBe0ig5VXdcaBaTclKcp8fxHxIPdyxpSrz+USTCd+ZulnPA959I0Wyk9OwNCMSAi1ixnKlKnpZdaLj7kIEyDBY1WDQpCEMdu6ra1tlfB1YsYgmBJJb4fjEWlXKLUeWGIcjs70JXhuyIR9Fu1d2GfdeGEBnbm1E+gkeJWJ4xlkPQ6NNb+ef4pZ8T13XmqSI1eLkvbMFxvrifVzJGnDMGU59m7wqiYRIPHhX8PpdUw+q3zC2Nr4abMSODNlPOLZfxF4PleIm34xAGia+WTxguStJtnsEtn9/5MOXuSthzQiqP5zDO7HetqaIHUCRjF82E0Xl9bIAw6vA+zlweXo9+FAMctJHjSNgq7lL/OBTt+0KsWN0km0YxREs0Trq6jFYEVyzIKY9czoGYXsnQ+nbpMgsUgpQsMYex63IFTeiTXL4rVT0mAtt8pwabTw5BPWUTf1iEby1vvMa5qs+VzBGCRgjlLfn6M4rG35iIMKUb+k+++mvbdYQg1CX185UPHR4M5XnT2yLMI88zzOMUtlkYhAp5w81THYAi/iviwnzeeFG+fzRP54Ossk0CUdc4vTJmPvkR03YeVEYr4yLCkuXhVFF0UhL9LmnOCt9OW0Zb55Pcbla0SVoSr9PPS0ZHlbFkAtUFPNQlQkqClrxAu0hbJUXeeLbTnCvg5Oaf7R7aHv8jWgBFv11xq9UawJAukTU3unxmlNgvGm3qwbV5oBlmusjQ+4PF9xOfM8wtzG4HbeyHlET+WDQcDyVAAodfaLSV4gGAr1e8jrpcg/R0IgEuXdmlVQXpHRq8k4dN3sqEq6wEQiBx1NUcLzQwTLS+yKPKFMrygtokellsy+IvByyheFihjLk420MXsjv5Xqra7VzJmUWXb5kOezJ9OHhYQLS91Y7ujQuS8fwSK8YUdjx5h8MM605sdWV2PKUCKlhosrDpCv/P9wVjF8Iiysp0xTY5RkgI/jA8656OEBmHA1YGf5lNOyePNt8f9fyOCgsNA4CvGSL/DJe8iFH2AYjoY14VN9koGfFB3Ncb4YjTGEM3Qlu9hIFZjIn/FOIdiiEEVEro/DaNW6yjCJ44Any+tHQKwqGH1DPtC5otKvnfVoctBVvPidCXyJoJRv4e4eH9kCOzE79E2izIMxu/gqmaLHkE3OhhJLlT5HZQmshQIfDYChcip3y7VzDZWk6E2JQthSZnd0rk5mktWc7V4DXFMXek7K132ZQSwwqF8aRpymYTS9JFgFfi6CzBMJyFBHAmjrgRMBI4egZrtUsgx3TxbeUXh6Fim2nOwfgXDsWtOK2HDOFKnvR7+LZ+/EgC3l7M4iObE6Z1Pgnm5No0TgKUOQu99BUPx6ogQwPKsL/XapXxK3zBLCEy9ganR7f0uZYSPB8CxWOWLgsqssPwHZJS3IiAQOGoEMJFRs12KJXuY1CxBcez16oXyYe0BMCoKqmSLNe1rGirPRVAgcJQI1GyXqhUPY5BvsCFLVLCYPiJYr762IctX7whgPgaZl6ovwrqOFXyrzCs7Qt+RuUgiEDgoBOq0S/ngKjazrC5Yous1RimbPpAwKq3HVaQP/NotFVtPnzV3mfTaJO0HyvyZk/b7fb7SXVy1IhAEc8+bfSRLfn5pvXbpWnRiE/DaVOSLh2JsDq31qkkq10rT0WaGHtZqty/7/aOtwSESjgWwNLmWPrYJun679OPLmLCbMt9QuX/QNU0rpl7xF0KmCO+fLEHB6SFQ8+gRdjy/G0NMq/Y7+m9XLfy7PC82P787s48mBE+OJhM4ZEJGstwdj/rWgXQeH62ZSH98CNRpl27U/kc10l7b6DrLWRwMC6lyY+QuNvL81NvqBK+sNRR19PvEgMOFOPo2do3zad9J4DXk9ttYv/R7yhwuGqb+HN4S+sMRXHxhV0vsTYYu+X0yamRUbqSjsXt+OTS5UzH484PTMbURuYPboHc14is9qP9t5G47c/jUKovCDg+B+udL8zpC7S3+bde4fLUdkKzmkyEfzLLm0ms75urJM9sEVq+2S/7wE7kD14CyO514C6Y41791JXjxcol0fdlRzSTx7m5mfhzHYD5Da9Jgcj2ctbsdbGF/dCfD66EER/7YLdo0vNndNDDMRjgcTRWn3zu77phkOLiMZLt/LgZvPtxOP10G6M2/4n+9fhpwCNOzQCXYgb/avb0dAQPC2w9fT7I5jptkZdHPekXZzv/1J5V68HEw6rmTxqB/PZBYfL9QsLz/ejBI4HMgr+6Mu9otK56kdC4RLU1lCV5mzy5HcMKiyVP0XvA+gld6Su6jlDuklU3Jwq6hmxH8BilRhH6qZgcxr9dRvD0KBL5Cnn4OoYV76JfLYvCF2e/mfnXySEHEHWbv8QqIbsPdZgjHCYaCHa2yToO76/G8P73XG4SR+fjbdao4jkmkXnuDzmzFsJ3+wGDx9SBQZs+5sQRnZ1E0Z4PRrd6y9WS3fm02iBS3x4LADu3SH4IAYnAWJLoeF/6Q4GZlco81EKuP/YfyqiMy2Gc2GbZ+ux63M2y/u7n+Fiby+XjY715QuCgbz8LzUX88beBAuNkM3vXWgpQlJIryTbvw9wJXl3A9bV+ONPgQNCHi4RcTOgCJ4txqjwh2xU7t5gC+f+Eae/xttw776wBG5PHZCNQ/X/qRGuC8lNwjloZMcEjBpx1d8yLNxBv+48lU1/AfFR9L03MfKmxxeRW3lCye3lznj73rK5787uZmGQ0/SweWw0Kvvbnie3ceh/9YRxAhgcBTBPh8Kf4/ffihOzmLP5ReJBYICAS2EPjyaXbpVtHigUBAIPAmBA7FLi2IxZZu7BdFmOC4NXF9LgLh4+OQnz0hrjoRIKWX9/fmumO79OnYDw7q/O5YEKp0Nc4wTYoNNO+tlEj3HgQw+jWdlnb2e3IQaXaEQP126ccJxaBRDSz63f7g44SKHAQCn4VAnXYp+uOqb90qp2ALG1bhWEb1sJj3VxF+WCxTse0n5yli2837cxQpBQIHjMAO7VJCcSQfUzS+qAi7QLFiIU3NgpcinDiR4FR3nACWxfzsFb617VmUcHAfjg3ByiRDV3EWiarohacy/ryyXIlgbrWqYL/mLf/ZcsRDgcCBIlC/XYoTxHBOn5q7/APbeH50ebFelwO+KlzUlz4WSmCwEw9L7UpeBRPyVzJn7zLOSwF+jEWwHvYAAfH6sMyXEonnAoHjQAB2ac3reON0gaWo4JMCgBlOlNZI9dC0l4Dh3AieXB0z8VK07efoC1wvfMTRmqtCcbY0P41iO6p48ioCwlfDq/C88+XHfTWg4LrX8cIlA/ENozg7m7Pr9C5chLFtw5Mgd7DyFtn4FjzAnDgEisSJH8T89NuSRfl5hDigXjDpW1Bcx8F+WuGrYQ1HfaGr66sP+moALfXbpWn0IKkGzuwsagr+8QICWYdbKLqKimOscUa9htPhoQDLudeVpX6LGFX1Nme0UgfOjwnP4CYbC2HhnAXPC0O0yp/IgFE/JZX1egUR7/oLXw3YAVokJThzahecL2s47pzvdxOXQOAFBOq3S3lBLA7nrtXqlYyKZwUvJUn5OXIzsjBfESjMVIwSYXMm+DRnz4wfA5+PKhXcyMMVgcnfbV1puiDhwxvmZbdSbj3gvhpcV4p8gu4Fu1X8m+tp/SK6Pxga6XBY/znJW/URD44Wgfrt0iUUaQRGNVpdRWm+Ak7JdRXuff9iBmjaXIyzsiN4peS3vcK2GHfmPUaG89tt1+mYZmfoMCrLqXdz6/VGo8JvQzXsEcWUwptAmQ6a44lrOH01jYy2sxHTfwwVo41T5IxmK3LfRoyIdcII1G2XllCmEQ1uMt1pGNbrvFqmeHcAIjQhPqNhLVJ0TYas9/o9y8kM26bTGyZns7EfRJbnwe+LDr8NEIKyYSu9QRkmrNF37NjQHKc193zDVFLJsdj8ajjFrtTeObGa5mTQY3rnNyf8j/49xDV0B3EJBF5HoH67tCwPhlxMPJn6BN6tZZ3phqrCCsstvZXVWkb+gUBKUrgOkqSM4lhhklLCj2DdhdHIaOAHAVx9z+5glyqGdXU56KhNTSHp/XQi/Vb4bZiMbybqMjy9dYk86JgSCee2eSmziMhaRDwYtUGQXjKF0TmWfkiqnQYTkE0iYv5AzUXUU0RgN3bpUyQ5/7AoliJ4O4A6C3uPewDOfc+DdaX1YWrK03TlXa4D55OpaZLiILdtntzdeC4hJAwjTopiXg1ulGg4nDn2GI70jdJvg9EiZVhXfT9tjW06G83s4Wgxm8yy7qXuKMq9ZcuhnxY8iX3iyqXDXGqaupQv6ihrKwICgQ0EdmaXbpRTuc2FXlxYjwXrVl6+Kbg7ntwoHo4UygWPmICdR0HPvhhBThIuye1uv/DbsAiCs8HSh8M8CCTZCw1tHC6uAp8GEMbUGQ8nI4uRYOzOz00rS+Ha4dZzRrfjAXYg1Oruf6MG4vZnQUC2BhAUP0ttRD3eiQB0nNvff/8/cdWNwOXg8p1NskqmOKMvUCBXt+JXICAQODgEYJfWfH7pwVVRECQQOHIE9mCXHjliPzP58NXwTayCqruFP+6rARTtbL607tqK/HaKAEb1hK+GnSL8kcyFXfoR9ERagcDOERB26c4hFgUIBD6IAOzSmv3xfpAgkVwgIBDYRqBOv0fbuYsnAgGBwMcR2OE63o8TJ3L4NASwquHTynq9oJ0syX69yMN++xnreA8bAUEdR6Bg0XJ99T5BwTptmS+zEbxatoKYLy2hOPUAWFTRDb4LAlsg9nXBq2SiMLitEuvhnjaBmC99isfp3S13KSnGudM0jP0eRm7MF2TmcX+SErZQiWuFgLBLV0ic+G9DVRRN0bQ9w7AgErzB7vd46T1DsFm8sEs3ETnR+3y7L5PS9IUVgsXQ0g/ttC9Ho34oFce/oXJfrdiH/MMpf87WE3bpz9mu76gVjgrAyev0hT3pltNR09Cfv3XHOs4hMO0OTuXCReZzPyoOVX4HXSIJR0DYpeI7WCMARl3fPA0pEi3fKpZjgwWTxHt8hJ5sOrYKwccS339EIvhcBlfLi2ACJ2xKu9drmSmBQ0k9P8+agGfjF0t5Wqa4WyIg7FLxKSwRSDIJ46vPwgHdk2UJpXxER7cvnJYSPXjmWb8Lz1Y4o4uSiBnnndb9wyNy0OW2KlHX9yiEM038SLesFmtYMplGsm23rGh694JQVliuez9Lw8k+FHbpyTb9cxVPsyh6nktNmqqMRHBfxblUYiSczjw9dkYdTdUl9x6uiltw7EqiAM6TmcwHiuHVrXCkrBNqQO7iSNpb/76lthyFRiT3JbVJA0xZ3VyeirD57oTvuV2qq7I4APqEv4F11SEvKX1ByKVZhsPx8rc04/pqkmSYV834eTy6lFIJgljC6BPPIZEWc9ptqbIbEUWxLU0nc1du9WgcQ+ZmFo4OoaVDqXXxeUgXvn02EMlvv+K0leeei2cCgScINJ3LIY6ozKgXhYlzMR1Ksql43/zI0Qe9iZXB9/CSw+EYGd7GB4OR1Q5l3ZJYMJqRYWuVG04wENcPIiDs0h8E7CSjz6bfwod8wUMjIyQeXi2aSiOBq1Ka6Nnsjq+GsMKQQMIW8ASeSwkMVEyrPCB+TLPJ8Ar2VZq414lE+YzoM962FEU5SXS/U2lhl34HoNN5jcOx+OjsC3wCfXdBFms0MrLI+bHRaJi2A6fC0Hant0GG+ZzVPGlCiyg8EXylQ0PGcmFNgrLLnzxbEHLj78T1FAFhlz7F42Tv+FofDPHge/hhPgm9aTkZ+o7kz0Ce8Q5ALGmoIiPs0ioaJxwGb2C5vWHtFwJusz6nDO+Xqr2XLuzSvTfBngmA1MJmMWi8/uNi73tiJLZYHjKyZ1QOqHhhlx5QY+yXFByxkVKc3wPrtJgy/eSBHJSbX/k5QPuF4tBKF3bpobXIfujJxSmGfXBY1opb9kMIL1VYpNvYC7t0G5NTfCJ445BbXfjjPeTWEbQJBGCni3NixGcgEDhsBGCXfsE63sMmUlAnEDh1BL6Idbyn/gmI+h88AsIuPfgmEgSeNgLCLj3t9he1PwYEhF16DK0kaDx5BIRdevKfgADg4BEQdunBN5Eg8LQREHbpabe/qP0xICDs0mNoJUHjySMg7NKT/wQEAAePgLBLD76JBIGnjQC3S08bAVF7gcChI8D3l6qqlqaGOOXq0NtK0HfCCPyimB0mm+BXVeKOjxOpAQlbAvLK8zLOZvzci1yCDYsb+XzKc1BVdf3M6V95tRPPiyYTONSJA0uqK+HL7237+3+JX777XErI/wPvE9LzA+m3fwAAAABJRU5ErkJggg==) 2. Enter the **User name** and **Password** of an Identity as a Service user and click **Log On**. You are prompted to enter additional information. ![Citrix NetScaler Login Prompt](/assets/images/citrix-netscaler-login-prompt-a59a9038f263620e41fec5f34a1ea11b.png) 3. If using two-step authentication you should be presented with a challenge page. Enter the response to complete the authentication and then click **Submit**. - Complete a knowledge-based authentication challenge You are prompted to enter answers to the questions registered in your Identity as a Service account. ![Citrix NetScaler Knowledge-Based Authentication Challenge](/assets/images/citrix-netscaler-kba-challenge-d2dad186a80ef2844d9feb06999b1dab.png) 1. Enter the answer to each question listed. tip The answer to each question was recorded when the knowledge-based authenticator (KBA) was assigned to you on your Authenticators page. 2. Click **Login**. - Complete a Entrust Identity Push authentication challenge You are prompted to provide an authentication token to log in. Your Entrust Identity app receives a push notification requesting confirmation. ![Citrix NetScaler Entrust Identity Push Authentication Challenge](/assets/images/citrix-netscaler-entrust-identity-push-challenge-a59a9038f263620e41fec5f34a1ea11b.png) 1. Open your Entrust Identity app on a mobile device. 2. **Unlock** (log in) using the identity you want to use to respond to the request. 3. **Tap Actions**. 4. Review the transaction summary details. 5. Tap **Confirm**. ### Step 5: Hide or modify the sign-in page for users when they log in #### Hide or modify the sign-in page on Netscaler server 12.0 1. Log in to the Citrix NetScaler server. ![Citrix NetScaler Login](/assets/images/citrix-netscaler-login-f2f0087380b699cd378713bc5af50d0e.png) 2. Go to **System** > **Settings** > **Configure Basic Features**. The **Configure Basic Features** page appears. ![Citrix NetScaler Configure Basic Features](/assets/images/citrix-netscaler-configure-basic-features-d026f6bddc59c0670e49446e433afb37.png) 3. Select **Rewrite.** 4. Click **OK**. 5. Go to **AppExpert** > **Rewrite** > **Action** > Add. The Create Rewrite Action page appears. ![Citrix NetScaler Create Rewrite Action](/assets/images/citrix-netscaler-create-rewrite-action-d4907737de332f1fa6b517048c4fd61c.png) 6. Enter the following values in the information fields described below. 1. **Name:** Enter any name for the rewrite action. 2. **Type:** `INSERT_HTTP_HEADER` 3. **Header Name:** `Set-Cookie` 4. **Expression:** `("pwcount="+"1")` 5. Click **OK**. note Set the apostrophe in the expression as shown in the image above. 7. Go to **AppExpert > Rewrite > Policies > Add.** ![Citrix NetScaler Create Rewrite Policy](/assets/images/citrix-netscaler-create-rewrite-policy-5371b1b038158d0ba3acd96907a10015.png) 8. Enter the following values: 1. **Name:** Enter any name for the rewrite action. 2. **Action:** Select the Rewrite Action, for example, `Action_pwd_hid`. 3. **Undefined-Result Action:** `-Global-undefined-result-action-` 4. **Expression:** `HTTP.REQ.HEADER("Cookie").CONTAINS("pwdcount").NOT` 5. Click **Create**. note Use the Expression Editor to create the above expression. 9. Go to **NetScaler Gateway > Virtual Servers > Edit the added Virtual server > Add Policies to bind the above rewrite policy.** 10. Select **Rewrite** as the **Choose** Policy. 11. Select Request as the Choose Type. ![Citrix NetScaler Select Request Type](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAX4AAAFQCAYAAAC4fBW6AAAAAXNSR0IArs4c6QAAAERlWElmTU0AKgAAAAgAAYdpAAQAAAABAAAAGgAAAAAAA6ABAAMAAAABAAEAAKACAAQAAAABAAABfqADAAQAAAABAAABUAAAAAB6aeNnAAAfWklEQVR4Ae3dT4yd11nH8TNRAjMqUs0C5U6F2k6KhCYgJAcJsCVYJEigxkXC7qbOzgldpItKTiuRkhSKShfgRkgolaB22bgVLNIFNBFIJEhENaItzs4Wm3jH3F28qTy7yzxjnptnzpz3vH/u+957/nxvNb3ve/6953zOzW/evHZmthZHL8cLAQQQQKAWgcUjtayUdSKAAAIIPBQg+PkkIIAAApUJEPyVbTjLRQABBAh+PgMIIIBAZQIEf2UbznIRQAABgp/PAAIIIFCZAMFf2YazXAQQQIDg5zOAAAIIVCZA8Fe24SwXAQQQIPj5DCCAAAKVCRD8lW04y0UAAQQe3QTB+fPPLC9769bby2MOEEAAAQSmF+COf3pjroAAAggkJTDaHb+9i7cr5I7easSPmwybemHbJEM5AgjEBFa+45ewigVWrC42MeoQQAABBKYRWOmO3w/10B2o32aaZZQxaptfqL6MlbMKBBBYp8Dg4PcDvSmUmsrtIv2xpC7WL9S+rY/UD+kX6tN3brH2Mq+hLzu3pmuE2miZ9tFzOw+ts2V63Le99uMdAQTSEFj5UY8sIxYSbcsMhYj06Vse6zO0ru8cYu2b6mRuQ1/Wfcj40qep35Dypj5D10c/BBCYRmDQHf/Y/4A3BZhcp6lOOEJ1fh9p58+3Sz/bx7YPjeeX2fZ2HGm3zpe9tp2TPwdbZ/v47Wxd1z7+GJwjgMDmBUa5419lGTZAZBz/vGnsWDsbUH7/of3sOLExbDs5tm1j8/L7revczm/ofO0YKa5xXZZcB4FcBFYOfvsP/ZSLtoESumaoTOYztJ9dix3DluuxrW+ah7Yd+91ez85j7OvYse01x74O4yGAwPQCgx71TD+tzV9Bws2GnR63hZ622/QK7Dza5tx3rnbsvn1pjwACmxdY+Y6/thCobb2b/4gyAwQQGFuAO/6IqN4p+2Ev51rnd28q99uNeS7X1DnG5jbWNTexxrHmzjgIIODcoDv+2v7Bl/X6a9agTfFDZOfmzzvF+TInBBBYr8Cg4PenaIPGrxvr3AZY6HqhMrn20H6heduxQvVS1jSPpvaplXeZf5c2qa2L+SCAwIcCg4PfD8GmMGgq/3AKw45i4/pzs1fo2k/axdraMf3rhfr1Gc+O3fXYn0PXfrF2dkx7LH02scbYXKlDAIHuAluLo1f35qdbhgLgdKvmO28/UKSvHdOvt3Vt17H1ffv1be/P217bHvvrsXWhYzuPtr62rYzV1N5vF7ruFH1D16EMAQTWLrAYfMevU5WAaAoJ20aPV32PXWvMuiFjxfrIutvqV7UZq39snrG6nNY4lhXjIJCjwMp3/DkuuuQ56918LKC1jTjE2pXsxNoQqFhg9Tv+ivGSW7oN9OQmx4QQQCAZgZUf9SSzksonYkOfu/jKPwwsH4EWAf4DrhaglKtt2Kc8T+aGAAJpCRD8ae3HSrPhTn8lPjojUI0Af7hbzVazUAQQQOBYgD/c5YOAAAII1CbAH+7WtuOsFwEEqhcg+Kv/CACAAAK1CRD8te0460UAgeoFCP7qPwIAIIBAbQIEf207znoRQKB6AYK/+o8AAAggUJsAwV/bjrNeBBCoXoDgr/4jAAACCNQmQPDXtuOsFwEEqhcg+Kv/CACAAAK1CRD8te0460UAgeoFCP7qPwIAIIBAbQIEf207znoRQKB6gUfn83n1CAAggAACpQvMZrPlEvl5/EsKDhBAAIEqBPh5/FVsM4tEAAEEjADP+A0GhwgggEANAgR/DbvMGhFAAAEjQPAbDA4RQACBGgQI/hp2mTUigAACRoDgNxgcIoAAAjUIEPw17DJrRAABBIwAwW8wOEQAAQRqECD4a9hl1ogAAggYAYLfYHCIAAII1CDwaGiR/PyekAplCCCAQL4C9mf1BINflmYb5btUZo4AAggg4As0Br/f8PDw0C/iHAEEEEAgE4Ht7e3lTDs94yf0l14cIIAAAtkLtAY/oZ/9HrMABBBA4IRAa/CfaM0JAggggED2AtHg524/+/1lAQgggMApgWjwn2pNAQIIIIBA9gIEf/ZbyAIQQACBfgIEfz8vWiOAAALZCxD82W8hC0AAAQT6CRD8/bxojQACCGQvQPBnv4UsAAEEEOgnQPD386I1AgggkL0AwZ/9FrIABBBAoJ8Awd/Pi9YIIIBA9gIEf/ZbyAIQQACBfgIEfz8vWiOAAALZCxD82W8hC0AAAQT6CXT+RSz9ht1860uXnltO4s0333D6A+e03JYtG0YOhvaLDEkVAgggsBGBZIJfg9VXkICWlwa3X9/1XH77zLPPXjrRXMq6jOvPrWu/ExfjBAEEEEhEIPlHPRLW8mV/bdhQO/0m0rf/0H59r0N7BBBAYB0CSdzx21C3ITv0Dj0GZ8ePtfPrhvbzx+EcAQQQ2LRAEsHfhCBhGwp/v0z6S9u2xza2nx/k/uMcO2affjqunUvT2HIN207OeSGAAAJTCyT7qKcpEG0IWxwpl39zsP/2YOtjx6Fg1vax8UL9dH46l1AbHZt3BBBAYBMCSd/xa4gqjD3XO2up03J5t+XaL/Zug7lP36Z+MofQPPqMHZsvdQgggMCqAskFv4a4XVhbaEq97Re7S7fjdjlu+jcP7ds2N20X+mbQNrb25R0BBBAYUyC54PcXFwpWWybhOUbQ+2P682g6t99wQm1kXG2j7/ZaoT6UIYAAAlMKJBf8Q0Ix9TtnG/6ymXr3L9+wUp/7lB8+xkYAgc0IJBf8XRg0OLu07dpm6Jhdv1FpO73rH3q9ruuhHQIIINAkkPTf6pG7YfvVtAj7B61NbaYq1yC349syOdY12DZ6PMZjKh2LdwQQQKCLQFZ3/PaRiQ1XXajeVet5l/fYmLHxYv3864a+McXG9vtzjgACCIwpkOwdf2iRcufcFJi2XNp1fcXGjI0R62fnEhrD1veZa2gsyhBAAIG+AluLo5ffaT6fu9lsttY/ePQfeTQFot/On7ucS98u7fq2tdfqcw3bzz9uWqffjnMEEEBgFQGTiYus7vhl0RKUTWFp6/w2tk7xtE2oTtuE3of288fScfxyzhFAAIEpBZJ5xt83BLu0D7UJlSlwrE7bhN6H9guNRRkCCCAwtUB2d/xTgzA+AgggULoAwV/6DrM+BBBAwBMg+D0QThFAAIHSBQj+0neY9SGAAAKeAMHvgXCKAAIIlC5A8Je+w6wPAQQQ8AQIfg+EUwQQQKB0AYK/9B1mfQgggIAnQPB7IJwigAACpQsQ/KXvMOtDAAEEPAGC3wPhFAEEEChdgOAvfYdZHwIIIOAJEPweCKcIIIBA6QJZBv8nP/mr7sc/ea/0vWF9CCCAwCQCWQa/SHz1q39B+E/ykWBQBBAoXSDb4P/3d35A+Jf+6WR9CCAwiUC2wS8ahP8knwkGRQCBwgWyDn7ZG8K/8E8oy0MAgdEFsg9+ESH8R/9cMCACCBQsEP2du/fv309y6YvF4tS8JPx/+3d+37388lX31NlfO1VPAQIIIFCzwGw2Wy4/Gvy24bJHAgePPBL+F5V3/+Nf3DO/+wfuG9/4U/ebv/HrCcyUKSCAAALpCYQTNL15dp7RW299333lK19z//Wj/+7ch4YIIIBATQLFBf/P/syj7vtvfI/wr+lTzFoRQKCXQHHBL6v/6Ed/zn3vuzcI/14fBRojgEAtAkUGv2ze44//gvv773zrOPxr2UzWiQACCHQRiP7hbpcBUmjz058euo98ZPt4KvKHu7wQQAABBJoFsg9+Cf3HH99z//CPN92FZ59xW1tb7otffNF95sLvNa+aGgQQQKBigawf9Wjov330d/hf/uNXjrfxOzded195+c8q3lKWjgACCMQFsg1+G/ryd/Y/8clPuHff/ZH7+Md/8fj4n3/wr/GVU4sAAghUKpBN8L/wwgvLLXryV/aPH+/Inb7+h1qvvvpl9/nPf+G4zV/95dfcK3/y58v2uR/Ytcta5NwvW2WNY461yjzoiwAC6xFI7hm/H0LXr18/JfH2v/3TqTL5BvCpX/qUu3v3f9z+/i+7xx577FSbTRT469E5hNaldbwjgAACUwokE/wakKsE4t/97V+7Z575jDt3/rfct7/9N1O69R7brkvWKl+2rM+AQ/v511BzLdfzscbXcXlHAIG0BJIJfmFZNXA+9rHZ0R3/j9MSDsxG1qkhG6heW5F6y1zkS8/XNgEuhAACGxFIIvj7hKDfNhRWq7Zp699WP2Qn+4wpbf11h/prWaitlmkbmXNo3CFroQ8CCKQtkETwC5EGUYzLDyY5t2Vy7I81pI0/hp1T0zW6zF/H0THkXI9tf3/O2q/pPTSGtJUxtU77+ufaTt5DddqPdwQQKEcgm7/VI+Q2HEPnoTK/T9c20q7pFRqzqa2WS6jql5TZMeyxX6f92979MWLtbdum41h/6hBAIG+BZO74U2KUMNS7XxuMOket0/Mu76FxuvQbo43Md5PXH2MNjIEAAuMJEPwNlhqUodDUuoauSRXLXPUbVWgtSU2WySCAwFoEknjUY8NpLavucZGU59ZjGTRFAAEElgJJBL/ORu9M9XzIuz+Gfy5j+mX+ub1uqM4v889t/y7Hfn//fMgYtg/fvKwGxwggkMyjHgkneYVCT+vatkvb+WNoufTX41ibWJ30l3q/Tdvcmuq7zKepr5Y3zUnHtu30mHcEEKhXYGtx9PKXP5/PXaq/aN2fK+fdBOQblf+NoFtPWiGAQGECi6Qe9RSGm8xyCP1ktoKJIJCEQDKPepLQKGwSYz2OKoyF5SBQvQCPeqr/CACAAAKVCfCop7INZ7kIIICA4xk/HwIEEECgMoGNP+O/O3fuvYMj9cPK5FkuAgiMI7Dt3Nld5/Zn4wxXwygbDf7/vOfc199y7oybu50atFkjAgiMLvDgaMTvupl75dPOndsbffgiB9xo8N8+Cv5dd89d/wK7VeSni0UhsCaBP3r9nrt9b4/g7+i90Wf88nTn6N/SeCGAAAIrCUiOSJ6c+q9RVxq13M4bDf5yWVkZAgggkK4AwZ/u3jAzBBBAYBIBgn8SVgZFAAEE0hUg+NPdG2aGAAIITCJA8E/CyqAIIIBAugIEf7p7w8wQQACBSQQI/klYGRQBBBBIV4DgT3dvmBkCCCAwiQDBPwLrk0884eSLFwIIIJCDwEZ/ZMMQoFDA3nn//SFDjdYndH2ZZ6h8tIsyEAIIIDBQILvgl3X6gUrIDtx9uiGAQJUCWQZ/aKdC4W//7cB+s9ByWyZjNo2h7bTe72/P9VjHk3ftL8fysm38uoct+H8E6hP47IUL7s6dO6cWfvbcOXfz5k23tbV1qo6CYQLFPOP3A1TCVcr0qy1sbX2M0o4baqfXkzp7rG1tf6nvel3tzzsCpQpcvnIlGO7Xrl0LlpfqsI51FRP8FkvD1ZbJcVvI+kHc1t4fv+186LzaxqUegRIELl686LbPnPx5vc89/7zb3T36LSu8RhXIMvglQO2XBHbbK9SmS7CH+rVdq0/91OP3mQttEdi0wJUrLy6nIN8Erl69ujznYDyBLJ/xa1jGgjtWJ3wyRlub8Zg/HGkT1/zw6hwhkLbApUuX3Ldee80tFgv3pZdecjs7/G6+KXYsy+BXiFh46zcHbRt7lzDu0z42Vlvduq7TNg/qEUhRYDabOXnkc+v2D93nLl9JcYpFzCnr4Jcd0PAfK1B1PB27iF1mEQhkJHDx8kUnX/wtnuk2Lctn/CEO+wjFhrdta9tIeVM722fM46br+fMa85qMhUBuAmfPnnPyxWs6gezv+IUmFKhNZSFKaTvFSwPdjt9nXlPMiTERQACB7ILfhqjdvlB5qMz2keNQm1BZU9um8qYxmtpLOS8EEEBgHQLFPOpZBxbXQAABBEoQIPhL2EXWgAACCPQQIPh7YNEUAQQQKEGA4C9hF1kDAggg0EOA4O+BRVMEEECgBAGCv4RdZA0IIIBADwGCvwcWTRFAAIESBAj+EnaRNSCAAAI9BDYa/Cd/8naPWdMUAQQQ8AQkT/gdXR5Kw+lG/8vd/aPfr/DO3V33pdffa5gexQgggEC7wP+6ffeH/L6Wdqj/b7HR4D+/79z9w213+97ZzhOmIQIIIOALPLfnnOQJr24CW0e/8GDhN53P505+LjYvBBBAAIHiBBYbfcZfHCcLQgABBDIQIPgz2CSmiAACCIwpQPCPqclYCCCAQAYCBH8Gm8QUEUAAgTEFCP4xNRkLAQQQyECA4M9gk5giAgggMKYAwT+mJmMhgAACGQgQ/BlsElNEAAEExhQg+MfUZCwEEEAgAwGCP4NNYooIIIDAmAIE/5iajIUAAghkIEDwZ7BJTBEBBBAYU4DgH1OTsRBAAIEMBAj+DDaJKSKAAAJjCmQT/C+88MKY665mLNyq2WoWikBngY3+IpbQLP2gun79eqhZFmX+WvxJ57w2fy2cI4BAPgLJBL+GZElhaNey7vXp9fSjqOd2TlrHOwII1CWQTPALO6E03odPLSXw5UvPx7sCIyGAQK4CSQS/3o12QfTbhgJt1TZt/dvq29ah/f25S7mU2Xc7Vqh913od07bnGAEE6hRIIviF3g+10Hb44SXntkyO/bGGtPHHsHNpukaX+es4Gu56Lu86rpbJuR2z6zpsHxlLz/3x9Tq8I4BAfQLZ/K0e2RoNMd0m/3zMNnqN0HvouqF2fcvsuPZYxvHPm8rsNW0fe2zbcIwAAvUJJHPHnxK9hKTeIYcCU+tWnbOMExq/67hjzaPr9WiHAAJlCBD8DfuogRwKZ61r6NqpWMbQ4A5do8sgY8yjy3VogwACZQkk8ajHhmBqvCnPLTUr5oMAAnkIJBH8SqV3wHo+5N0fwz+XMf0y/9xeN1Tnl/nntn/suM83FbmGf4fvX9c/j12bOgQQqFcgmUc9Gmqh8NK6tm3Sdv4YWi799TjWJlYn/aXeb9M2t1i9zsm28cf320wxD3t9jhFAoFyBrcXRy1/efD53s9nML+Z8AgEJeD/UQ2UTXJohEUCgToFFUo96atsDAr62HWe9CKQhkMyjnjQ41jML/zHOeq7KVRBAAIGHAjzq4ZOAAAII1CXAo5669pvVIoAAAs7xjJ9PAQIIIFCZAMFf2YazXAQQQGDjf7h748YNdgEBBBBYWeD5559feYxaBth48As0G1bLx411IjCNADeQ/Vx51NPPi9YIIIBA9gIEf/ZbyAIQQACBfgIEfz8vWiOAAALZCxD82W8hC0AAAQT6CRD8/bxojQACCGQvQPBnv4UsAAEEEOgnQPD386I1AgggkL0AwZ/9FrIABBBAoJ8Awd/Pi9YIIIBA9gIEf/ZbyAIQQACBfgJJ/MiGPlN+8oknTjW/8/77p8pyK5B1lbCO3NyZLwI1CmQX/LJJfkASmjV+dFkzAggMFcgy+EOLDYW//bcD/5uFjmHbaJltq/W2TNoNuZ6OZa9jy/TYv5a25x2BkgU+e+GCu3Pnzqklnj13zt28edNtbW2dqqNgmEAxwe+HpR/M/rlwNZUNofTHajvXa+i8/fZazzsCtQhcvnLFvfrlL7vFYnFiydeuXSP0T4isflLkH+42haiU68sea9nQ9y7XGzo2/RCoReDixYtu+8z2ieU+d/Qz9nd3d0+UcbK6QJbBL0Frv/SuOcYRahMqi43Rpy409pjfbPrMhbYI5CJw5cqLy6nKN4GrV68uzzkYTyDLRz0aqrEgjdWNx/fhSG3X8+es5x+OwBECCFy6dMl967XXjh/3fOmll9zOzg4oEwhkGfzqIOHZFLjrDtau19N2Mm891vXwjkDtArPZzMkjn1u3f+g+d/lK7RyTrT/LRz1WQ8KzKfxtO44RQCAPgYuXL7pr177JH+hOuF3ZB7/a2PBv+mZg20i/tnNpE7or9/t1vZ6MxwsBBOICZ8+ec/LFazqBrB/1KEsoeJvK/D42xEN9tH1bu1BfKdOX7S9lts5vE6rTNrwjgAACqwpkF/xNoRgqD5VZsLZ6bRtq17UsNobWyXtoPFvPMQIIIDCWQDGPesYCYRwEEECgdAGCv/QdZn0IIICAJ0DweyCcIoAAAqULEPzeDvOs3QPhFAEEihMg+IvbUhaEAAIIxAUI/rgPtQgggEBxAgR/cVvKghBAAIG4AMEf96EWAQQQKE6A4C9uS1kQAgggEBdI4r/cvXHjRnyW1CKAAAIIjCawdfRrzk7+nrOjoefzuZMfj8oLAQQQQKA4gQWPeorbUxaEAAIIxAUI/rgPtQgggEBxAgR/cVvKghBAAIG4AMEf96EWAQQQKE6A4C9uS1kQAgggEBcg+OM+1CKAAALFCUT/Hr/8tU5eCCCAAAL5C9i/oh8Nftsw/2WzAgQQQAABEYgG/+HhIUoIIIAAAgUIbG9vL1fBM/4lBQcIIIBAHQIEfx37zCoRQACBpQDBv6TgAAEEEKhDgOCvY59ZJQIIILAUIPiXFBwggAACdQgQ/HXsM6tEAAEElgIE/5KCAwQQQKAOAYK/jn1mlQgggMBSgOBfUnCAAAII1CFA8Nexz6wSAQQQWAoQ/EsKDhBAAIE6BAj+OvaZVSKAAAJLAYJ/ScEBAgggUIcAwV/HPrNKBBBAYClA8C8pOEAAAQTqECD469hnVokAAggsBQj+JQUHCCCAQB0CBH8d+8wqEUAAgaUAwb+k4AABBBCoQyD6O3f7Ety7f+jeuv2Bu3tw6OSY12YE9s5su/3dbffpp37eyXHfl/yu5YODAyfvH3zwQd/u1bff2dlxZ86ccbu7u87+ntPqYQBIRmBrcfTyZzOfz91sNjv+B9+vazqXoH/ljXuOvG8SWn+5ZP7XL+31Cn8J+7t37x7vP8E1bM/0G6f8c7S/v0/4D2Ok18gC5iZkMdqjntffOSD0R96oVYeTb8KyL31e9+7dOw79vb09AqsPnGkr/4CJn9w8iScvBFITGC345fEOr/QE+u6L3K3KnT6v1QXEUTx5IZCawGjBn9rCmM8wgQcPHnCnP4zuVC+58xdPXgikJkDwp7YjzAcBBBCYWIDgnxiY4RFAAIHUBAj+1HaE+SCAAAITCxD8EwMzPAIIIJCaAMGf2o4wHwQQQGBiAYJ/YmCGRwABBFITIPhT2xHmgwACCEwsQPBPDMzwCCCAQGoCBH/Ljrz90lknX7zKFnjqqaecfPFCoAaBUX8651RgTcH7zDffm+qSjDuBQFOw3r59e4KrMSQCCDQJJH/Hv87Qb7pWEx7l3QUI/e5WtERgaoGk7/htEG/q7n5T151649c5vg197u7XKc+1EAgLJB38OuW28LXfIEJ9tF7G0WNpp+PaMnts2/ttbZ0dS451DO3TVib18rLtH5aU9f+x0LffHHTVtr3WS5keSzvbRs5tnZzLS9v4dVr+sBX/j0A9Ask/6mnbCg1Zv12o3C/zz/0xYud+X/881lfqQu1DZW3jlFIfCmE/qGWtfpk9t8fqouOG6kJl2o93BEoWyOKOv8sG2LvlWIBqO9tGyvRc6/tcU/t26eO3sdeTceTLlvntSz7XkJY1xkJZ2zW10fqQla2T/vJly0J9KEOgNIFigj+0MX6IjhmoY421yjeN0JpzLmsKcrumVUO6yzXs9ThGoESBooM/hw0b6xtIDmuNzVEDWYNdz2N9htTp+EP60geBUgSyeMY/9K6YUE3rYzpVmKe1SmaDQPoCSd/xS3Br6Ou7JbXBHqq3bbse23Hs+F3723Z2LFtuj0NtVr2uHT+FY7nL1tDXdzsvexceqrdtuxz7Y7SNb+u7jE8bBHIXSP6Ovy0Em+qbyps2rG/7pnGk3B/LPw+1iY1XQl3fcO3bXoxifWJ1JfiyBgT6CGwtjl5+h/l87mazmTs8PPSrGs+fff1uYx0VmxV48wv7nSdw69Yt9/TTT3duT8O4wDvvvOPOnz8fb0QtAmsQ2N7e1qsskr/j15nyjgACCCAwjgDBP44joyCAAALZCBD82WwVE0UAAQTGESD4x3FkFAQQQCAbAYI/m61ioggggMA4AgT/OI6MggACCGQjQPBns1VMFAEEEBhHgOAfx5FREEAAgWwECP5stoqJIoAAAuMIjBb8D7r/R77jzJxROgkM2Zc+/8V2p0lU2gjHSjc+g2WPFvyHQxImA6DcpzhkXw4ODnJfdhLzxzGJbWASAYERfzrnA/fgcNvtLH8cROBqFK1V4OH34ge9ryk/q0leu7u7zvx8j97j1NpB7vQl9NWxVgfWna7AaMH/9JO77ru3Do7CYsdtH/2PbwCb23QJ/MOj/x0cPHDPnd/tNREJew0tCa4HD/p/4+h1wQIb7+zsHK9K7MSTFwKpCYwW/K98eu84bCT8eaUhIKEv+9Lntbf3sD2PKfqonWyr3ywl9NXzZAvOENiswGg/llmXIT/J+e7Bfcd9ooqs/13uN/d3zxw9plnt2vfv319tgIp7nzlzpuLVs/QUBcxj28Vod/y6UAmbs3t86NUj53fCK+fdY+4INAuM9rd6mi9BDQIIIIBASgIEf0q7wVwQQACBNQgQ/GtA5hIIIIBASgIEf0q7wVwQQACBNQgQ/GtA5hIIIIBASgIEf0q7wVwQQACBNQgQ/GtA5hIIIIBASgIEf0q7wVwQQACBNQgQ/GtA5hIIIIBASgIEf0q7wVwQQACBNQgQ/GtA5hIIIIBASgIEf0q7wVwQQACBNQgQ/GtA5hIIIIBASgIEf0q7wVwQQACBNQhEfywzP499DTvAJRBAAIE1CMxms+VVGu/4+X2hSyMOEEAAgaIE/g/2LaZ2N5WHsQAAAABJRU5ErkJggg==) 12. Click **Continue**. The **Rewrite Policies** page appears. ![Citrix NetScaler Rewrite Policies](/assets/images/citrix-netscaler-rewrite-policies-c0f08344adaa66eb00230c9c9a1f6f2f.png) 13. Under **Select**, choose **Rewrite** from the drop-down list. #### Hide or modify the sign-in page on Netscaler server 12.1/13/0 1. Log in to the Citrix NetScaler server. ![Citrix NetScaler Login](/assets/images/13-citrix-netscaler-login-30ecdf5fb288fae636ef66d51ff32794.png) 2. Go to **System > Settings > Configure Basic Features. The Configure Basic Features page appears.** ![Citrix NetScaler Configure Basic Features](/assets/images/13-citrix-netscaler-configure-basic-features-b5d07e761ebb81acd3d5c0a142010f76.png) 3. Select **Rewrite.** 4. Click **OK**. 5. Go to **AppExpert > Rewrite > Action > Add. The Create Rewrite Action page appears.** ![Citrix NetScaler Create Rewrite Action](/assets/images/13-citrix-netscaler-create-rewrite-action-0dbe127114d43508a0b83f721bdb5a6e.png) 6. Enter the following values in the information fields described below. 1. **Name:** Enter any name for the rewrite action. 2. **Type:** `INSERT_BEFORE_ALL` 3. **Expression to choose target location:** `HTTP.RES.BODY(25000)` 4. **Expression to insert with:** `"//"` 5. **Search: Text:** `from.append(field_pass2)` 7. Go to **AppExpert > Rewrite > Policies > Add.** ![Citrix NetScaler Create Rewrite Policy](/assets/images/13-citrix-netscaler-create-rewrite-policy-8ed3212a8f01a600a092b4c9cf83aba8.png) 8. Enter the following values: 1. **Name:** Enter any name for the rewrite action. 2. **Action:** Add the step 3 rewrite action. 3. **Undefined-Result Action:** `-Global-undefined-result-action-` 4. **Expression:** `HTTP.REQ.URL.CONTAINS("gateway_login_form_view.js")` note Use the Expression Editor to create the Expression on step d. 9. Go to **NetScaler Gateway > Virtual Servers > Edit the added Virtual server > Add Policies to bind the above rewrite policy.** 10. Select **Rewrite** as the **Choose** Policy. 11. Select Response as the Choose Type. ![Citrix NetScaler Select Response Type](/assets/images/citrix-netscaler-select-response-type-81248ff2865076c11b986f2160100254.png) 12. Click **Select Policy**. The **Rewrite Policy** page appears. ![Citrix NetScaler Rewrite Policy](/assets/images/citrix-netscaler-rewrite-policy-291edf0dda91ac55f92186a15f9e927e.png) 13. Under **Select** the **Rewrite** policy.