Authentication Failure When Password Contains £ Character

Authentication Failure When Password Contains £ Character

book

Article ID: CTX229089

calendar_today

Updated On:

Description

Authentication for 401 based failure is observed only on  iOS devices ,when the password contains £ character, it works for Form based authentication. Authentication for 401 and Form based is working fine without any issue on Android devices ,when the password contains £ character.

Coming to RADIUS:
Microsoft document , which is informing "Network Policy Server (NPS) does not support the use of the Extended ASCII characters within passwords"

https://docs.microsoft.com/en-us/windows-server/networking/technologies/nps/nps-best-practices#authentication

Environment

Citrix is not responsible for and does not endorse or accept any responsibility for the contents or your use of these third party Web sites. Citrix is providing these links to you only as a convenience, and the inclusion of any link does not imply endorsement by Citrix of the linked Web site. It is your responsibility to take precautions to ensure that whatever Web site you use is free of viruses or other harmful items.

Resolution

This issue has been fixed in below NetScaler versions, request you to please upgrade to a version containing fix for the issue:
12.0 56+
11.1 56_3+


Problem Cause

This issue is because we pass “as is” the password received from client, to the LDAP server. In some cases we need to convert password from Unicode-codepoints to UTF-8 to fix this issue.

Unicode codepoints for the range 0x00000000 - 0x0000007F pose no trouble: for characters in this range, codepoint == UTF-8 encoding. All ASCII numerals, English alphabets fall in this range. This is the reason why plain English usernames/passwords are interpreted correctly by the receiving auth(LDAP) server.
Conversion is needed for characters in the range beginning with 0x00000080. Umlauts (like ä, ë, ï ) and Arabic characters fall in this range. For these characters, codepoint != UTF-8 encoding. So we need to convert the codepoint to UTF-8 before passing on to auth server.