Is anyone here using Duo for MFA on the NetScaler Gateway? We are still using the "classic" Duo interface which reaches end of support at the end of this year. The replacement is to leverage Duo's SSO and implement the Universal Prompt, switching to nFactor/SAML from basic auth policies & RADIUS. We implemented everything on the Duo side per their KB and it appears authentication occurs successfully - however, instead of enumerating the apps, a generic error is displayed. I found the corresponding error event in the logs on the StoreFront server, and it pointed me to a Citrix Communities discussion that basically states Citrix FAS + smart card auth enabled DC's are required for StoreFront to support SAML authentication, which I suppose makes sense thinking about the mechanics under the hood. Have others using Duo for MFA already migrated to Duo SSO/SAML that can verify the FAS piece is indeed required? Duo's documentation mentions nothing about it, which I suppose is understandable. We're using on prem Duo Auth Proxies pointing to on prem AD as the primary auth factor, for what it's worth.

correct, you'll need FAS here. Pretty much all SAML requires FAS to prevent the 2nd username/pass prompt when clicking a citrix icon. There are some articles explaining how to do it without, but support might be a bit more challenging.

Kind of what I thought, thanks. Carl Stalhood's documentation seems to make the steps to implement pretty cut and dry. I suppose SAML/SSO will be kind of nice, although I have hesitation generally about the added complexity just to support it now, since the FAS servers are obviously a fundamental component to being able to login. Whole new slew of things that have to be working right, beyond just Active Directory.

I 100% agree, there is another option to stay with radius/duo is using the radius_server_auto config in the authproxy. It's not great though, as it doesn't allow a nice GUI with choice to send push or text, nor does it allow the user to walk through enrollment. I will just auto send the push after they enter in their creds (they have to be enrolled). If that's not important to you, it might be worth a look. https://duo.com/docs/citrix-netscaler I think the 'challenge' method is downright hideous. But to each is own.

Yeah...that's an interesting thought. If it weren't for the fact we were Duo SSO-ifying a bunch of other applications and will have a common UI it's probably something I'd give serious consideration to. I just have an aversion to introducing complexity without good cause, which I don't really consider Duo EOL'ing the classic interface + RADIUS to be a good cause.

Yep FAS is needed for SSO

Duo say there is something coming out around august that won’t need FAS if you move to 14.1.

nice

Ah, good find thanks. I did see something about a native integration available on 14.1 but must’ve overlooked the fact FAS was also no longer a requirement with it. We JUST went to 13.1 lol, but if that means not having to introduce the complexity of FAS, I’d definitely entertain upgrading again to avoid it.