So with the iframe DUO/Netscaler feature being deprecated in a few months, it looks like the DUO recommended solution is to use the Single SignOn/Universal prompt technique, which #1 moves the authentication prompt from on prem to Duo's control plane. #2 requires you to have a FAS. I saw an article where someone was doing this all on prem with nfactor and edited auth schemas, but not 100% if that's supported and also dont think it would work well with Netscaler Standard edition licenses. Is there a supported scenario where we can still keep everything onprem?

That was @Michael Shuster NS as IdP to prompt user -> SaaS "IdP" Okta/Duo/Azure/etc as SP and IdP for MFA, Gateway as SP ping pong flow right? https://www.ferroquesystems.com/resource/howto-azure-mfa-saml-and-citrix-gateway-with-sso-without-fas/

I was thinking of this one. https://community.citrix.com/articles/security/leveraging-netscaler-nfactor-for-seamless-integration-with-duo-via-non-iframe-radius-r305/

ah havent seen this one

yeah, with standard you basically have to use the default auth schemas, can't edit anything.

I was going to mention the community article but great to see the Ferroque one as well. Those guys are pretty smart! 😜

Currently looking at this for a client as well. They have an Enterprise license on their NetScaler so the community nFactor article is going to be the way to go while still retaining the ability to do push or enter a code. If the end users only use push notifications to the app, then if using the DUO Proxy the reconfig script is simplest and the auth request is auto pushed as soon as the user hits logon after their password (https://help.duo.com/s/article/8408?language=en_US)

I recently had a look at this as well and there doesn’t seem to be a supported way to do it on a standard license because of the nfactor requirement for a custom schema

Yes, nFactor needs a higher license. There is a sort of exception that doesn’t work well for Gateway only IMHO. I wouldn’t try it.

yeah I saw you can do simple nfactor for gateway stuff, but this config uses a seperate aaa vserver which the standard license doesn’t seem to allow?

Very nice article, just don't think Citrix would support it and really don't want upgrades to mess with it.

Yeah that's not supported and my recommendation is for LAB-usage only... 😕

thanks @Aaron O'Reilly I hadn't seen this guidance (https://help.duo.com/s/article/8408?language=en_US). I do remember talking about it with one of the reps and it sounded sub-standard, which it does appear that it is. To sum this up there are 2 different options, radius_server_auto and radius_server_challenge (https://duo.com/docs/citrix-netscaler-nfactor-radius-challenge), both configs can be found here https://duo.com/docs/authproxy-reference#radius-auto. User Experience is def sub par to what it was before if you are using these, and enrollment is something that needs to be prioritized before first login.