RSA Product Set: SecurID
RSA Product/Service Type: Authentication Agent for Citrix StoreFront
RSA Version/Condition:  1.0

Delegated Forms Authentication (DFA), has not been configured correctly on the Citrix StoreFront and NetScaler devices.

KB article 000067199-How to increase the chances of successfully configuring Citrix Delegated Forms Authentication (DFA) with the RSA Authentication Agent 1.0 for Citrix StoreFront  outlines that DFA should be configured and working successfully for password logons before attempting to add either SecurID passcode or RBA authentication.  The article will provide some details on how to do that on the Citrix StoreFront server through PowerShell. For full details, review the DFA Configuration document on the Citrix website.

1. Configure the Citrix StoreFront back to standard DFA, without RSA SecurID or RBA, in PowerShell with the command:

Set-DSDFAProperty -ConversationFactory ExplicitAuthentication

2. Test a Citrix logon through DFA with the default LDAP or AD password.  If it still fails, look at the Windows Event Log on the Citrix StoreFront server when you get the authentication failure such as "Cannot complete your request."  In one particular case we saw the following error:

3. On the StoreFront server, launch PowerShell and issue the following command to use a different, simpler passpharase:

Update-DSCitrixPSKTrustedClient -clientID <access_Web_agent> -passphrase <passphrase>

4. se the same less complex passphrase on the NetScaler:

5. Once you successfully logon to Citrix with an LDAP or AD password through DFA, you can change DFA to use SecurID in PowerShell.

Set-DSDFAProperty -ConversationFactory SecurIDAuthentication

6. Test SecurID with a fixed passcode.
7. If the test is successful, test again using RBA. Troubleshoot any script problems or RBA helper problems

See also 000066300 | How to increase chances for successfully implementing Risk Based Authentication on the RSA Authentication Agent for Citrix StoreFront