This message was deleted.

I believe you're eglible to use O365/Entra MFA via an Enterprise App in that scenario. You might lack some CA stuff, but I'd say that's your best option. If your users don’t have smart phones and you still need to support TOTP, there are apps for PC that can do the trick. We've faced this a couple of times. It's actually not too bad having the OTP app in Windows when logging in.

Thanks Kari, the issue is more like some users don't want to use their personal device including Windows. KeePass OTP plugin works great but it's not good for us. We are more thinking keep OTP for most users and for the other use something else. I was considering Yubikey with Fido but I am not sure how if it would work in our setup without having to buy extra licenses. I'll check the Enterprise app and will try to clarify what is our licensing. thanks!

If you're able to use FIDO2 with your current EntraID, you should be able to use it for NetScaler auth as well (NetScaler as SAML SP for Entra). As long as you're able to do the authentication stuff in Entra, you're able to trust it with NetScaler.

Indeed we only have EntraID free with O365 E3 so it's not good really. I don't really like buying an OTP fob key but it's prob will be cheaper than buying EntraID licenses (not sure what is the minimum) even if it's future proof. Fido2 would be better, I'll have to check the cost. Anyone using OTP physical fob?

Netscaler Native OTP?

Hi, you can difference between SAML / native OTP with a Group-Filtering using nFactor with AAA, all bound to your Gateway vServer, which is possible with adv / plat license. As you mentioned ADFS, so your AAD Domain is federated to your OnPrem ADFS? I'm not 100% sure if ADFS is supporting FIDO2 Auth, better check that.

Yes NetScaler Native OTP Kari. Thanks Julian. Noted for the group filtering, that's what I was hoping for! Also SAML would be for 2FA, I am planning to keep LDAP to avoid FAS. Yes our AAD is federated to ADFS. Ok I'll check out. I found an interesting blog here, reading through https://www.ferroquesystems.com/resource/howto-azure-mfa-saml-and-citrix-gateway-with-sso-without-fas/ I am still welcoming any help as Identify is not something I dive in depth yet!

We've done the similar setup with various approaches 1. Separate GW for each authentication methods 2. One GW; First factor for just entering username and then either redirect for SAML or passwd & otp challenge 3. One GW; showing login box for Native OTP users and then "login with your company creds" link to responder that writes a cookie in to browser session which then gets picked up by SAML policy

And you did this with similar setup than mine right? No FAS even for GW number 2. Thanks a mill for your help.

yeah... it's actually a good thing also continuity-wise, because there's no requirement for working PKI and so forth (have even created fallback scenario, where the SAML authnpol checks if the FAS server is reachable via service and if not then cascades to local auth for the internal users)

That's great I like that, this is why I don't want to go down the FAS road. Looking forward to your blog post! Thanks again

@Kari Ruissalo (WyW) I think I'm doing a similar config-flow. Just for clarification, in your flow (when doing SAML to AAD) the User has enter one time their OnPrem LDAPS PW for SSO to StoreFront/VDA, so no FAS is needed. Correct?

@Julian Jakob, I've had cases where corporate users authenticate using SAML and use a FAS enabled store, and due to licensing cost and/or challenges in inviting all contractors as guests to their Entra ID tenant, having a parallel GW with LDAP+Citrix OTP (an a store /wo FAS).