This message was deleted.

Can you have an nfactor flow or AAA authentication policy that doesn't actually authenticate (no-auth) and leverage it to pass group extraction to an authorization policy?

Something like this: https://www.ferroquesystems.com/resource/howto-create-a-citrix-gateway-ssl-vpn-with-sso-via-kerberos/ Instead of Gateway just use an LoadBalancer.

Thank You @Martin Meier - I think I did see that site in my research but the gateway stuff kept me from digging into it too deeply. I finally managed to get it working. An authorization policy similar to what is described in this article was part of what I was missing. The other obstacle was cleaning things up from the various examples I was trying to coble together! Appreciate the contrib.