29.10.2015
Error: "Cannot complete your request" in StoreFront
CTX133904
Error: "Cannot complete your request" in StoreFront
Article | Configuration, Connectivity, Third Party | Created: 26 Mar 2014 | Modified: 29 Oct 2015
Languages
English
Symptoms or Error
When accessing a store website on StoreFront, the following error message is displayed:
"Cannot complete your request. You can log on and try again, or contact your help desk for assistance."
Solution
Important! This article is intended for use by System Administrators. If you are experiencing this issue and you are not a System
Administrator, contact your organization’s Help Desk for assistance.
Note: The first step should be to review the messages in the Event Viewer on the StoreFront, and the local computer account
running the Receiver concerning the error "Cannot complete your request". The errors in the Event Viewer logs will provide you
guidance on where to start investigating the behavior on the sections listed in the article.
The article is layout into the following sections:
Certificate/IIS
Authentication
NetScaler Gateway Authentication
Load Balancing
AntiVirus/Firewall
Miscellaneous
Certificate/IIS
1. Verify the StoreFront server can resolve the StoreFront FQDN by pinging the FQDN from the command prompt.
http://support.citrix.com/article/CTX133904
1/6
29.10.2015
Error: "Cannot complete your request" in StoreFront
Configure the StoreFront Service to point to itself in a load balanced environment. For additional information, refer to the
product documentation: Load balancing with NetScaler In a single-server deployment, the Server Base URL must resolve to the StoreFront’s server local IP address.
2. Verify the StoreFront IIS server is bound to 443 and it is configured with a certificate corresponding to the FQDN.
3. Verify the common name of the certificate binding in IIS matches the StoreFront's base URL.
If the certificate does not match, issue a new certificate to reflect the StoreFront URL or change the StoreFront URL to match
the certificate. After performing the adjustments, run iisreset.
4. If accessing the server externally, validate the callback URL is configured correctly on the StoreFront Server.
The behavior can occur when the callback URL resolves to the wrong IP or the entered NetScaler Gateway FQDN does not
match the certificate on the NetScaler Gateway.
5. Verify that the server certificate and any intermediate certificate are installed on NetScaler Gateway and StoreFront server
6. If the same FQDN is used on both the NetScaler Gateway and StoreFront, refer to the product documentation Create a single
Fully Qualified Domain Name (FQDN) to access a store internally and externally
7. Verify if a third party tool has made changes to IIS on StoreFront server, such as Windows Updates.
Within the specific situation, the error appeared on IIS after a Windows Update “Details:
CertEnroll::CX509Enrollment::p_InstallResponse: ASN1 bad tag value met. 0x8009310b (ASN:276)”
In this example, the resolution was to uninstall and reinstall the certificate on the IIS server.
8. Verify if any legacy sites were upgraded to the latest version of StoreFront. In this example, an entry was found in the web.config file under "C:\inetpub\wwwroot\Citrix\Authentication" for the
"component id="pnaAuthenticationStartupModule". Backup the web.config file and remove the entry.
A uthe ntication
1. Check that the “User name and password” authentication method is enabled on the StoreFront server.
2. Verify the Base URL is configured with a FQDN “example.com” instead of NetBIOS “example”.
http://support.citrix.com/article/CTX133904
2/6
29.10.2015
Error: "Cannot complete your request" in StoreFront
3. Verify the Citrix Default Domain Services Windows Service is running. By default, the startup type will be set to Automatic
(Delayed Start). Confirm the service is running after the StoreFront server reboots. 4. Verify users do not have different names in Active Directory. For example, the user principal name (UPN) name1@domain
does not match the pre-Windows 2000 naming convention "down-level logon" domain\ABCname1.
Adjusting the down-level logon to match the UPN. For the example, the down-level logon would show in the user profile
as domain\name1.
For additional information, refer to User Name Formats.
NetScaler Gateway Authentication
1. Verify the Single Sign On Domain is configured correctly on the NetScaler Gateway.
2. NetScaler Gateway Single Sign-on (SSO) may not be passing the correct information due to incorrect configuration. Verify that
the following attributes are configured:
Server Logon Name Attribute: samAccountName
Group Attribute: MemberOf
Sub Attribute Name: CN
SSO Name Attribute: samAccountName
Security Type: PlainText
Note: When LDAP is configured as userPrincipalName, confirm that the SSO Name Attribute field shows the value
sAMAccountName when using StoreFront with NetScaler or NetScaler Gateway.
Follow the product documentation for pass-through for NetScaler Gateway: http://docs.citrix.com/en-us/storefront/3/sfplan/sf-plan-user-authentication.html
3. Verify the "No Rewrite Clientless" policy on the NetScaler Gateway is configured to use the expression TRUE.
4. In the event log on StoreFront server, the following error is displayed: "CitrixAGBasic single sign-on failed because the
credentials failed verification with reason FailedPasswordComplexity"
In this example, a network trace on NetScaler shows the following:
Inside the POST, the credentials are shown.
A blank password field causes the failure.
For client certification to successfully log on NetScaler Gateway two factor authentication, LDAP should be set as the
primary. Also, LDAP is required to be set to the primary in the session policy credential index.
5. For Domain users in a multi-domain environment. Add the SSO Name Attribute field as UserPrincipalName under LDAP
configuration and uncheck the Single Sign-on Domain for the authentication.
http://support.citrix.com/article/CTX133904
3/6
29.10.2015
Error: "Cannot complete your request" in StoreFront
Load Balancer 1. Verify the configuration for Method and Persistence in the Load Balancer Virtual Server section within the NetScaler
Set LoadBalancing Method to LEASTCONNECTION
Set Persistence to COOKIEINSERT
For additional information, refer to the product documentation: Load balancing with NetScaler
2. Verify the Load Balancer can resolve the base URL of StoreFront when one of the StoreFront Server is taken offline.
AntiVirus/Firewall
1. Verify if antivirus firewall is installed on the Storefront server. Disable antivirus firewall and test the connection. Exclude the
StoreFront ports within the antivirus firewall
Review the CTX101810 - Communication Ports Used by Citrix Technologies for the list of StoreFront ports.
2. If McAfee Enterprise antivirus protection is enabled on the Storefront server, randomly user accounts logging on will
generate the error message "Cannot complete your request". Typically, the first user account will always see this error.
Add the IIS process W3WP.exe to McAfee exclusion list and restart the server.
Click on the links for addition information.
https://community.mcafee.com/thread/74874
https://kc.mcafee.com/corporate/index?page=content&id=KB81595
3. Verify if NetScaler is using App Firewall. Test the configuration by disable the App Firewall. If successful re-enable the App
Firewall in learning mode, it can Learn and Allow the necessary StoreFront traffic.
4. If a proxy server is configured on the network, configure URL for the proxy is set correctly within the browser LAN settings for
the Use automatic configuration script setting.
http://support.citrix.com/article/CTX133904
4/6
29.10.2015
Error: "Cannot complete your request" in StoreFront
Miscellaneous
1. Verify the Credential Wallet service is not started or hung state. Ensure the Citrix Credential Wallet Service is set for a Delayed Start and started on the StoreFront server. Restart the Citrix
Credential Wallet Service.
2. The Credential Wallet component of StoreFront can prevent users from storing securely used password. When the password
cannot be stored using the Credential Wallet, the authentication process cannot complete.
Restart the Credential Wallet service on the affected server to restore the functionality. In certain situation, the behavior can
reoccur. To permanently resolve the issue, Citrix recommends upgrading to the latest StoreFront.
3. Citrix recommends allowing at least an additional 2 GB of RAM dedicated to StoreFront. The memory allocated to StoreFront
will be above the requirements for the operating system and applications installed on the server.
Refer to document for additional information: StoreFront Scalability Update
4. Verify Event Viewer error Event ID 7: Unhandled exception thrown for route "ExplicitFormsAuthentication/AuthenticateStart"
System.Configuration.ConfigurationErrorsException, System.Configuration, Version=4.0.0.0, Culture=neutral,
PublicKeyToken=b03f5f7f11d50a3a
The Forms Template Engine could not be found in the service locator.
at
Citrix.DeliveryServices.Authentication.Explicit.FormsCommon.Conversations.ExplicitConversationEngine.CreateConversationSt
ate(RequestToken requestToken, ITokenService tokenIssuingService)
at Citrix.DeliveryServices.Authentication.FormsProtocol.Conversations.ConversationEngine.StartConversation(RequestToken
requestToken, ITokenService tokenIssuingService)
Update the system environment variable directory: C:\Temp instead of D:\Temp.
5. It has been reported that using Microsoft "NLB" type load balancing with unicast mode might trigger this issue. Switching to
multicast mode helps resolve this issue.
Additional Resources
http://support.citrix.com/article/CTX133904
5/6
29.10.2015
Error: "Cannot complete your request" in StoreFront
CTX140281 - NetScaler Gateway to StoreFront Single Sign-on Fails with Error: “Cannot Complete your Request”
CTX200887 - Error: "Cannot complete your request" When Load Balancing StoreFront Through NetScaler
Applicable Products
NetScaler Gateway
StoreFront 2.1
StoreFront 2.0
StoreFront 1.2
StoreFront 2.5
StoreFront 2.6
Join the conversation
Open a case
CITRIX D ISCUSSIO NS
CITRIX SUPPO RT
http://support.citrix.com/article/CTX133904
6/6
">
