This message was deleted.

@Mads Petersen & @Jan Tytgat?

Maybe a reverse of allow specific group, then disallow the group (!(memberOf=CN=blabla))

You create a shadow AD group that update auto and you block it?

@jvitech I thought of this, but where can I block it?

Yes

I'll give that one a whirl, thank you guys!

I use it to block access to certain parts of MFA enroll on the NetScaler, so i use !(userParameters>=#@) to block those that already enrolled access to the enrollment site, which just check an attribute, but should also work with groups and such

what does the "#@" mean in that expression btw? "the value of "userParameters" is smaller or equal than #@"

Its been a while, but if i recall right the enrollment writes something like #@iPhone=BLABLABLA, so it requires something more than just #@

we have plenty of Citrix OTP deployed, but the string in that attribute is different depending whether you are encrypting the hash or not, and also, the "userParameters" attribute is never used here, so but there's no magic to it, it's just a string?

Or in the nFactor flow you check first if member of the AD group and then if member you skip the auth and it will fail.

The reason i made it like that, was the customer wanted to deny access to the OTP enrollment site, if they already enrolled once, so it was just an quick fix, and yes it was before they enabled encryption... been a long time 😄

we're doing so that if you haven't enrolled, you can enroll with just user/pass and once you have enrolled, you need to also enter MFA to access the /manageotp