Netscaler will accept only SAM Account name for authentication with Radius client i.e. primary authentication on NetScaler, no LDAP VServer exists.
If user enter only samAccountname authentication fails with RADIUS. Radius server is Microsoft NPS & Azuure cloud. NPS server is in different domain that of user's domain.

Instructions

• Create authentication profile with a new authentication Virtual server (non-addressable) bound to it
• Bind the authentication profile to NetScaler Gateway Virtual server

• In AAA VServer:

1. create and bind a login schema and an advanced no_auth authentication policy as per the document https://support.citrix.com/article/CTX226488 for EULA

• Next factor policylabel for the above policy should have the following:

1. Login schema will be for “SingleAuth.xml”. 
2. Bind a NO_AUTH policy to this with the expression HTTP.REQ.URL.CONTAINS("/nf/auth/doAuthentication.do") and profile “NO_AUTHN”

• Next factor policylabel for the above will be for RADIUS with the following:

1. Login schema for RADIUS with username prefilled:

1. Set the policy in this policy label as the RADIUS policy configured
2. Click OK and Done

• Save the configuration