You may encounter the issue when login with iOS workspace app, user cannot connect to StoreFront after login NetScaler gateway.
In nstrace, you can observe the following symptom:
1. NetScaler responds iosc cookie to client:
POST /nf/auth/webview/done HTTP/1.1
...
HTTP/1.1 200 OK
Set-Cookie: NSC_VPNERR=1,iosc;Path=/;Secure
2. NetScaler responds 500 internal server error for AGServices discover.
GET /AGServices/Discover HTTP/1.1
...
HTTP/1.1 500 Internal Server Error
Content-Length: 71
Connection: close
Cache-Control: no-cache,no-store
Pragma: no-cache
<html><body><b>Http/1.1 Internal Server Error 43549 </b></body> </html>
Changing transparentInterception to OFF resolved the issue.
GUI: Session Profile > Client Experience > Plug-in Type = Java.
"transparentInterception" is set to ON in CWA session profile.