IE 6 and NFuse login failure

[sb2]

Our NFuse 1.6 with secure gateway environment has been working very well however a few clients have had the experience of successfully logging into the company environment from their home machines and then suddenly their login fails. They assure me that they did not make a change to the system...

They are using XP professional and IE 6 and were successful in using the citrix client about a half dozen times before the problem showed up, then tried reducing security setting to minimum, cleared caches and all history but it did not help. I had them remove the client and re-install it as well.

They were able to log on correctly using other machines so it was not the account. I suggested they install Netscape which they tried and it worked fine.

Initially I thought it might be a certificate problem, we use a verisign cert. However it seems to be more of an IE 6 issue. Does anyone have any suggestions?

 

[sb2]

forgot to mention one person sent a screen image of the IE session with the command at the bottom reading the URL of our NFUSE box\login.jsp?nfuse_loginErrorID=On which is where IE hangs.

 

[Jontmke]

Do they have the java machine installed? Microsoft had taken it off of XP SP1. Try re/installing either the MS or SUN java machine.

JON

 

[BeerGood]

Given it works with Netscape, it's quite possible that it is a certificate problem within IE - you could ask them to open up internet options/content/certificates, find your certificates and remove them manually so you can start from fresh so to speak....

Otherwise, check the standard windows error log on the server running the csg service - you can also increase the amount of info collected by running the csg install again. Also, when this problem happens ask the user to scroll the page down a bit and see if there is an error message in red on the web page itself.

Cheers

 

[sb2]

Jontmke good thought and I will have that tested, though I would think it wouldn't work at all for them instead of just quitting all of a sudden.

BeerGood, maybe I didn't test the cert side of things enough, when you suggest removing the certs would that be all of the verisign cert entries in Intermediate Cert Authorities AND Trusted Root Cert Authorities? I thought that IE came with some basic root certs for verisign. How do I know which ones to delete?

Our CSG is on Solaris, a bit more complicated to support - for a Intel person like myself!

The users do scroll down and there is no error except the note in the bottom ribbon of the IE windows saying "URL of our NFUSE box\login.jsp?nfuse_loginErrorID=On" which is where IE hangs.

Many thanks!

 

[BeerGood]

Definitely check the Solaris system log on the CSG server for errors that happen at the same time as the users are having problems. Check out

http://support.citrix.com/servlet/KbServlet/download/148-102-7750/Solaris_Secure_Gateway_Guide.pdf

for more info.

As for the certificates, if you're using Verisign certs then maybe I'd leave the root cert alone and just wipe the ones that you purchased from Verisign *if* they've been installed permanently onto the workstation. Actually, the thing you may want to try first in IE is click on the "clear SSL state" that might help reset things back to normal. Otherwise you can find a pc that works, export the certs from that, and then delete/import on the "bad" workstations - but you're right in that the Verisign root certs that come with IE should be ok so maybe just clearing the SSL cache might fix things......

Cheers